Two clocks, not one
Every belief version in Zephr carries two time dimensions. Valid-time records when the claim holds in the world: valid_from and valid_until. Transaction-time records when Zephr recorded it: recorded_from and recorded_until.
Bi-temporality means corrections never destroy history. If a file changes and a belief anchored to it becomes stale, Zephr closes the valid-time interval of the old version and records a new version. You can still answer "what did we believe when we shipped X?" because the old transaction-time record remains.
Append-mostly, not edit-in-place
The evidence graph is append-mostly. Beliefs are not destructively edited; every change — human correction, revalidation, review-state transition — produces a revision chained to its predecessor with actor and reason. Deletion is tombstoning.
This is what makes the audit trail real. A user can traverse from a recalled answer back through every version, every verification event, and every contradiction edge to the original source.
Verification as a cascade
T1 is deterministic: anchor content-hash checks, artifact drift detection, and reproducible machine-decidable checks. T2 is semantic contrast: a contradiction graph that surfaces disagreement between beliefs within a scope but never silently resolves it. T3 is budgeted judgement: a model-assisted, advisory-only tier with a hard spend cap and no authority to change validity or review state.
Verification is not a single score. It is a cascade: if T1 fails, the answer is invalid regardless of T2 or T3. T2 can only surface disagreement; it cannot override T1. T3 can propose; only a human or a new T1 fact can dispose.
Provenance is mandatory at recall
Every recalled belief presents a provenance chain: source, anchor, and confidence. If any element is genuinely unknown, the response says unavailable explicitly. A blank or omitted provenance field is a contract violation, not a rendering choice.
That rule is what separates a memory product from a search engine with confidence dressing. The answer is inseparable from where it came from.