Every record answers questions about time, whether or not it was built to. A balance describes a moment. A maintenance history is a sequence of moments. A decision an agent made for an operator can be defended only if the record can later show what it knew, and when. Most stores keep one clock, the moment a row was last written. That clock mixes two different facts: when something applied, according to its source, and when the record came to know it. This paper argues that a record has to keep the two apart, and that two clocks are both necessary and sufficient.

01 · The single clock

A record with one clock rewrites its past

Take a fact that changes, such as the status of a valve, a risk rating or the revision of a procedure. In a store that keeps only the present, a correction destroys data. The new value overwrites the old one, and the old one is gone. The store can say what it believes now. It can’t say what it believed yesterday, or reproduce the answer it gave on the day of the decision.

An audit log next to that store doesn’t fix this. The log records that a change occurred. It doesn’t let the store answer a question as of a past date unless someone replays the log by hand. The fault is in the data model, and everything derived from the model inherits it.

ONE CLOCKVALIDITY ONLYwas: Acorrectedvalue = Bt₀t₁nowThe prior belief is gone. The storecan't say what it said before t₁.TWO CLOCKSVALIDITY × KNOWLEDGEcorrected at t₁recorded · T₁Arecorded · T₂ABt₀t₁nowBoth beliefs remain addressable. Query anytransaction time; reconstruct any past.
Figure 1. One clock overwrites history. Two clocks append to it. Schematic.

02 · Two clocks

Validity is one axis and knowledge is another

Every entry in the Syderial journal has two independent clocks. Valid from and valid to mark when a claim applied, according to its source. Recorded at marks when the record learned it. Suppose a failure found this morning began last night. The correction moves the claim earlier in the world and later in the record, and both positions stay visible.

Nothing is updated in place and nothing is deleted. A correction is a new entry that cites what it corrects, and a retraction is also an entry. The journal only grows, and every state it has ever recorded stays addressable by two coordinates: (valid time, recorded at).

7Q4N-0190Observation

V-204 in service

quote · shift log, 2 Feb, line 14

valid from
2026-02-02 06:00Z
recorded at
2026-02-03 08:10Z
posting lane
import · receipt
signed
ed25519 · prev 41ab…c3e0
7Q4N-0193Observation

V-204 status failed

quote · sensor log, start 1482, end 1611

valid from
2026-03-11 09:14Z
recorded at
2026-03-11 11:02Z
posting lane
reader · receipt
signed
ed25519 · prev 9f1c…a204
7Q4N-0201Adjustment

V-204 failed from 22:40

pointer · entry 7Q4N-0193, valid from

valid from
2026-03-10 22:40Z
recorded at
2026-03-14 08:30Z
posting lane
principal · receipt
signed
ed25519 · prev 7d02…19e8
Figure 2. Three entries in the journal, in posting order. The adjustment moves the failure earlier in the world and later in the record. Both clocks stay visible. Examples are illustrative.

A record with one clock has to rewrite its past to stay current. A record with two never has to misstate what it used to believe.

03 · Necessity and sufficiency

Why two clocks, and why no more

One clock isn’t enough. With one time axis the store can’t tell a fact that changed in the world from a fact that was recorded wrongly and fixed later. Both look like “the value is different now”, and a reviewer can’t tell a legitimate update from a retroactive edit.

Two clocks are enough. Every question a reviewer asks is a query over the two coordinates. What did the sources say applied at time t? What did we know at time t? What did we know at time t′ about time t? Single-clock stores fail on the third question.

Other times, such as decision time or ingestion time, are attributes of a claim and belong in its provenance. The record stores them as data. It doesn’t index or reason over them as extra axes.

04 · Reconstruction under correction

What a reviewable record requires

The test of a record is how it behaves when facts are corrected. Call as-of fidelity the share of historical questions (“what did the record know at time t?”) it answers correctly after a series of corrections. For a single-clock store the share falls with every correction, because each one overwrites a state a later question needed. For a two-clock journal it stays at one, because no prior state is ever destroyed.

025507510002468CORRECTIONS APPLIED →AS-OF FIDELITY (%)invarianthistory degradesbitemporal storesingle-clock store
Figure 3. As-of fidelity survives correction only with two clocks. Schematic of a formal property, not measured data.

05 · Everything else is rebuilt

The journal is the record, and the rest are views

Syderial rebuilds graphs, indexes, briefs and timelines from the journal, and none of them is a second record. Because the journal keeps both clocks and is never edited in place, a view rebuilt as of any moment shows exactly what the record knew then. When a graph and the record disagree, the disagreement shows up and can be corrected.

Each entry is signed with Ed25519 and chained to the one before it. Independent RFC 3161 timestamp authorities anchor each chain, and it verifies offline. An action an agent took, the claims it acted on and the policy it acted under are all entries, all on two clocks, all replayable.

Notes

  1. “Bitemporal” follows SQL:2011 and the temporal-database literature (Snodgrass and others), where valid time and transaction time are two independent intervals. Syderial calls the second clock “recorded at”.
  2. Examples in this paper are illustrative. SYD-TR-2026-002 covers information flow control and the labels on every entry.

← All researchHow it works →