Immutable ledger corrections

Design how an append-only, immutable financial ledger handles MISTAKES: a posting was made with the wrong amount, to the wrong account, or duplicated. You can never edit or delete a posted entry (audit + regulatory requirement), yet the balances must end up correct. ~10M postings/day. How do you model corrections, keep the audit trail intact, and make sure a correction is itself idempotent so a retried 'fix' doesn't over-correct?