the changelog is the last witness

The tree is assumed to be the truth about what is running, and occasionally it is not. Somebody changes a running system by hand, the change works, no failure forces the tree to catch up, and from that moment the source and the machine describe different systems while both continue to look healthy.

This happened in a small updater: the deployed program contained a change that existed nowhere in the repository. The next person to rebuild from source would have produced a system quietly missing it, with no build error and no test failure. The difference would have appeared later, as behaviour, in a system nobody had reason to suspect.

The response was to write the divergence down where the next reader would be. The change record carries a provenance note beside the code change: the deployed artifact is ahead of the tree in this specific respect, and it must not be rebuilt until that logic is restored. That note is the only place the fact exists. The alternative is that it lives in the memory of whoever made the edit, which is how a system acquires an oral history and then loses it.

Two smaller things make the record usable rather than decorative. It is numbered into the hundreds with one entry per change, so a gap is visible as a number that is missing rather than as a silence. And entries carry absence as well as change: one records, explicitly, an interface the system does not implement and what was built in its place, which is a fact a future reader would otherwise spend a day rediscovering.

What it proves is that the record is treated as part of the deployment, not as an account of it.