Every record answers questions about time, whether or not it was built to. A balance is a statement about a moment. A medical history is a sequence of moments. A decision made by an agent on a principal’s behalf is defensible only if the system can later reconstruct what it knew, and when it knew it. Most stores keep a single clock (the moment a row was last written), and that single clock quietly conflates two different facts: when something was true in the world, and when the system came to believe it. This paper argues that the two must be separated, that two clocks are both necessary and sufficient, and that this separation is the load-bearing primitive of a context of record.
01 · The single clockA record with one clock must rewrite its past
Consider a fact that changes: a counterparty’s address, a risk rating, a contract value. In a store that keeps only the present, applying a correction is a destructive act. The new value is written where the old value stood, and the old value is gone. The store is now internally consistent and externally unaccountable: it can tell you what it currently believes, but it cannot tell you what it believed yesterday, nor reproduce the answer it gave when the decision that mattered was made.
This is not a tooling gap that a careful audit log patches over. An audit log bolted beside a destructive store records that a change occurred; it does not let the store answer questions as of a past state without replaying the log by hand. The deficiency is in the data model, and it propagates into everything derived from it.
Validity is one axis; knowledge is another
A bitemporal claim carries two independent time coordinates. Valid time is the interval over which the claim holds in the modelled world, when the address was the address. Transaction time is the interval over which the system held the claim to be its belief, when we recorded it, and until when we treated it as current. The two are orthogonal, and the orthogonality is the point: a correction discovered today about a fact that was true last year moves along the transaction-time axis without disturbing the valid-time record of what was previously believed.
Under this model nothing is updated in place and nothing is deleted. A correction closes the transaction-time interval of the superseded claim and appends a successor. A retraction is itself a claim. The store grows monotonically, and every state it ever held remains addressable by a pair of coordinates: (valid_time, transaction_time).
A record that keeps one clock must rewrite its past to stay current. A record that keeps two never has to lie about what it used to believe.
03 · Necessity and sufficiencyWhy two, not one, and not three
One clock is insufficient.With a single time axis the store cannot distinguish a fact that changed in the world from a fact that was recorded wrongly and later fixed. Both present as “the value is now different,” and an auditor cannot separate a legitimate update from a retroactive edit. Accountability requires that separation.
Two clocks are sufficient. Any question an auditable store must answer (what was true at time t?, what did we believe at time t?, what did we believe at time t′ about time t?) is a query over the two coordinates. The third question, the diagonal, is where single-clock stores fail and where bitemporal stores are merely a WHERE clause.
A third clock (decision time, ingestion time, and the rest) is occasionally proposed. It is never load-bearing: additional timestamps are attributes of a claim, recorded as provenance, not additional axes the store must index and reason over. Two axes carry the algebra; further times ride along as data.
What auditability formally requires
The test of a claim store is not how it behaves when facts are stable but how it behaves when they are corrected. Define as-of fidelityas the fraction of historical questions (“what did the system believe at time t?”) that the store can answer correctly after a sequence of corrections. For a single-clock store this quantity is strictly decreasing in the number of corrections: each correction overwrites a state some future query would have needed. For a bitemporal store it is invariant, because no prior state is ever destroyed.
This is why the substrate treats the claim, not the row, as its atomic unit, and why correctness here is established by property-based tests rather than examples: the invariant (append-only, no value ever overwritten, every coordinate reconstructable) must hold across arbitrary correction sequences, not the handful a fixture happens to enumerate.
05 · The atomic unit of the substrateEverything else is a projection
In the target end state the claims log is the system of record, and every other structure is derived from it and rebuilt on demand. The knowledge graph, vector indexes, search, briefs, and timelines are projections: label-aware views computed from claims, never the source of truth. Because the claims log is bitemporal and append-only, a projection can be rebuilt as of any transaction time and will reproduce exactly the beliefs the system held then. Drift between “what the graph says” and “what the record supports” becomes a detectable, correctable condition rather than a silent one.
The same property underwrites accountability end to end. Each claim carries provenance and boundary labels; the log is anchored to an append-only audit chain (Ed25519 signatures over a SHA-256 hash chain), externally verifiable and independent of the database that serves queries. An action an agent took, the beliefs it acted on, and the authority it acted under are all claims, all bitemporal, all replayable. The decision is reconstructable not because we kept a log of it, but because the record never forgot the world it was made in.
The argument in one line
- One clock conflates a changed fact with a corrected belief; an audit log beside it does not recover the distinction.
- Two clocks (valid time and transaction time) are necessary and sufficient to answer every as-of question.
- Append-only, bitemporal claims make as-of fidelity invariant under correction.
- The claims log is the atomic unit; graph, vectors, and search are projections rebuilt from it.
Notes
- “Bitemporal” follows the usage settled in SQL:2011 and the temporal-database literature (Snodgrass and others): valid time and transaction time as two independent intervals.
- The store of record is PostgreSQL with explicit bitemporal columns; the append-only invariant is enforced and verified by property-based tests, not by convention.
- The continuity loop, the boundary lattice, and the authority model are treated in the companion architecture notes and in the context-of-record specification.