A municipal finance office must post multi-row ledger entries that either all commit or all roll back across related accounts. Which store is the most appropriate primary system?

Municipal ledger posting requires multi-row atomicity: related account lines must all commit or all roll back so public financial statements stay balanced. A relational database with strong multi-row ACID transactions is the appropriate primary system for that integrity pattern. Key-value caches that expire rows after minutes optimize ephemeral lookups, not durable double-entry ledgers, and TTL would silently erase fiscal history. Graph databases excel at relationship traversal such as fraud rings, not at guaranteeing cross-account debit/credit atomicity for statutory books. A write-only append log without transactional rollback can retain events for analytics, but it does not by itself provide the all-or-nothing posting semantics finance controllers demand for day-to-day ledgers. Exam caveat: CAP and NoSQL scale arguments do not erase ACID needs; BDPC-style syllabi still place strongly transactional civic finance on relational engines even when profiles or sensors live elsewhere. Operational check: post a multi-line journal in a test ledger, force a failure mid-batch, and verify no partial balances remain visible to reports or the citizen payment portal. In production terms for multi-row civic ledger atomicity, assign an owning team, wire a dashboard that shows the pattern is healthy under peak civic load, and require a staging drill that rehearses failure and recovery before resident impact. Revisit the choice when traffic shape, retention, or integrity needs change, and keep a named rollback owner on the change record. Re-test both the happy path and the failure path for multi-row civic ledger atomicity after material dependency upgrades so regressions are caught before the next public release.