Every operation, chained.

Each entry's SHA-256 covers its parameters and the previous entry, so any edit breaks the chain. Settings and receipts stay on this device.