"The log is the truth. The database is a story the log tells — and can tell again."
The Log Is Canonical
Forge stores its data twice, and only one of them is the truth. Append-only JSONL op-logs under ~/cwk-dbs/forge-db/ record every mutation: a crumb added, a crumb revised, an interpretation written, an analysis artifact produced, a module changed. That log is ground truth. SQLite, running WAL, is a derived mirror that serves queries, aggregates, and the client. When you internalize which is which, a whole class of bugs disappears — because the database is never something you protect, only something you can rebuild.
Write Before Show
The ordering rule is strict: every event is durable in the JSONL before it is shown to Dad. Nothing appears on screen that has not first been written to the canonical log. This is the same 'write before show' discipline cwkPippa uses for conversations, and it is why a crash or a stopped process can never leave the truth behind the UI. The screen is downstream of the log, always — the log is not a record of what the screen showed; the screen is a view of what the log holds.
Why Two Stores At All
If the log is the truth, why keep SQLite? Because a log is perfect for durability and terrible for questions. "Show me symptom sites this month" is a query, and queries want indexes and folded rows, not a replay of every event since the beginning. So Forge folds the log into SQLite for reading while keeping the log for truth — each store doing the job it is good at. The discipline is only to never confuse them: the mirror is fast and disposable; the log is slow to query and impossible to lose.