CONTINUITY

Quantitative trading desks lose strategies when the people who wrote them leave. The court record has the extreme version — a strategy earning about a billion a year losing more than half its profits in the month after two traders resigned — but the ordinary version is worse because it is invisible: PM turnover of 15 to 20 percent a year against strategies that outlive their author's seat, and nothing anywhere that records *why* a parameter was set where it was set. Regulators have asked for exactly this in writing for years and firms answer with documentation written after the fact. The industry built world-class platforms for research data and none for research reasoning, which is the half that walks out of the building.

Treat the reasoning as an append-only, hash-chained ledger and make everything else a projection of it. Capture ambiently rather than asking anyone to write documentation: a post-commit hook files commits that touch strategy code and a model drafts the record, a person approves it with one keystroke, and meeting transcripts enter through the same path transcribed inside the browser. Then earn the schema back — knowledge-risk analytics scored per strategy, replay of the decision genealogy at any past moment, regulator-shaped handover packs generated as pure functions from rows, and retrieval that runs in the browser tab with no key and no round trip. Finally, fine-tune two small models on the desk's own records so the tagging and the answering work with no network at all, and build the screen that shows the model losing to the record when it is wrong.

A federal court filing describes a strategy earning about a billion dollars a year losing more than half its profits in the month after two traders resigned. Portfolio-manager turnover at multi-manager funds runs 15 to 20 percent a year, so the average strategy outlives the seat of the person who wrote it. Finance already mandates the fire drill — two weeks of block leave with system access cut — and nobody scores whether the desk would pass it.

The industry solved the adjacent problem completely. Firms built world-class platforms for research *data*; nobody built one for research *reasoning*. The reasoning lives in a departed person's head, in a Slack thread nobody can find, and in the fifteen minutes of a meeting that evaporated as soon as it ended. Regulators have been asking for it in writing for years: RTS 6 wants a record of when each material algorithm change was made, who made it, who approved it and its nature; SR 11-7 wants documentation a stranger could read; SYSC 25.9 says handover material should include judgement and opinion, not just facts and figures.

Continuity is less a dashboard than a database with an opinion. The schema is the product and the interfaces exist to feed it and to ask it questions. Every meaningful thing in the system is an event in an append-only, hash-chained ledger first and a projection everywhere else. A post-commit hook files each commit as an artifact and asks for a decision record when the commit touches strategy code; a model writes the draft and a person approves it with one key. Meeting transcripts enter through the same path, transcribed inside the browser tab with no audio leaving it.

What the ledger buys is everything downstream of it. Knowledge risk is scored per strategy — bus factor adapted from the truck factor, Herfindahl concentration borrowed from competition economics — and never per person, because a product that ranks individuals is a different and much worse product. Replay is nearly free on an append-only record, because the state at a past moment simply *is* the events up to it: drag a scrubber and the decision genealogy assembles, then turns amber the moment it passes a resignation. Ask a question about a departed colleague and the answer comes back in their own words, quoted and cited, with the line above it saying they resigned three days ago.

Then the harder half. A 2B model, LoRA fine-tuned on this machine, tags every decision with one of seven types and a risk flag, so the classification path needs no network at all. A second fine-tune puts the ledger itself into the weights, so the model answers questions about the desk offline. That one both works and is the thing this project got wrong first, and the run that failed is still in the repository, because a negative result that gets deleted teaches nobody anything.

Every colour, radius, motion duration, claim and sprint entry in the repository is checked by a script, and `pnpm check` runs six of them. That is not thoroughness for its own sake: three of those guards were found, mid-build, to be passing while the rule they protected was broken.

Two shells, one front end, one database. A React and Vite application, wrapped in a Tauri 2 desktop shell that adds a tray icon and a global quick-capture hotkey, served on the web as a static SPA with a handful of Vercel functions beside it. Supabase Postgres underneath, with row-level security, Realtime and pgvector. The embedding model runs in the browser tab.

`events` is the source of truth and everything else — decisions, links, scores — is a projection. Immutability is three layers deep, and they are deliberately not equivalent. Update and delete are never granted on the table, so they do not exist for the application role. A trigger raises on update and delete, and a separate statement-level trigger raises on truncate, because truncate does not fire row-level triggers at all. And a unique constraint on `(firm_id, prev_hash)` with `nulls not distinct` rejects both a grafted branch and a second genesis row — which is the only one of the three that survives a privileged session turning every trigger off. A `before insert` trigger takes an advisory lock and chains each row to the sha256 of the one before it.

Retrieval is hybrid and runs entirely client-side: a 384-dimension embedding model downloaded to the tab, blended with BM25, with a keyword-only fallback when the model cannot download. The lexical half is not decoration. Asked why the expiry window is capped, dense embeddings return everything about the expiry book and rank the record that literally answers it below them; and because the embedding model returns a cosine around 0.75 for text with nothing to do with the corpus, a semantic-only threshold has to be set inside the noise.

The two models are separate jobs. The tagger is a LoRA fine-tune of a 2B Qwen with a strict parser: anything that is not one line of the expected JSON with a known label is counted as unparseable and excluded from the class metrics rather than coerced to a default class. The firm model is a second fine-tune on the ledger's own records, evaluated on a fact probe and a refusal set that are scored separately and must be read together.

Compliance documents are pure functions from rows to markdown — the same corpus always produces the same bytes, which is the only thing that makes a pack hash worth storing. Reads and exports append to the same ledger they read from, so `My record` can show every member what was captured from them and everyone who has looked at it.

With no credentials at all the application still runs: it generates the same corpus in the browser that the seed script loads into Postgres. Not a mock — literally the same generator, so what renders with no backend is what the database contains after seeding, and the two cannot drift apart without a test failing.

The product's whole argument is that the record can be trusted, so the first thing audited was whether the database actually enforces that — and not in the way the design had assumed. Postgres was granted only select and insert on the events table, with triggers raising on update, delete and separately on truncate, since truncate does not fire row-level triggers at all and a single trigger looks like it covers a gap it does not. Measured rather than assumed: under `set session_replication_role = replica` every trigger on the table is off, and update, delete and truncate all succeed. So the trigger layer is tamper resistance and nothing more. The layer that survives is a unique constraint on `(firm_id, prev_hash)` with `nulls not distinct`, which rejects both a grafted branch and a second genesis row even with every trigger disabled. The honest description that came out of the audit — the triggers are tamper resistance, the chain is tamper evidence — is stronger than the claim it replaced, and it is the one that ships.

The verify page rebuilds every hash from the event's own contents rather than asking the server whether the server is right, and that required reproducing Postgres jsonb rendering exactly in TypeScript: keys ordered by length before byte value, a space after every colon, and a loud refusal for numbers that would not round-trip instead of a hash that silently differs. It is checked against a live Postgres over fifteen deliberately awkward payloads and then recomputes sixty seeded event hashes. Three of the repository's own guard scripts were found mid-build to be passing while the rule they protected was broken, which is why there are six of them now and why `pnpm check` runs all six. Several tests earned their place by failing first: the contrast test caught `--text-secondary` measuring 6.87:1 inside a recessed pane against a stated 7:1 bar, because the design document had measured against the lightest surface rather than the darkest one text actually sits on; the departure test caught a tag present on every decision in a strategy counting as covered ground, so as soon as one other person touched a book nothing in it looked orphaned; and the transcript parser test pins that a sentence containing a colon is not a speaker line, or "The rule is simple: cut size" gets attributed to a person named "The rule is simple". The largest repair is the first fine-tuning run of the firm model, and it is kept in the repository rather than deleted: it scored 9 of 36 on facts and 0 of 12 on refusals. The tuning had worked and the model had still failed, because it learned the ledger and also learned that declining is never the answer. The cause was data design, not training — that run authored 33 refusals against 686 answerable pairs, and the expansion step made it worse because facts had cached paraphrases and refusals did not, so what reached training was 6.6 percent.

The tagger is a LoRA fine-tune of a 2B Qwen trained on the same laptop that ran the build, and on a held-out split the training never saw it scores macro-F1 1.0000, accuracy 1.0000, risk accuracy 1.0000 and zero unparseable outputs over 300 rows at 462 ms p50. The number worth quoting is not the 1.0 — a perfect score alone is equally consistent with a good model and a trivial benchmark. It is the 38.5-point gap to the few-shot arm: the same base model, the same parser, the same split, with all seven classes described in the system prompt and two worked examples each, scores 0.6155. So the task is not solvable by prompting, and the adapter has learned something a prompt cannot express. Rebalancing the firm model's training data from 6.6 percent refusals to 20.1 percent moved refusal accuracy from 0.0 to 0.4167 while fact accuracy moved 0.25 to 0.2222, which is inside the noise of a 36-item probe — the share of refusals in the training data controls refusal behaviour almost directly and costs very little accuracy. The untuned base scores 0 of 36 on facts about this desk and a perfect 12 of 12 on refusals by refusing everything, which is exactly why refusal accuracy must never be quoted on its own. Retrieval's relevance floor is measured rather than chosen: questions the corpus can answer score 0.88 to 0.93 blended and questions it cannot top out at 0.47, so the floor sits at 0.60 in the gap — and that gap only exists because of the lexical half, since the embedding model returns a cosine near 0.75 for text with nothing to do with the corpus.