ADR 0162: The logbook records its full vocabulary from day one, as evidence rather than inference

Amendments.

• ADR 0166 — identity: the driver vocabulary now accretes source-labelled coding-agent hints and bounded MCP client metadata. It still stores no agent verdict, confidence, or behavioural branch. The rest of this decision is unchanged.
• ADR 0194 — consent vocabulary: verb events now carry optional consent evidence lifted from successful acceptance results. Its source comes from the canonical conversation, standing-grant, and effort-grant vocabulary; standing-grant evidence may also carry the covering scope names. The recorder still stores evidence rather than inference.
• Partial effect (2026-07-28): verb outcomes now distinguish partial from failed and refused. A partial acceptance carries the four booleans from data.landing so the event records which recovery, trunk, worktree-removal, and branch-deletion effects happened. Rotation digests preserve a separate partial count; red-rate history treats partial effects as red work.
• ADR 0319 — Gate execution: done events carry gate_ran; explicit same-state probes record rerun, while the --confirmed compatibility path retains its historical flag. Readers can distinguish Proof reuse from measurement without inferring from timing or steps.
• Launch contract (2026-09-03) — Gate rerun input: current writers record only the rerun flag. Readers continue recognizing historical confirmed flags already present in local Logbooks, without exposing that spelling as input.
• Launch contract (2026-09-03) — validation evidence: the registered current test and done writers always attach validation evidence. Validation-less historical lines remain readable and unattributed, but no longer create a legacy evidence class or public result fields.

Status: accepted

ADR 0160 decided the logbook substrate. The first implementation recorded a lean event: verb, surface, branch, HEAD, cleanliness, a binary outcome, durations, diagnostic classes, and the config epoch. Reviewing it against the readers to come (waves 2–3) surfaced a structural fact about timing. The event schema is loose and versioned, so any field can arrive later without breaking a reader. But a field added after launch means every early adopter's first months of history can never carry it, and that early corpus is exactly what the first detectors tune on. The launch window is therefore the one moment "record it later" and "record it never" are the same decision for the data that matters most. The product ships in days.

Each specific gap was unanswerable retroactively. ADR 0160 promises the limit trajectory "reads straight back out of the logbook", yet pins recorded no values anywhere. Measured standard values evaporated after each gate run. Nothing distinguished a refusal from a red gate — the dogfood corpus shows done refusals indistinguishable from failures. surface cannot separate human from agent, because agents drive the CLI per the guidance. No event named the discern version that wrote it. Nothing recorded the scale of the change, so every longitudinal number lacked its denominator. And rotation deleted months wholesale, killing any trend longer than the retention window.

Fill the vocabulary before the first release, and record evidence, never inference. Every event names its writer (the discern version). Verb events gain raw driver signals: a session hint, --json, terminal, CI. These are facts a reader scores, never a stored "was this an agent?" verdict — a stored verdict would fossilize the day-one heuristic into immutable history. They also gain a four-way outcome: ok, failed after work ran red, partial after an irreversible effect preceded an error, and refused when the verb declined to act. The gate's failed_stage and touched scopes land beside it. So do the change's scale against the trunk merge-base, a dirty-diff fingerprint, the verb's target (a help topic, a map page — what agents look up is the purest guidance-gap signal), flag names (never values), per-standard readings (limit and measured value — the metric trajectory), and an update's counts. A standards --pin lands one first-class pin event per tightened limit, carrying the old bound, the new bound, and the measured value. That is the trajectory the epoch machinery masks, delivered through its own door as ADR 0160 promised. Retention doubles to 24 months. Pruning digests each removed month (totals by verb and outcome) into the prune event, so coarse trends outlive the raw lines.

Everything lifts from existing machinery — the envelope's steps, GateData, and the standards verb's new data.standards/data.pinned payload. The recorder measures nothing itself, and lifts by shape rather than verb name. The metadata bar is unmoved: every field is a name, a number, or a slug, safe to read aloud.

The explicit nos hold. No vendor attribution — a neutral session hint is not a vendor guess, there is still no cheap honest signal for vendors, and a wrong guess poisons the corpus worse than none. No payloads. No derived scores in the store. No env harvesting beyond the conventional CI marker.

• The early corpus is complete. Day-one adopters accumulate the fields the wave-2 detectors need. Nothing about the launch cohort's history is second-class.
• The compatibility surface grows once, at the cheapest possible moment — before any released reader exists. The substrate-era minimal line remains readable forever (pinned by test), and fields only accrete.
• Readers own interpretation. Driver scoring, task segmentation, and flake detection are reader logic over raw signals, revisable across the whole history. This is the substrate/reader split of ADR 0160, applied to the schema itself.
• The trust page's read-aloud bar now covers more fields — all still names and numbers. The no-network guard and footprint inventory are untouched.

• Ship the lean schema, enrich in a point release. Rejected: additive fields are technically free later, but the launch cohort's missing months are unrecoverable, and the first corpus is the one the first detectors are tuned on.
• Store a driver confidence score. Rejected: a stored inference freezes the scoring heuristic at write time. Raw signals let a better future reader re-score all accumulated history.
• A pin field on the verb event instead of its own kind. Rejected: the trajectory is a first-class series (one row per tightened limit), and a dedicated kind keeps it readable without unpacking verb events.