Authority lives where legitimate writes land
Memory changes through editors, mobile sync, and live brain sessions. The live vault is where those legitimate paths meet. If a versioning tool calls its convenient mirror the source, actual human work becomes external input and the tool wins every conflict.
Source does not mean the most sophisticated store. It means the place where authorized change occurs. It may have less elegant formatting or slower history queries, but if edits originate there and propagate to devices, authority lives there.
A projection is dangerous because it is useful
The mirror is better for search, diffs, and commits. It creates a stable tree without editor locks or synchronization internals. That convenience makes it feel cleaner and therefore more authoritative, which is exactly why direction must be an invariant.
Allowed arrows run from live vault to mirror, then from mirror to indexes and ledger. No reverse arrow bypasses the write path. Even restore reintroduces historical content as a new present event through mediated mutation.
A sync conflict does not transfer authority
When synchronization produces conflicting files, the mirror does not become judge. The conflict is itself an event from live truth, presenting two traces for a person to compare. A derived system may expose both but must not silently decide which memory is real.
This boundary makes rebuilding cheap. A bad mirror or index can be discarded and recreated from the vault. If live truth depends on derived state, nothing can be thrown away safely and a cache failure becomes a source failure.
Write the authority table first
Before implementation, list each datum, who writes it, and what can rebuild it. A value with a named rebuild source is a projection; a value receiving normal authorized writes is a candidate authority. A row marked as both is a warning. Genuine bidirectional synchronization needs a separately designed conflict owner and merge semantics.