Every knowledge system eventually splits into the thing that is true and the things that answer questions about it. The durable design decision is declaring which is which and then holding the line so no derived index, cache, or search database quietly becomes a second source of truth. For an agent-facing knowledge base, the Hraness answer is stark: the Markdown files and Git are the database. Everything else (graph projections, search indexes, catalogs, percolation candidates) is a derived index that can be deleted and rebuilt, and none of it is allowed to write back.
authority is a property you declare
The distinction survives because it is enforced, not because it is agreed. Sponge’s costs.json registers every data surface in the product with a kind (authoritative, derived, telemetry, or served) and a retention class, and a new table, bucket, stream, dynamic route, blob, or provider meter fails check:cost-surfaces until it registers. Two rules in the checker carry the epistemology: an authoritative surface must name an existing deletion path, and a derived surface must name its source: the authoritative thing it is rebuilt from. A derived surface without a declared origin is a contract violation, not a style issue.
Oh’s storage spec draws the same line inside one database. oh_operations, oh_spaces, and the canonical records define state; the dependency and operation-record tables are checked materializations; and the search documents, FTS rows, and QMD cache are derived and rebuildable. The spec’s consequence rule is worth quoting in effect: deleting an embedding or FTS index must not delete authored records or operations, and a search result must be rejoined to a current record and digest before it is returned as current. A derived index can be wrong about what exists; it cannot make things exist.
the write path is the product
In a Wordcell vault, the authored artifacts are the entire API. A note is Markdown with typed frontmatter. A reusable concept is an ordinary note with type: concept. A typed relationship is a relations block in the source note’s frontmatter (lower-kebab predicates, exact vault-root target IDs) owned by the note that asserts it, so two agents editing different notes never contend on a central edge file. A repository scope is a repository_scopes list. There is no schema migration to run and no service to provision; wordcell note create writes one confined Markdown file atomically, and the graph, metadata filters, and search all read what the files say.
The generated surface is narrowed to exactly one marked region. A managed vault gives index.md a delimited block that wordcell refresh renders as a sorted catalog and replaces atomically: text outside the markers belongs to the author, malformed or duplicate markers fail closed, and a kb_catalog: authored front door opts out entirely so refresh and check leave the file untouched. Parallel edit lanes validate with wordcell check --no-catalog and the integrator runs the one shared refresh; the front door never becomes a merge hotspot.
The write path is guarded like a transaction because it is one. Single-note authoring confines paths to the vault, rejects symbolic and hard-linked targets, serializes same-note local writers, compares an optimistic source revision, and atomically replaces the file, with the replacement’s visibility and its directory durability treated as separate milestones so a failure after installation cannot overwrite the new bytes with older ones. Different-note writes share no lock and no graph file, so lanes parallelize without a coordination server. Git remains the cross-worktree review and merge mechanism: the history humans already trust is the history agents inherit.
Advisory output follows the same rule: wordcell percolate reports recurring-concept and missing-relationship candidates with the authored evidence that produced them, and writes nothing. The tool proposes; the vault records only what a person or agent chose to author.
derived indexes stay disposable
Wordcell embeds Oh as a graph authority and then refuses to let it be one. The only persistent artifact is .wordcell/oh.sqlite inside a self-ignoring cache directory, written only by an explicit wordcell graph rebuild. The rebuild is staged like a deployment: changed records and deletions apply in a private staging database, replay is verified, the Markdown revision is rechecked, and the result installs atomically. A failed build leaves the previous database in place; rebuild --fresh requests a clean one. Queries and verification never write vault files: the default graph query builds an in-memory projection of a bounded snapshot and closes it, and --persisted queries read a bounded copy into memory while refusing a missing, stale, foreign, or corrupt cache.
The same posture governs the search index. The QMD-backed embedding index lives in a path-derived SQLite cache under the user’s cache directory (outside the vault), is rebuilt with wordcell index, and can be deleted at any time and recreated. Wordcell refuses a symlinked or multiply linked database file, claims the adjacent snapshot directory with a versioned ownership record, and indexes a validated source projection so the index cannot ingest a note that bypassed the vault’s per-note or aggregate limits or recursively ingest its own cache.
The disposability goes all the way down to time. In-memory projections use a fixed synthetic genesis time so identical snapshots can reproduce and verify their proof results across sessions; the derived layer’s clock is a reproducibility device, and the docs state flatly that this logical time is never evidence of when a note was authored or an operation occurred. A derived artifact that cannot honestly claim its own timestamps does not get to borrow them.
reads never write
The invariant that keeps authority clean is the flat one: no writes on read paths. wordcell check verifies catalog policy, graph integrity, and attachments without changing files. wordcell graph reports the resolved graph and diagnostics from a scan. wordcell capture diff reads Git history, which is the capture version history, rather than maintaining a second content-history database. A code-mode session intentionally retains one read-only snapshot of the vault and shares it across exact search, metadata queries, navigation, hybrid search, and Git provenance; when Markdown changes, you reopen the session rather than let it mutate underneath you.
This is what makes the derived tier cheap: because reads cannot write, a stale index is a wrong answer to discard, never a state to repair.
verification names its evidence
Because Markdown is the authority, every derived answer has to be able to name what it derived from. A graph query result identifies the vault, the exact source revision, the named request, the projection digest, the evaluated limits, the rows, and the supporting proof trees: a fact proof names the source note, its content digest, and its exact Oh record digest; a derived proof names the applied rule and its premises. graphVerifyResult re-evaluates a bounded result against the session snapshot and rejects modified, foreign, or stale evidence. oh verify at the store level runs SQLite’s integrity and foreign-key checks, replays the operation chain from empty, recomputes digests, and requires the reconstructed head to equal the stored head.
Truncation is reported rather than hidden: work exhaustion fails instead of claiming a complete answer, and a truncated result keeps truncated and proofsTruncated markers and exits the CLI with status 4: an incomplete answer is labeled evidence, not a quieter kind of complete one.
what it costs
The honest price of Markdown authority is rescanning, and the bounds are explicit. Structural commands rebuild focused views from the current notes on every call; scans reject more than 10,000 notes before parsing, bound each note at 16 MiB of valid UTF-8, and the vault at 256 MiB. The graph projection boundary accepts at most 4,000 notes, 100,000 facts, and 64 MiB of source text, with query atoms bounded at 16 KiB. A vault that outgrows those ceilings needs a different authority story, and the design says so rather than silently degrading.
What it buys is the property the whole system rests on: git log is a complete, human-readable audit of every assertion the system has ever served, and rm -rf .wordcell plus a rebuild reproduces every index from bytes you can read. The database is the part you can edit with a text editor, and everything else is a cache with the honesty to say so.