So Pete gets more than a log. He gets a record he can’t be lied to.

Every decision becomes a signed record — what was proposed, the state it was checked against, the decision, and the policy behind it. Signed, tamper-evident, verifiable. Pete can hand it to an auditor without trusting his own database. The record is a protocol output — the proof the boundary ran — not the thing being sold.