One way to think of the difference between an "append-only" ledger and one that isn't (e.g. LCR without checkpoints) is the difference between a strict teacher that allows no late work and a soft teacher that allows late work just the same.  Half way through the semester, a clever student in the soft teacher's class who hasn't done any work can still pull off a perfect total score in the class just by cramming at the end, turning in all homework, and getting all previous zeroes turned to perfect scores.  It's a function of what rule the system uses - does it allow previously confirmed ledger entries to change or not? Trustless or not.  Right?

I guess it is assumed that you are watching for rule violations constantly.  Always block such violations, and your copy of the ledger remains append-only.