Fable
Which page the ledger must be lost at before it can still survive
The seaside merchant guild had a large ledger recording orders, receipts, shipments, and debts. Every day after closing, the old accountant made a copy and locked it in an iron cabinet. He felt that as long as the cabinet was thick enough, the business would not be lost.
Later the chamber of commerce changed to handling matters on arrival. Morning fish was sold to out-of-town boats by noon, afternoon cloth was loaded onto carts by evening, and prices changed several times a day. The ledger no longer moved only once a day as before; it changed every moment like the tide.
One day the warehouse flooded and the main ledger was soaked to pieces. The copy in the iron cabinet was intact, but it stopped at last night. The afternoon's three hundred fish transactions, a dozen credit contracts, and several price changes were all gone. Merchants crowded at the door, and no one accepted 'everything was still there before last night.'
The chairman's first instinct was to make several copies and store them in three cabinets. The accountant reminded him: if all three cabinets only copy last night's ledger, today's will still be lost. The real question to ask first is: in a disaster, how much ledger loss can we tolerate at most? A whole day, two hours, or half a tea break?
The guild divided goods into three tiers by weight. Ordinary sundries were copied once per night; credit accounts and bulk goods were copied once every two hours; fish catches and shipping contracts under active bidding were written to the shore-side duplicate ledger immediately after every few transactions. More frequent copying was more laborious, but it matched the cost of loss.
Later they encountered a rainstorm, and the main ledger was down for half a shichen. The chamber of commerce recovered from the duplicate register and only re-asked about a few prices just transacted. Only then did the old accountant understand that backup is not just about whether there is another copy, but about how far back you are willing to return after a disaster. That tolerable point in time determines the rhythm of daily ledger copying.
Later, a new apprentice asked why they didn't copy every ledger every moment. The old bookkeeper took him to see the copyists and the price of paper: overprotection also slows down business. The guild first needs to know which ledgers can be recovered if lost for a night, and which would trigger compensation if lost for a moment. Different businesses can tolerate different rollback points, so the copying cadence differs. Clarify this point before a disaster, and after the disaster no one will be arguing in a heap at the docks. Later the guild wrote these tiers into its rules, so everyone knows which moment they might return to after a disaster. Once the tolerable loss is clear, backups no longer rely on imagination. The shorter this point, the higher the everyday cost; the longer, the bigger the post-disaster dispute. This is not a small bookkeeping matter, but a business commitment. Copy frequency is really setting boundaries for loss.