Detection is not judgment

Drift begins as a difference between what the system expected and what it can now observe. That difference may appear in system health, a changed state hash, a rule event, a missing journal entry, an operator action, a dependency failure, or the behavior of an assembly under load. None of those signals proves an attack, a defect, or even an unsafe condition by itself. The first responsibility of the architecture is therefore not to punish the difference. It is to capture it with enough context that the next stage can evaluate it honestly.

The original TCA design described this boundary through the LogicHashWatcher, journals, the System State Table, and SysSecureOps. The current QEnSAi system has evolved beyond those early names, but the operating principle survived: watchers observe filesystem and process boundaries; the Flight Recorder preserves correlated events; state and governance stores retain the values used by later checks. Observation and decision remain separate. A watcher may report that a hash, status, dependency, or timing condition changed. It does not get to decide what the change means.

Capture before interpretation

A useful drift record needs more than a warning string. It needs the source, time, prior state, observed state, affected scope, and the evidence needed to reproduce the comparison. Where possible, records are hashed and appended rather than rewritten in place. This matters because interpretation changes as more evidence arrives. If the original signal is preserved, a later diagnosis can disagree with the first explanation without losing the event that started the investigation.

This separation is one of the quiet differences between monitoring and governance. Monitoring says that something happened. Governance preserves who observed it, what state the observer compared, which boundary was crossed, and what happened next. A health anomaly may turn out to be load. A missing event may expose an emission failure. A policy mismatch may reveal stale configuration rather than hostile behavior. The capture has to survive all three conclusions.

The danger of silent drift

The hardest failures rarely announce themselves as catastrophic events. They accumulate through small changes that look reasonable one at a time: a rephrased instruction, a skipped verification, a widened scope, a stale dependency, or a record that was created but never entered shared memory. Human review catches some of these. It cannot reliably reconstruct a long sequence after the fact if the system did not preserve the intermediate state.

That is why TCA treats drift as a first-class signal. The goal is not to make change suspicious. Change is expected. The goal is to make unobserved change difficult. When the system can say which state moved, when it moved, and which evidence disagreed, drift stops being a vague quality problem and becomes something that can be scored, routed, and tested.

What has to be true before Stage 2

Detection is complete only when the signal is durable enough for another process to examine without relying on the detector’s memory. The record must name the scope, preserve the before-and-after values, distinguish observation from inference, and carry a correlation key into the rest of the recovery loop. If those conditions are missing, the system has not captured drift; it has produced another alert someone will have to rediscover later.

Part 4 moves from capture to evaluation. The question changes from “what moved?” to “how much does this movement matter, and what response does the evidence justify?”