the ledger could not say why nothing happened

An independent reviewer was asked a deliberately unfriendly question about the decision log: not whether it recorded the right outcomes, but whether a reader could tell from the record alone why nothing happened at a given moment. The finding was that they could not, in several distinct ways.

Some halts wrote nothing at all, so an operator reading the log saw the same emptiness during a deliberate halt as during a healthy quiet period. Some closes were recorded as successful when the corresponding request had never completed, so the log contained outcomes that did not occur. Some decision passes aborted silently, leaving a gap exactly the width of a pass. Each is small. Together they make the log unusable as evidence, because a record that cannot show refusal cannot be trusted to show action either.

The response was not a patch to one path but a vocabulary: a distinct reason code per refusal cause — suppression by an event window, a close-before-idle rule, a request that was pending and later filled, a feed judged stale, a rehearsal that must not be mistaken for a live action. Each code carries its own tests.

The audit ran in the opposite direction from the engineering work, and that is why it found anything: it asked what the record could not express.

It proves the audit trail is treated as a product with a correctness standard of its own, not as exhaust.