# Ledgers, hashes, and append-only history

> Distinguish replay journals, durable facts, logical branches, content-addressed values, controls, and downstream analytics.

Constal keeps two related forms of execution history. The positional journal records what a program requested at each replay position and how that operation resolved. The ledger records immutable facts and control events that constitute durable workflow truth. Neither is an application log.

## Journal and ledger {#journal-and-ledger}

A replayed journal position must request the same operation kind and canonical argument hash. Completed positions return their recorded result; mismatches fail as nondeterministic replay. World-effect entries additionally record Resource, operation, Policy decision, effect class, recovery state, and terminal evidence.

Ledger facts form a logical parent chain while physical events form an append-only audit chain. `commit` adds a fact. Branch creates a named prefix. Truncate moves the logical head by appending an event rather than deleting history. Compensation runs registered forward-recovery work and records every result.

## Bytes move by hash {#bytes-by-hash}

Large values and files are stored by immutable content reference. Dataset manifests index content-addressed files, and hashes bind deployments, Resources, Policy, Tools, turns, operations, and stages to exact semantics. A hash is evidence and identity input, not a mutable execution address.

## Observation remains downstream {#observation-downstream}

Analytics events are recorded and become available for recent and historical queries. They support aggregate questions, investigation, cost, and export, but they cannot authorize, resume, bill, or mutate a workflow. Read authoritative current state from the Run or Session, and use [Analytics](/docs/analytics.md) for observation.