Chapters 3 through 6 leave the system with a working pipeline and an uncomfortable surplus. Chapter 3 retrieves raw history. Chapter 4 derives a persistent graph from it. Chapter 5 propagates activation across that graph. Chapter 6 chooses between these mechanisms. A candidate memory reaches the reader, the reader writes an answer, and the answer contains claims about the project. This chapter asks the book’s third question — why did we decide or believe this? — in the form the pipeline forces:

A memory system has produced a claim. What gives it the right to believe or say that claim?

That is not the same as asking where the text came from, how the system retrieved a memory, which subsystem the Nexus chose, or whether the claim is still true. Those are three other questions plus a later chapter. This chapter is about evidential justification and traceable derivation, and its thesis is:

Provenance is not a citation attached to an answer. It is maintained dependency information connecting derived claims to the evidence that licenses them.

A second formulation runs through the whole chapter: lineage tells us where information came from, while support tells us why we are entitled to believe it. Both are tested below against an implementation and a frozen experiment suite rather than asserted.

A citation is not a reason

The old version of this chapter opened with the simplest provenance — a source pointer on every stored belief — and four ways it breaks. The four failures survive the rebuild unchanged, because they are representational facts rather than implementation details.

Multiple support. The PostgreSQL decision rested on several pieces jointly: the contention report in session-014, the benchmark in session-019, the importer incident incident-021, and the rationale in adr-007 that ties them together. No single span contains the rationale. A single pointer must either pick one leg, understating the evidence, or point at the decision record that summarises them, which moves the problem one step back.

Summaries that drop qualifications. A later wiki page restates the decision as use of PostgreSQL for performance, omitting that the advantage applied to concurrent-write workloads and that the team accepted higher operational cost. A pointer to the summary supports the simplified belief while hiding the qualification that determines its scope. The chain must reach past the summary to the evidence the summary compressed.

Repeated old decisions. The August runbook repeats that the event store runs on PostgreSQL without noting that it restates July’s outcome. A pointer to the runbook looks like independent confirmation; traced properly, it is the same belief echoed. Without derivation edges, repetition masquerades as corroboration.

Non-supporting sources. A passage can be topically relevant, correctly retrieved, and genuinely similar to the claim while not supporting it. The pre-decision note in session-033 argues the losing side — keep SQLite for operational simplicity. Citing it as justification for the migration is worse than citing nothing, because it lends the belief borrowed authority.

Each failure shows the same missing piece: support is a relation between items, not a property of one item. A pointer records where a belief was found. It does not record what the belief was inferred from.

Four different meanings of “why”

The rebuilt pipeline produces four traces that all sound like answers to “why”, and the chapter’s first architectural act is to refuse to conflate them.

Retrieval causality answers why a memory was recalled: the query led through Bill to Project Alpha to invoice-183. That is Chapter 5 pathway information. It does not establish that the invoice supports the answer; in the fixture it does not, because the invoice records routine renewal unrelated to the budget variance.

Control causality answers why the system used one memory process rather than another: the Nexus chose associative retrieval because direct retrieval confidence was low. That is Chapter 6 routing information. It does not establish that the resulting claim is true.

Derivation lineage answers what generated a representation: source spans led to an extracted relation, which led to a community summary, which led to retrieved context, which led to the final answer. That explains where derived information came from. It still does not establish evidential support, because any stage may have added content its inputs do not license.

Evidential support answers which evidence actually licenses the claim: the contention benchmark, the importer incident, and the decision rationale jointly support the statement that contention motivated the migration. Only this fourth relation is the chapter’s subject. The other three are preserved as annotations on the same graph, stored where they can never be mistaken for support.

    flowchart TD
    Q[query] --> NX[Nexus route]
    NX -->|control causality| AP[associative path]
    AP -->|retrieval causality| DG[derived graph object]
    DG -->|derivation lineage| SE[source evidence]
    SE -->|evidential support| CL[claim licence]
    style CL fill:#3978c5,color:#fff
  

The cost of derived memory

Chapter 6’s frozen measurements motivate everything that follows, and they are worth restating precisely because they cut against the obvious story. On eight measured routing tasks, raw evidence was extremely strong, graph modes carried substantial unsupported-source harm (0.43 to 0.79 against zero for raw evidence, associative recall, and no-memory), and the oracle router’s headroom over the best fixed policy was cost-only: quality headroom 0.000, utility headroom 0.067. The single discriminating provenance task, q3-why-postgres, split quality 1.0 for raw evidence against 0.5 for every other measured capability.

Book result. Chapter 6’s matrix (experiments/benchmark/runs/ch6-20260919-nexus/) shows derived machinery adding harm as well as structure on the fixture tasks.

The emerging problem is therefore sharp: every derived stage potentially adds useful structure and another place where unsupported information can enter. More derivation is not monotonically better. Chapter 7 makes that measurable by tracing each claim through every stage and testing each stage separately.

Claims first

Verification cannot begin until the system decides what needs verifying, and a sentence is not a claim. The sentence stating that PostgreSQL was selected because SQLite contention caused the importer failures contains at least four checkable propositions: that PostgreSQL was selected, that SQLite experienced contention, that the contention contributed to importer failures, and that those events contributed to the decision. A citation attached to the whole sentence may support only some of them.

Claim extraction is itself fallible infrastructure, so the layer treats it as a measured component rather than a preprocessing given. Three deterministic baselines are implemented. C0 splits sentences and stops. C1 applies a constrained schema: splitting on conjunctions and causal joints, and flagging negation, conditionals, and attribution. C2 reproduces the published Claimify shape — selection of verifiable content, disambiguation with abstention on unresolvable reference, decomposition into atomic claims — without any Claimify code, and is labelled Claimify-inspired throughout. A claim records its source span, its producer, and its producer version, because a support graph built with a new extractor is a different derived artifact.

Book result. On seven labelled sentences covering conjunction, causation, qualification, negation, conditionals, attribution, and ambiguity (ch7-20260919-e7, E7-B), all three extractors reach identical coverage of 0.70, while the baselines separate on exactly the axes the literature predicts: the sentence baseline misses all three qualifier flags, the structured extractors miss none, and the Claimify-inspired extractor is the only one that abstains on the unresolvable reference instead of inventing a claim for it.

The tie on coverage is reported rather than hidden: deterministic splitting does not beat sentences at finding propositions. Its value lies in flags and abstention. A verification system cannot be more trustworthy than the claims it decided to verify, and abstention on “Its behaviour changed” with no resolvable referent is the honest output.

Support is a relation

With claims fixed, the layer proposes candidate evidence and then decides whether each candidate actually supports the claim. The fixture plants the adversarial cases deliberately: the losing-side note, a benchmark of a different importer reached through a valid associative path, a qualification-dropping summary, and an echo of the decision. Retrieval success and evidence success diverge on purpose.

Book result. The evidence filter rejects every planted non-supporting candidate while keeping every genuine leg (E7-E, rejection recall 1.0 on both the migration case and the invoice trap). A valid Chapter 5 path through a benchmark of the wrong importer is retrieval working and evidence failing at once.

Provenance precision penalises the specific sin this invites: citing genuine but non-supporting evidence. A citation should not borrow authority merely by looking relevant. The instrument therefore scores answer correctness and evidence correctness as separate axes. The fixture’s four reader outputs fill all four cells — right answer with right evidence, right answer with wrong evidence, wrong answer with right evidence for a subclaim, wrong answer with wrong evidence — and the layer’s verdict is that a correct answer carried by an invalid chain fails justification even where it passes question answering (E7-J). For revision-critical tasks that failure verdict is the whole point; for trivial lookups the layer’s own cost accounting says the machinery may not be worth running, and the chapter keeps that task-sensitivity explicit.

One source is rarely enough, and evidence has logic

The migration rationale needs three legs at once: the benchmark establishes contention, the incident establishes operational consequence, and the decision record connects those observations to the choice. No single source fully licenses the claim. Worse, legs do not add up the way coverage fractions pretend. If the benchmark is the keystone, losing it invalidates the rationale even while four weak supporting artifacts remain; conversely, an independent benchmark rerun can carry the same leg, so that losing one of two sufficient routes changes nothing.

The representation answers with support groups: conjunction inside each group, disjunction across groups. The main claim carries two alternative groups — benchmark plus incident plus rationale, and independent rerun plus incident plus rationale — which is the minimal-evidence-group semantics of Li and colleagues: sufficient, non-redundant, minimal sets, with alternatives allowed. Minimality is checked group-relatively, because a pair licensed inside one group says nothing about its role in another.

Book result. Group exact-match rates separate the representations completely (E7-C): single pointers 0.11, direct citation of everything retrieved 0.44, explicit support groups 1.0. The pointer cannot express conjunction; direct citation cannot express minimality, and counts echoes as legs.

Repetition is not corroboration

The decision record, the runbook, and the wiki page all say the event store runs on PostgreSQL. Counted as citations that is threefold support. Traced as derivation it is one observation plus two echoes, and the layer stores ECHO_OF edges to say so. Twenty echo documents must never outweigh one independent benchmark, and the experiment maps exactly where the cheap detection stops working.

Book result. A token-overlap echo heuristic at threshold 0.55 recalls 0.40 of a five-rung paraphrase ladder (E7-D): exact copy and near paraphrase are caught, heavy paraphrase, summary, and changed terminology are not. Beyond near-duplicates the system relies on recorded derivation edges, not on resemblance.

That boundary is stated as a limit rather than a roadmap promise. If derivation edges cannot be recorded through a transformation, the echo distinction for that transformation is scorer fiction, and the chapter refuses to claim general paraphrase-robust echo detection.

A graph connection is not evidence

Chapters 4 and 5 connect relevant-looking information: Bill to Project Alpha to budget to invoice. The connection is real and the retrieval is valid. The invoice still supports nothing about the budget claim. Deng and colleagues give this failure its sharpest published form as the connectivity-support gap: graph edges are support hypotheses, not support, and a fixed-budget reader needs the hypotheses tested before promotion. The layer implements the testing side of that split. Association proposes; only the support relation disposes, and the retrieval trace is kept alongside the verdict so that debugging can see both.

Follow the lineage backward

For claims that pass through derived GraphRAG state — source chunk to entity extraction to relationship to community summary to retrieved context to answer — the layer walks the chain in reverse, asking at each stage whether the stage output is supported by its inputs. The design follows VeriTrail directly: a DAG model of the multi-step workflow, reverse-order verification, per-stage verdicts of fully supported, not fully supported, or inconclusive, and an evidence trail of selected spans with node identities for supported claims. What is borrowed is the shape and the verdict discipline, not the model judgements: on fixtures, ledger truth drives every verdict, and any LLM-backed verifier would be a new run with its own manifest, never a silent substitution.

Demands stay explicit through the walk in the LineageRAG spirit: each stage output must establish something specifiable, grounding completes in verbatim source spans, and lineages that never reach a span stay visibly open rather than being rounded up to supported.

Book result. Five of nine fixture claims trace completely to raw spans with no open ends; four remain honestly open — two with no support structure at all, one grounded only in a harmful derived relation with no raw path, and the hallucinated figure discussed next (E7-F). Open lineage is an incompleteness signal, not a failure to be smoothed over.

Where did the error enter?

The most useful new capability is localisation. A community summary adds an invented figure — SQLite lost 14% of writes — and the reader repeats it fluently. Scoring the final answer as hallucinated is true and unhelpful. The reverse walk finds source, extraction, and graph stages valid, the summary unsupported by its inputs, and context and reader merely propagating: first likely failure, the summary stage. A second fixture, where a graph-local relation invents a Redis cause for the importer failures, localises to the graph stage while routing and retrieval both pass — the Nexus-routing trap, reported as routing pass, retrieval pass, evidence fail, so the router is never blamed for a downstream invention.

Book result. Error-stage localisation matches the injected stage in all three fixture traces, including the fully supported control (E7-G, 3 of 3).

Ground in the original source — but the source can be wrong

Chains terminate in raw artifacts because termination buys inspectability: any auditor, human or mechanical, can open the span and read what was actually said. What termination does not buy is truth, and the fixture plants the case that proves it. A session note confidently reports the 14% write-loss figure; the ledger records it as fabricated. The layer reports the claim as traceable to that span and unsupported by anything, which is exactly the honest pair of verdicts:

Raw-source termination guarantees inspectability and historical grounding, not truth.

A raw source may be mistaken, stale, deceptive, incomplete, or itself a report of another source. Source reliability — track records per source, maintained over time — is designed as an extension point and deliberately not built: the chapter establishes traceability as distinct from truth and records source identity so later reliability work has something to attach to.

Provenance of provenance

Support edges are themselves proposed by fallible machinery, so every edge carries what licensed it: the extractor, its version, the spans behind the proposal, and an extraction confidence. That confidence means confidence the relation was correctly extracted — never the probability the claim is true. Claim confidence, source reliability, extraction confidence, and memory utility are kept as four separate quantities that must not be collapsed, because each answers a different consumer: the verification system needs claim-level evidence, the human auditor needs inspectable spans, the reader needs compact context, and the future revision engine needs machine-readable dependencies. Generated prose may render the dependency structure for any of them. It must never invent the structure, which rules out satisfying this chapter by asking a model to explain why it believes something and filing the fluent answer as provenance.

Build it

The implementation lives in solution/evidence_lineage/ beside Chapters 3 to 6 rather than above them, and layers over the existing systems: raw spans feed retrieval, graph, association, and Nexus paths; answer claims feed the evidence layer; the evidence layer resolves support, lineage, and verification back against the original spans. Upstream provenance is preserved where the pipeline records it; where it does not, the layer reconstructs support hypotheses and marks them as reconstructed, never as recorded.

The edge taxonomy is strict and small:

• SUPPORTED_BY — evidential: this evidence contributes to licensing the claim.
• DERIVED_FROM — lineage: this object was generated from the parent, which says nothing about whether the parent proves the child.
• ECHO_OF — restatement: this content propagates earlier information and contributes no independent evidence.
• REFUTES — evidence against a claim, recorded without resolution; conflicts belong to Chapter 8.

DERIVED_FROM is never converted into SUPPORTED_BY, Chapter 5 paths and Chapter 6 routes are stored as trace annotations rather than edges, derivation cycles are rejected, and every echo must resolve to a non-echo source. Using the layer follows the repository’s CLI conventions:

claims = extract_claims_c2(answer)
support = graph.support_for(claim_id)
trail = graph.trace_to_sources(claim_id)
affected = graph.dependents_of("s19-benchmark")
verification = verify_backward(claim_id, stage_support)

cd solution && python -m evidence_lineage.cli explain claim-main
cd solution && python -m evidence_lineage.cli trace claim-14pct
cd solution && python -m evidence_lineage.cli verify claim-14pct
cd solution && python -m evidence_lineage.cli impact a07-rationale
cd solution && python -m evidence_lineage.cli evaluate --run-id ch7-<date>

    flowchart LR
    B[s19-benchmark] --> G1{g1: AND}
    I[i21-incident] --> G1
    A[a07-rationale] --> G1
    R[s44-replicate] --> G2{g2: AND}
    I --> G2
    A --> G2
    G1 -->|OR| C[claim-main]
    G2 -->|OR| C
    style C fill:#3978c5,color:#fff
  

Measure it

The suite extends the Chapter 2 instrument only where the chapter earns the measurement: claim extraction coverage with qualifier tracking, support precision and coverage, provenance precision against borrowed authority, group exact and soft match, lineage completeness, raw-grounding rate, echo precision and recall with echo inflation rate, error-localisation accuracy, and dependency impact precision and recall. No aggregate provenance score is produced; the dimensions stay separate because they fail separately.

The evaluation order is deliberate. Controlled fixtures with ground-truth groups come first, mechanical checks second (valid source identifiers, existing raw spans, terminated chains, rejected cycles, complete groups), and model judges last or never. The literature insists on this ordering: AttributionBench finds even fine-tuned judges reaching only around 80% macro-F1 on attribution decisions, and CiteEval shows binary support judgements missing much of what makes a citation good or bad. A support layer whose own evaluator cannot be trusted further than its fixtures is a layer that manufactures justification, which the concepts file correctly names as the most dangerous error in the book — worse than missing support, because it reads as confidence.

Pull one support leg out

The chapter’s strongest demonstration is mechanical. With the support graph built and the main claim verified, withdraw one evidence leg and recompute. Withdrawing the 19 June benchmark breaks the narrow throughput claim, which depended on it alone — and leaves the migration claim standing, because the independent rerun group still holds. That pair is the keystone-versus-redundancy distinction made operational: the same withdrawal is fatal to one belief and harmless to another, and the graph says which before any re-reasoning happens. Withdrawing the decision rationale instead affects both the migration claim and the atomic selection claim, while withdrawing the rerun alone changes nothing at all.

Book result. Dependency impact matches fixture truth exactly on both retractions (E7-H, precision and recall 1.0), and redundant-group removal preserves support (E7-I).

The response to withdrawal is flagging, not rewriting. Affected claims are marked as requiring reevaluation, with the historical evidence preserved rather than deleted. Deciding what is now true given the remaining evidence is Chapter 8’s resolver; Chapter 7 hands it the dependency structure it needs through support_for, sources_for, dependents_of, lineage_of, evidence_groups, and requires_reevaluation queries.

What it cost, and whether the layer earns its place

Provenance is not free. The fixture graph holds 26 nodes and 20 edges for nine claims; the full suite runs in about a millisecond with zero model calls because every judgement is ledger-driven. Those numbers describe the fixture, not production: real extraction and verification cost model calls, storage grows with every derived object that must keep its path home, stale lineage needs maintenance, and false support edges manufacture the most dangerous kind of error. The invariant therefore scopes itself — any derived memory that may influence future behaviour should retain a path back to the evidence it came from — while transient computation owes the layer nothing.

Against the pre-registered outcome types, the fixture evidence maps to Type A: pointer and direct-citation systems produce correct-looking answers with broken support, while explicit groups and lineage repair evidence correctness, localisation, and impact analysis. The scope limits are stated plainly. Extraction and verification are deterministic over fixtures; LLM-backed variants are unmeasured, real-corpus validation is pending, and the echo results already show one place where the machinery degrades honestly. If real-corpus measurement shows direct raw-source grounding sufficing wherever decisions are right, the persistent layer shrinks to a query-time justification (Type B). If lineage helps debugging and revision without moving answer quality, it earns itself as an audit layer (Type C). If AI-generated support edges manufacture justification faster than verification catches it, the layer stays experimental and raw grounding stands alone (Type D). The experiment decides; the chapter records the current score.

What remains unsolved

Chapter 7 answers why a claim was supported. It does not answer whether the claim still holds — whether sources are trustworthy, whether intervals expired, whether a successor superseded the belief, how conflicts resolve, or what the authoritative current state is. That is Chapter 8’s machinery, and the boundary is load-bearing: this layer marks what must be reconsidered, never what should now be believed. Beyond that handoff sit the harder problems this chapter exposes without solving: source reliability as maintained state, support strength and confidence aggregation, how much provenance to retain forever, and whether five years of accumulated chains stay traversable or need their own forgetting. The layer’s answer to all of them is the same dependency structure, offered upward.

Research foundations

Citation and revision research supplies the scoring discipline: RARR retrofits attribution and revises output against evidence, keeping answer and support correctness apart; ALCE benchmarks citation recall and precision over multi-passage answers and finds completeness wanting even in strong systems; Self-RAG gates retrieval and critique on learned support signals; the original RAG formulation grounds generation in retrieved documents. GopherCite contributes verbatim-quote grounding with abstention, and the finding that supported claims can still be untrue. Evaluator caution comes from AttributionBench, which shows automatic attribution judgement stalling near 80% macro-F1, and CiteEval, which replaces bare support labels with principle-driven assessment in full retrieval context. Claimify provides the extraction shape and its evaluation metrics; VeriTrail provides reverse verification with error-stage localisation through multi-step workflows including GraphRAG. Minimal evidence groups give the AND/OR group semantics; PAGE-RAG names the connectivity-support gap and pairs it with minimal sufficient selection; LineageRAG carries per-demand lineages through to verbatim spans with open lineages as honest incompleteness; HARIS represents the search half of multi-hop verification, finding evidence the persistent layer must then represent. The chapter adopts the mechanisms and reserves the model training behind every one of them.

References

• RARR: Researching and Revising What Language Models Say, Using Language Models (2023).
• Enabling Large Language Models to Generate Text with Citations (ALCE) (2023).
• Self-RAG: Learning to Retrieve, Generate, and Critique through Self-Reflection (2024).
• Retrieval-Augmented Generation for Knowledge-Intensive NLP Tasks (2020).
• Teaching Language Models to Support Answers with Verified Quotes (GopherCite) (2022).
• AttributionBench: How Hard is Automatic Attribution Evaluation? (2024).
• CiteEval: Principle-Driven Citation Evaluation for Source Attribution (2025).
• Towards Effective Extraction and Evaluation of Factual Claims (Claimify) (2025).
• VeriTrail: Closed-Domain Hallucination Detection with Traceability (2025, preprint).
• Minimal Evidence Group Identification for Claim Verification (2025).
• PAGE-RAG: Provenance-Aware Graph Evidence Promotion for Fixed-Budget Multi-hop Retrieval-Augmented Generation (2026, preprint; results author-reported).
• LineageRAG: Harnessing GraphRAG by Constructing Evidence Lineages with Source Grounding (2026, preprint; results author-reported).
• Coordinating Search-Informed Reasoning and Reasoning-Guided Search in Claim Verification (HARIS) (2026).