Every action in the back office and the engine writes one row: who, when, what, a summary, the entity it touched, the case it belongs to, and whether the family can see it. One function writes rows; nothing in the codebase edits or deletes one.

​
The chain

Each row carries the SHA-256 of the previous row’s hash plus its own canonical content. Remove a row and the sequence has a gap; edit one and every hash after it stops matching. Verify chain recomputes the whole chain from genesis in the browser and reports either Chain intact with the count and the latest hash, or Chain broken at #n with the problem.

​
Reading it

Filter by entity (case, account, step, document, provider, playbook, research, rule, operator, knowledge base) and choose how many rows to show. Each row shows the sequence number, when, who (an operator’s email, engine, or family), the action key, the summary with a link to the case, and the first characters of its hash. Rows marked shown to family are the family’s timeline. Export the log periodically so an off-site copy exists too.