The quickest way to lose a customer's trust is a number you cannot explain. A displayed balance is a claim on your business; if support has to guess how it got there, the customer is right and you are wrong. Ledger design is trust design.
Treat the balance as derived, never stored. An append-only ledger where every grant, purchase, debit and adjustment is one row means the current balance is simply the last row's closing value — you can cache it for speed, but the ledger wins every disagreement. Every write carries a reference, so the same invoice can never grant twice and the same debit can never replay.
Make the illegal states unrepresentable, not just discouraged. No overdraft, no duplicate grant for a verified invoice, and every staff adjustment carrying a reason plus an immutable audit record. Rewriting history should be refused at the database layer, not argued about in a support thread.
This is also what makes support fast. "Why is my balance this number" becomes a lookup instead of an investigation, and a billing dispute becomes two citations instead of a reimbursement. The paper trail is not overhead; it is the feature that lets you move quickly later.