Observability, audit and recovery

Five records are kept apart, because they answer different questions. Merging them would make each one worse at its own job.

The five records

• Technical observability — logs, metrics and traces. Answers "is the system healthy, and where is it slow".
• Operation timeline — the durable state and the steps an operation went through. Answers "what happened to this specific transfer".
• Audit trail — administrative and signing actions. Answers "who authorized this, and with which key".
• On-chain evidence — receipts, transaction identifiers, confirmations, logs and UTxOs. Answers "what does the network say actually happened".
• Ledger — the financial impact. Answers "what does this mean for the balances".

A log line is not evidence of settlement, and a receipt is not an accounting entry. Keeping them separate is what lets each one be trusted for what it is.

What never appears in a log

Structured logs never contain master keys, private keys, access tokens, seeds, passphrases or identity documents.

Operational recovery

Recovery covers:

• backups, and restore drills that actually exercise them;
• rehydrating workers from durable state after a restart;
• safe replay of events, which is possible because consumers deduplicate;
• rebuilding projections from the durable source;
• reconciling from the blockchain when the internal state is incomplete.

The last one is the important one. Because the chain holds facts the platform did not produce, a damaged internal state can be rebuilt from what actually settled, instead of from what the platform believed.