Immutability
Answers are written once. Neither the partner nor Moyo can edit or delete them.
Answers are appended to a write-once table. A database trigger refuses any update or delete, and the role the application connects as has those privileges revoked outright, so a bug or an injection in Moyo itself cannot rewrite an answer.
What that is, and is not
It is enforcement, not physics. Someone with owner access to the database could disable the trigger. What that would not do is go unnoticed: readings are hashed daily into a snapshot, each snapshot names the digest of the one before it, and the exact bytes that were hashed stay published. An altered history has to survive recomputation by anyone who kept an older digest.
Pausing check-ins or closing an account stops new collection. Answers already collected stay as they are, and a partner that has ever collected one cannot be deleted.