Why We Rebuilt Records Storage Around Append-Only Evidence

Mutable records storage made an old, uncomfortable question hard to answer: what did the system actually know when it made this recommendation, six months ago?

Moving to an append-only evidence log, with derived findings referencing immutable source events by ID, made that question answerable by construction rather than by audit.

The migration touched every service that reads clinical data. We shipped it behind a dual-write flag over eleven weeks before cutting reads over.