Replayability

This file captures the §6 chapter draft assembled on 2026-06-19. It is a working draft, not final publication copy. Final tone calibration is deferred to a later outreach pass.

Replayability is the second of the five structural prerequisites (ZTG-0a through ZTG-0e). It is drafted after Observability (ZTG-0a) because it depends on it: there is nothing to replay unless governance-relevant events were recorded with sufficient fidelity. ZTG-0a establishes the recorded substrate; ZTG-0b establishes that decisions can be deterministically reconstructed from it.

Operational Questions

ZTG-0b is the prerequisite directly named by the replayability operational question, and it is load-bearing for two others. It conditions evidence coupling (ZTG-4): evidence that cannot be replayed documents that a decision was made but cannot demonstrate that it was made correctly. And it conditions admissibility: the convergence test and any external audit of a governed decision rest on the ability to reconstruct that decision and obtain the same verdict. A record that cannot be replayed is a claim; a record that replays is a checkable fact.

Normative

Every governance decision MUST be deterministically reconstructable from its recorded substrate. Given the recorded inputs, the policy version in effect, and the evaluation-engine semantics under which the decision was made, replay MUST produce the same verdict the system produced at decision-time. Replay that produces an equivalent-but-different verdict does not satisfy ZTG-0b; the requirement is reproduction of the verdict, not approximation of it.

Replayability is a property of the Invariant decision procedure, not of the reasoning system whose outputs that procedure governs. The reasoning system is non-deterministic and is not required to be replayable. ZTG-0b requires that the deterministic evaluation the boundary performs over recorded inputs reproduces exactly.

The Decision Procedure

Deterministic reproduction requires that the entire decision procedure be reconstructable, not only its inputs. A governance decision is a function of three things: the recorded inputs, the policy version in effect, and the semantics of the evaluation engine that applied that policy to those inputs. All three MUST be recoverable for a decision to be replayable.

Recording inputs and policy version while allowing the evaluation engine to drift does not satisfy ZTG-0b. A policy text evaluated under a later engine version may yield a different verdict for reasons unrelated to any governance decision — changed evaluation order, altered numeric handling, modified built-in semantics. An implementation MUST therefore pin or otherwise freeze the evaluation-engine semantics associated with each decision, so that the procedure can be reconstructed as it operated, not as a later version of the engine would operate. The conformance question is not "is this policy still on file" but "can this verdict be regenerated."

Discrete and Deterministic Evaluation

Replayability constrains the form of the evaluation, not only its recording. Decision procedures MUST be discrete and deterministic. Continuous-valued assessments are disallowed where they introduce floating-point or implementation-dependent variation, because such variation makes verdicts non-reproducible across conforming implementations and across time. This is the constraint ZTG-5 invokes when it requires harm and liability assessment to use discrete banded algebra rather than continuous values: the banding exists so that the assessment replays identically. ZTG-0b is the prerequisite that requirement serves.

Replay Reconstructs Verdicts, Not Effects

Replay reconstructs the decision; it MUST NOT re-emit the effect. Re-dispatching a governed action during replay — sending the message again, moving the funds again, writing to the external system again — is not reproduction of a decision; it is a second irreversible action. A conforming replay path is structurally incapable of producing external effects. It reads recorded inputs and re-runs the evaluation to recover the verdict; it does not traverse the effect surface.

This separation mirrors the Mechanistic Boundary (ZTG-1): just as reasoning reaches the world only through the boundary, replay examines past boundary decisions without itself becoming a path to the world.

The Non-Determinism Boundary

The governed system contains a non-deterministic component — the reasoning model — whose output cannot be reproduced and is not required to be. ZTG-0b draws the line precisely: the model's output is a recorded input to the boundary, and replay re-evaluates the boundary's decision over that recorded output. Replay does not re-run the model and does not require the model to be deterministic.

This is what keeps replayability in the Invariant layer and consistent with the introduction's load-bearing rule that the Invariant MUST NOT depend on the Envelope. If replay required reproducing the model's output, ZTG-0b would inherit the Envelope's statistical character and cease to be a deterministic guarantee. Because replay operates over the recorded output rather than regenerating it, the boundary's decision is reproducible even though the reasoning that produced its input is not.

Replay Status and Degradation

Each governance record carries a replay status with three values: replayable, degraded-by-attested-deletion, and failed.

• replayable — the recorded substrate is sufficient to reconstruct the verdict.
• degraded-by-attested-deletion — a replay-load-bearing input has been deleted under an authorized, recorded deletion event, and the verdict can no longer be reconstructed for that documented reason.
• failed — the verdict cannot be reconstructed and no attested deletion accounts for it.

Deletion of a replay-load-bearing input — for example, under a data-erasure obligation — MUST transition the affected record to degraded-by-attested- deletion, bound to the deletion event that caused it. Replay of a degraded record returns this documented degraded state; it MUST NOT return a silent absence or a substitute verdict. A degraded record is conformant only because the deletion that degraded it was itself authorized and recorded as a governance event under ZTG-0a. A record that cannot be replayed and is not accounted for by an attested deletion is failed, and a failed status is a violation, not a documented limitation.

This resolves the erasure-versus-replay tension that ZTG-0a named and deferred to this chapter. ZTG-0b does not subordinate erasure to replay or replay to erasure; it requires that any loss of replay fidelity be attributable. The framework's position is that an honest, documented inability to replay is conformant, and a silent one is not.

Conformance Criteria

A conforming implementation can: reconstruct the verdict of any replayable record from its recorded inputs, policy version, and pinned engine semantics, and obtain the original verdict; demonstrate that its replay path cannot produce external effects; demonstrate that engine-semantic drift does not silently change replayed verdicts; demonstrate that its evaluation is discrete and deterministic; assign and honor the three replay-status values; and demonstrate that every degraded-by-attested-deletion record is bound to an authorized, recorded deletion event and that failed records are surfaced as violations.

Further Considerations

The control-theory grounding. Control theory does not accept a controller whose response to a given state cannot be reproduced. Reproducibility of the control law is a precondition for verifying, tuning, or certifying a controller at all: an actuator whose behavior cannot be reproduced under identical conditions cannot be characterized, and an uncharacterizable controller cannot be trusted with a process. Replayability is this property for governed autonomous execution. It is what allows a governance decision to be examined as the output of a definite procedure rather than as an unrepeatable event. Without it, the governance function is observed but not verifiable — present in the record, but not demonstrable as correct.

Replay is reproduction, not re-litigation. Replay reconstructs the verdict a decision produced under the policy then in effect. It is not a re-decision under current policy. Running an old decision against today's policy answers a different and sometimes useful question — "what would we decide now" — but it is not ZTG-0b replay and MUST NOT be confused with it. The value of replay is precisely that it holds policy and engine fixed at their decision-time state; substituting current policy discards the property that makes replay an audit of what happened.

Admissibility and the convergence test. Replayability is what makes governance evidence admissible rather than merely asserted. The convergence test and external audit both depend on a third party being able to take the recorded substrate and regenerate the verdict. A decision that replays is a decision an auditor, a counterparty, or a court can independently check; a decision that cannot be replayed is one they must take on trust. The framework's claim to produce checkable governance, not just documented governance, rests on this prerequisite.

Engine longevity is a real cost. Pinning evaluation-engine semantics across the retention horizon of governance records imposes a genuine archival burden: the implementation must preserve the ability to evaluate under engine versions that may be years out of date. This is a deployment cost, addressed by engine version archival, containerized evaluators, or semantic specifications precise enough to re-implement. It is not a reason to weaken the requirement. A guarantee of reproducibility that lapses when the engine is upgraded is not a guarantee of reproducibility.

Degraded records and audit honesty. The degraded-by-attested-deletion status is deliberately a first-class, visible state rather than a quiet failure. Its purpose is to keep the record honest under legal regimes that compel deletion: the system can comply with erasure and still tell an auditor exactly which decisions can no longer be reconstructed and why. The alternative — letting deleted inputs produce silent replay failures — would let genuine violations hide among lawful deletions. Distinguishing the two is the point.

Relationship to observability and to evidence coupling. ZTG-0a records what happened; ZTG-0b reconstructs it; ZTG-4 binds evidence to effects. The three are ordered by dependency: coupling presupposes reconstruction presupposes recording. ZTG-0b's fidelity demands flow back into ZTG-0a as requirements on what the record must contain — inputs sufficient for replay, policy version, engine version — and forward into ZTG-4 as the reason its coupled evidence is worth coupling.

How We Do It

Constable implements ZTG-0b by making each governance decision a pure function of recorded inputs evaluated under a pinned governance bundle and a pinned engine version, re-runnable through a replay harness that cannot reach the effect surface.

Deterministic evaluation surface. Constable evaluates policy with OPA/Rego. Rego's evaluation model is decidable and side-effect-free, which gives decisions a reproducible character by construction: the same bundle over the same input yields the same result. Other policy languages with equivalent decidability and freedom from side effects are conforming choices. The evaluation is structured to avoid continuous-valued computation in governance-determining paths, consistent with ZTG-5 banded algebra.

Version pinning. Each decision record captures the governance bundle version and the OPA engine version under which it was evaluated. Constable retains the bundles and the engine versions across the record retention horizon so that a historical decision is replayed under its own decision-time procedure, not under the current deployment. Replay selects the pinned bundle and engine rather than the live ones.

Replay harness. Replay runs through a harness that loads recorded inputs and the pinned bundle and engine, re-evaluates, and compares the regenerated verdict to the recorded one. The harness has no binding to the execution surface; it is structurally incapable of dispatching effects (EFFECT_DISPATCHED cannot be produced on the replay path). A mismatch between regenerated and recorded verdict is a conformance failure surfaced for investigation.

Replay status field. Each record carries the replay-status field (replayable / degraded-by-attested-deletion / failed). When Memoria or a data-erasure process deletes a replay-load-bearing input, it emits an attested deletion event under ZTG-0a and transitions the affected records to degraded-by-attested-deletion, linked to that event. Records that fail to replay without an accounting deletion are marked failed and raised as violations.

Conformance tests. Constable's internal testing for ZTG-0b includes: verdict-reproduction tests over a corpus of recorded decisions; engine-drift tests confirming that an upgraded engine does not silently alter replayed verdicts; effect-isolation tests confirming the replay harness cannot dispatch effects; determinism tests confirming evaluation contains no implementation-dependent continuous computation in governance paths; replay-status tests confirming degraded records bind to attested deletions and failed records surface as violations. The protocol is documented in the conformance verification specification referenced in §22.

Draft Flags

• Erasure↔replay tension resolved here, as ZTG-0a anticipated. The degraded-by-attested-deletion status is the resolution ZTG-0a's draft flag deferred to this chapter. If ZTG-0a is revised, keep its deletion event the binding anchor for this status.
• Engine-pinning composes with ZTG-0c (Temporal Integrity). Pinned engine and bundle selection at decision-time touches ZTG-0c's "no evaluation against stale policy" requirement from §10. Confirm the two chapters agree on what "the policy version in effect at decision-time" means once ZTG-0c is drafted.
• Replay-status taxonomy is shared with ZTG-0a. The three-value status is recorded in ZTG-0a's substrate but defined here. Decide, when finalizing, whether the enumeration is normatively owned by ZTG-0a (substrate) or ZTG-0b (semantics). Current draft defines it in ZTG-0b and stores it via ZTG-0a.
• §10 (ZTG-1) composition clause should be updated. §10's "With ZTG-0b" clause says boundary decisions reproduce given "the same inputs and policy version." ZTG-0b now also requires pinned engine semantics. Flag for §10's next pass to add engine-semantic reconstruction; do not silently edit §10 from this session.
• §22 Conformance Verification is referenced but not yet captured in this workspace.
• The chapter is substantively complete but likely needs final tone calibration for publication register.