Examiner windows are long; logs must mean the same thing months later
Durability of meaning — a field name is a contract with the future.
A log that outlives the system that wrote it is the only log an examiner can use. The hard part is not the bytes; the hard part is the meaning.
Examiner windows are long. A decision made in January is reviewed in October, by which time the model has been swapped, the pipeline has been refactored, and the engineer who wrote the logger has left. The bytes of the log may survive; the meaning of the fields often does not. A field called "score" that meant one thing in January and means a different thing after the refactor is a log that lies about its own past — and an examiner who reads it as if it were consistent is reading fiction.
Meaning is the contract with the future
The durability problem is not storage; append-only, hash-chained storage (BR-842) solves the bytes. The durability problem is semantics: a field name is a contract with the future reader, and that contract breaks the moment the field’s meaning drifts. The defense is typed, versioned schema: a NodeVersion is a NodeVersion in every release, an AxisOverride is an AxisOverride, an AuditManifest is an AuditManifest. The types are the guarantee that the field means the same thing months later, because the type is the meaning, and the type does not get silently redefined.
Why the substrate has to carry it
A documentation page that says "score means the calibrated probability" is not durable meaning; it is a claim about meaning that drifts the moment someone edits the page. Meaning that survives an audit window has to live in the substrate: the manifest records the schema version alongside the output, so a reader months later knows which schema the fields were written against. The replay anchor does not just reproduce the bytes; it reproduces the interpretation, because the schema version is part of what is reproduced.
The bytes survive the upgrade. The meaning usually does not. A field name is a contract with the future, and the future does not honor contracts that were only written in a wiki.
The three tiers all point at durability
Every tier reaches for durable meaning, each in its force. The EU AI Act (binding law) requires logging that survives the system’s lifetime for high-risk AI. SR 11-7 (supervisory guidance) expects model risk records to be retrievable across the model’s life. NIST AI RMF and ISO/IEC 42001 (voluntary) document lifecycle governance. None of them tell you how to keep meaning stable across a refactor — that is an engineering obligation, and it is the one the typed substrate carries.
- Bytes are solved by append-only hash-chained storage; meaning is solved by typed, versioned schema.
- The schema version is part of the manifest — replay reproduces the interpretation, not just the bytes.
- A wiki page is not durable meaning; a type is, because the type does not get silently redefined.
- All three tiers reach for durability; only the substrate can deliver it.
What durability does not promise
Durability of meaning does not promise the decision was right; it promises the decision is interpretable months later. The manifest attests provenance and reproducibility, not truth — Certified ≠ True. Accuracy is a calibration loop gated by Gate 1 (reproducibility) and Gate 1b (beat a disclosed baseline), and we are pre-revenue, building the POC, with the loop inert until it is filled. But the one thing an examiner cannot excuse is a log whose meaning has rotted, because that log cannot be read at all — and the typed substrate is what keeps it readable.
An examiner can accept a decision that was wrong, reviewed, and corrected. They cannot accept a decision they can no longer read. Durability of meaning is the floor of defensibility.
— audit window note