The evidence chain
A published figure is traceable back through claim → evidence → analysis run → dataset → study → instrument → responses. Provenance entries are hash-chained, so a broken or reordered chain is detectable rather than merely unlikely.
Promotion is written once
Promoting an analysis result into the evidence chain is idempotent: a repeat promotion of the same result into the same report writes nothing and says so. Lineage is a fact recorded once.
Retention, erasure and legal hold
These are an executable lifecycle — dry run, approval, governed execution, per-class audit record — not a settings page.
- A legal hold blocks an approved erasure, and holds are re-evaluated at execution time rather than at approval time.
- The absence of a retention policy means preserve. It never means permission to delete.
- Audit and evidence records cannot be given a deletion policy. The record of an erasure outlives the erasure.