Provenance Log

Tempe is this pattern working, and it is worth being exact about why. The system recorded what it detected, how it reclassified the object as the seconds ran down, and the brake command it held back, so the sequence could be established afterwards from the machine's own account of itself rather than from anyone's recollection.³ The record outlived the event. That is the whole requirement. UN R157 now writes it into type approval for automated lane keeping: a data storage system that has to log activation and deactivation with their reasons, every transition demand, suppressed driver input, emergency manoeuvres, detected collisions, minimum risk manoeuvres and severe failures, each entry stamped with the software version that produced it.¹

Horizon is the cautionary half, and it fails somewhere more specific than it is usually remembered as failing. The Post Office maintained in court that branch accounts could not be changed remotely.⁵ Fujitsu engineers could in fact change them, and an engineer's evidence to the inquiry was that such a change need not look any different from the subpostmaster's own entry.⁶ None of that is a storage problem; the data was all there. A log the other party to a dispute can write to on the same footing as the operator is not evidence of anything, which is why the useful version of this pattern puts the record outside the reach of everyone who can change the state. The second requirement is easier to miss: the record has to be legible to the person whose work it describes, while they can still remember the day in question. A log that only an investigator reads, years later, protects the institution rather than the operator.