Five guarantees, written into the schema.

The plain-language form of the first guarantee. The technical name is append-only decision ledger. Every compliance determination is written as a new row in an immutable ledger and is never updated in place. That covers every hour logged, every exemption granted, and every cure-period pause.

The mechanism is a row-level trigger that raises an exception on UPDATE or DELETE attempts against the ledger tables. There is no application-level honor code; the database refuses the operation even if a hypothetical privileged client tried. This is how the audit trail survives a court challenge three years after the fact: the integrity is enforced at the storage layer, not the policy layer.

The plain-language form of the second guarantee. The technical name is deterministic replayability. The same inputs, run against the same versioned rule set, produce the same compliance determination at any point in the future.

Every determination stores the inputs, the rule version, and the deterministic seed. An auditor working in 2030 can replay a 2026 determination and arrive at the same outcome. There is no clock-bound randomness, no "current best estimate" logic, no stale model output. The system was built to be re-audited, not just audited.

The plain-language form of the third guarantee. The technical name is fail-closed audit. If authentication fails, access is blocked. If an audit log write fails, the operation rolls back. Nothing proceeds silently. Nothing is ever lost.

The pattern is a transactional wrapper around every state-changing operation: the audit log write and the business mutation share a single database transaction. If the audit write fails, the whole transaction rolls back. There is no path through the codebase where a determination is made but unrecorded, or recorded but unmade. This is enforced in the route layer.

The plain-language form of the fourth guarantee. The technical name is view / mutation separation. A beneficiary's compliance record cannot be altered as a side-effect of a read.

The codebase enforces this with a typed split at the route layer. Read endpoints can only call read-tagged functions. Write endpoints can only call mutation-tagged functions. There is no shared layer that does both. Silent state changes during view operations are architecturally impossible. The type system refuses to compile code that crosses the boundary.

The plain-language form of the fifth guarantee. The technical name is closed-set actions. The platform operates on the actions and statuses that the statute permits. What can happen is what the statute documents.

The mechanism is an explicit enum of every admissible action and status, modeled as database-layer constraints and type-system discriminated unions. There are no "OTHER," "misc," or open-ended text fields where a future user could type a state the law does not recognize. The 9 federal exemption categories from § 71119 are 9 enum members; there is no 10th.