The ledger holds only the root — a fingerprint of the whole batch. What was bought stays private; that it existed, unchanged, at this time is public.
For auditors: the path from this receipt to the ledger root
Path from this receipt to the root
sha256 of the receipt's canonical JSON gives its fingerprint. Each step pairs it with a sibling (left or right) and hashes again; an odd node pairs with itself. The last result must equal the root above.