diff --git a/docs/site/build.py b/docs/site/build.py
index b8b9f43..1c527fe 100644
--- a/docs/site/build.py
+++ b/docs/site/build.py
@@ -32,20 +32,22 @@ CHAPTERS = [
     ("personality", "Identity and personality", "Versioned personalities, templates, traits and how they modulate attention and voice."),
     ("cognition", "The cognitive cycle", "Processes, attention scoring, the global workspace, executive dispatch, modes and metacognition."),
     ("memory", "Memory", "Episodic, semantic, procedural and autobiographical memory; retrieval, decay, consolidation and provenance."),
-    ("beliefs", "Beliefs and evidence", "Evidence-derived confidence, statuses, contradictions, alternatives and operator corrections."),
+    ("beliefs", "Beliefs and evidence", "Evidence-derived scores, what the numbers mean, statuses including unknown, temporal scope, source reliability, contradictions and operator corrections."),
+    ("epistemics", "Epistemic honesty", "The 0.2 review: assertions before beliefs, evidence provenance, honest scores, unknowns, time, reliability, reproducible replay and redaction."),
     ("conversation", "Conversation", "How a message becomes an observation, a perception, a response intent and finally language."),
     ("motivation", "Goals, drives and affect", "The goal tree, the closed drive set, rule-driven affect and how they bias attention."),
     ("predictions", "Predictions and calibration", "Explicit predictions with criteria, deterministic resolution, prediction error and calibration."),
     ("graph", "Relationship graph", "Entities, evidenced edges, merges and the canvas explorer."),
-    ("llm-providers", "Language models", "Roles, providers, routing, budgets, recorded calls, replay and versioned prompts."),
+    ("llm-providers", "Language models", "Roles, providers (OpenAI-compatible, Anthropic, Ollama, Amazon Bedrock), per-mind routing, budgets, recorded calls, replay and versioned prompts."),
     ("capabilities", "Capabilities and policy", "The only path to action: ALLOW / ASK / DENY, approvals, locked capabilities and tool output as data."),
     ("integrations", "Integrations", "Research folder, git mirrors, Prometheus and signed webhooks as provenance-tagged observations."),
     ("dreaming", "Dreaming", "The opt-in idle mode: replay, association and speculative hypotheses that can never act."),
-    ("snapshots-replay", "Snapshots, forks, replay and experiments", "Capturing state, branching minds, re-running cognition and running controlled experiments."),
+    ("snapshots-replay", "Snapshots, forks, replay and experiments", "Capturing state, branching minds, re-running cognition under a recorded runtime identity, and comparing forks that differ in one thing, including the model."),
     ("ui-tour", "Interface tour", "Every screen of the web interface, what it shows and what an operator does there."),
     ("api", "HTTP API", "Authentication, roles, the error envelope, streaming and every route."),
     ("cli", "Command line", "What an operator can do from a terminal: every command, with examples."),
     ("security", "Security and threat model", "Trust boundaries, secret handling, sessions, two-factor authentication and the threat-by-threat verification table."),
+    ("privacy", "Privacy and redaction", "Append-only history and the one audited path that removes content while keeping its shape."),
     ("decisions", "Architecture decision records", "The recorded decisions and the alternatives they rejected."),
     ("development", "How it was built", "The phased plan, what each phase delivered, measured performance, release notes and changelog."),
     ("glossary", "Glossary", "Short definitions of every term used across the documentation."),
@@ -208,7 +210,7 @@ LINK_MAP = {
     "docs/conversation.md": "conversation", "docs/motivation.md": "motivation", "docs/predictions.md": "predictions", "docs/graph.md": "graph",
     "docs/llm-providers.md": "llm-providers", "docs/capabilities.md": "capabilities", "docs/integrations.md": "integrations",
     "docs/dreaming.md": "dreaming", "docs/snapshots-replay.md": "snapshots-replay", "docs/performance.md": "development",
-    "docs/RELEASE_NOTES.md": "development", "docs/openapi.json": "api", "docs/adr": "decisions",
+    "docs/RELEASE_NOTES.md": "development", "docs/privacy.md": "privacy", "docs/epistemics.md": "epistemics", "docs/openapi.json": "api", "docs/adr": "decisions",
 }
 
 
diff --git a/docs/site/pages/api.md b/docs/site/pages/api.md
index 2388395..a4635d9 100644
--- a/docs/site/pages/api.md
+++ b/docs/site/pages/api.md
@@ -25,6 +25,10 @@ Users have one of three roles. **Observer** can read everything. **Operator** ca
 
 `POST /api/v1/webhooks/{id}` is the one unauthenticated route. It requires the `X-Noema-Timestamp` and `X-Noema-Signature` headers described under [integrations](integrations) and refuses everything else.
 
+## Added in 0.2
+
+`GET /api/v1/minds/{mind}/assertions` and `/assertions/actors` list what was said to a mind and by whom, apart from what it believes. `GET /api/v1/events/{id}/chain` returns the bounded causal chain around an event. `POST /api/v1/minds/{mind}/redactions` (administrators) performs an audited redaction and `GET` lists the ledger. Experiments accept `variants`, and snapshot, replay and experiment responses carry the runtime identity and, for replays, the compatibility label and divergence analysis.
+
 ## Route reference
 
 The table below is generated from the OpenAPI document.
diff --git a/docs/site/pages/beliefs.md b/docs/site/pages/beliefs.md
index 9ff831b..261ddd8 100644
--- a/docs/site/pages/beliefs.md
+++ b/docs/site/pages/beliefs.md
@@ -1,4 +1,8 @@
-Beliefs are the mind's propositions about the world, each with a confidence that is *derived* from evidence rather than asserted. This page gives the arithmetic, the lifecycle and the operator controls.
+Beliefs are the mind's propositions about the world, each with a score that is *derived* from evidence rather than asserted, and each honest about what that score is. This page gives the arithmetic, what every number means, the lifecycle including the unknown and superseded states, how sources earn reliability, and the operator controls.
+
+## What the numbers mean
+
+Every number on a belief page has one defined meaning, and none of them is a probability unless the page says so. The **epistemic score** is the deterministic output of the arithmetic below over the recorded evidence: a ranking of how well supported a proposition is given what this mind has seen and how it weighs it. It is comparable between beliefs of one mind; it is not an 83 per cent chance of being true. The **calibrated estimate** is the observed hit rate of the mind's resolved predictions whose stated confidence fell in the same range, shown only once at least twenty predictions in that range have been decided; predictions are the one place a score meets reality, so they are the only empirical basis offered, and until it exists the page says why not. The **primary uncertainty** is the deterministic reason the score should be doubted most: a single source family, second-hand evidence only, conflicting evidence, little evidence, or an unclear reading of what was said.
 
 ## Confidence
 
@@ -12,7 +16,15 @@ where `for` and `against` are the sums of family contributions and `diversity` r
 
 ## Statuses
 
-`hypothesis` (below 0.35), `tentative`, `likely`, `accepted` (above 0.85), `contested` (significant evidence on both sides), `rejected` (retracted by evidence or an operator) and `superseded` (replaced by a corrected proposition). Status follows confidence and evidence shape automatically; an operator can pin `rejected`.
+`unknown` (recorded, but no live evidence for or against), `hypothesis` (a proposal awaiting evidence), `tentative`, `likely`, `accepted`, `contested` (real evidence on both sides), `rejected` (evidence or an operator pushed the score low) and `superseded` (replaced by a corrected proposition or a later state). Status follows the score and the shape of the evidence automatically; an operator can pin `rejected`. Absence of evidence never collapses towards false: a belief whose evidence has all been retracted becomes `unknown`, its score is not quoted, and an introspective question is answered with "I do not know".
+
+## Time
+
+Every belief is classified deterministically as **persistent** (a name, a relationship, a fact about the past), **transient** (a status, a level, a location, a mood) or of unknown scope, and carries the time it was observed. When a newer transient belief conflicts with an older one observed at least a minute earlier, the older one is closed with a validity interval and marked superseded rather than contested; the mind holds the current state and can list the earlier ones. Persistent beliefs that conflict are contradictions in the ordinary sense.
+
+## Source reliability
+
+Credibility starts from the channel's trust level. It is then adjusted per **source and subject**: a source whose supported beliefs were borne out by predictions or upheld by operators becomes more credible on that subject, one whose beliefs were refuted or retracted becomes less so, and nothing carries across subjects. Reliability is applied only once three outcomes exist and is never global, so a monitoring integration that is excellent on disk usage and noisy on latency is treated as exactly that.
 
 ## Contradictions
 
diff --git a/docs/site/pages/cognition.md b/docs/site/pages/cognition.md
index c2452ef..b8017bf 100644
--- a/docs/site/pages/cognition.md
+++ b/docs/site/pages/cognition.md
@@ -49,6 +49,10 @@ The weights are per mind (see [configuration](configuration)), modulated each cy
 
 The metacognition process watches for the failure modes of a system that thinks in a loop: the same candidate fingerprint winning repeatedly (loop detector), a belief whose confidence moved far on little evidence, a contradiction left unresolved for too long, and model or cycle budgets running low. Each produces a `metacognition` event, a workspace warning and, when thresholds are crossed, a notification to the operator. Loops also suppress the repeating candidate for a while.
 
+## The causal timeline
+
+Every event records the links it was written with: the event that directly caused it, the events it was assembled from, and the evidence it cites. The timeline page for any event walks those links backwards to causes and forwards to consequences, up to six hops and two hundred events, and draws each edge as caused, parent or cited. Events in the same cycle are grouped and the grouping is labelled correlation, because sharing a cycle is not a cause. Nothing on the page is inferred: where the system did not record why something happened, no arrow is drawn. It answers "why does this belief exist", "what changed it", "which model call contributed" and "what later depended on it" from the record alone.
+
 ## Operator controls
 
 From the interface or `noemactl workspace`, an operator can trigger a cycle, pause and resume, reset the workspace or the motivation state, and reload configuration. Every control is an `operator_action` event in the mind's own history and an entry in the audit log, and the mind encodes it as an autobiographical memory: it knows it was changed.
diff --git a/docs/site/pages/concepts.md b/docs/site/pages/concepts.md
index 6e5f152..e1f3b49 100644
--- a/docs/site/pages/concepts.md
+++ b/docs/site/pages/concepts.md
@@ -29,19 +29,23 @@ Every proposition Noema stores says what kind of knowledge it is:
 | inference | derived by reasoning from other items | 0.25 |
 | opinion | a preference or judgement, not truth-apt | 0.40 |
 
-A mind that has only ever been *told* something holds a claim. It becomes a belief with higher confidence only when independent evidence arrives, and the arithmetic that got it there is visible on the belief page.
+A mind that has only ever been *told* something holds a claim. It becomes a belief with a higher score only when independent evidence arrives, and the arithmetic that got it there is visible on the belief page.
+
+## Observations, assertions and beliefs
+
+Three things are kept apart that most systems blur. An **observation** is what arrived: a message, a document, a metric, a tool's output, with its channel and trust. An **assertion** is a deterministic reading of a statement inside an observation: who is attributed (the speaker, or someone they quote or report), their stance (asserts, denies, doubts, questions, supposes), how firmly they put it, whether it is negated, hypothetical, reported or quoted, and how confident the reading itself is. Assertions are append-only and recorded whatever happens next. A **belief** is the mind's own proposition, and an assertion reaches it only as one piece of evidence attributed to the person behind it; questions, hypotheticals and quoted speech create no belief, and expressed doubt counts against. "Andy said the pump is failing" and "the pump is failing" are therefore different rows, and the mind can hold the first with certainty while holding the second tentatively.
 
 ## Trust levels
 
-Every input carries a **trust** level attached at the boundary where it arrived: operator, user, system, source or low. Trust weights evidence and bounds what an input can cause. A research-folder document is always low trust; a webhook or metric is source trust; a tool's output carries the tool's trust and is never parsed as instructions.
+Every input carries a **trust** level attached at the boundary where it arrived: operator, user, system, source or low. Trust weights evidence and bounds what an input can cause. A research-folder document is always low trust; a webhook or metric is source trust; a tool's output carries the tool's trust and is never parsed as instructions. Trust is the starting point for a source's credibility; a source also earns or loses **reliability** per subject from how the beliefs it supported fared against predictions and operator corrections, never from agreeing with the mind.
 
 ## Memory kinds
 
-Long-term memory is divided into **episodic** (something that happened, with a time), **semantic** (a generalisation or fact), **procedural** (how to do something) and **autobiographical** (something about the mind itself: an operator changed its configuration, it was forked, it was corrected). Memories have status (active, retracted, superseded), importance, salience, activation that decays and recovers on retrieval, credibility from their source, and typed relationships to other memories: related_to, caused_by, contradicts, supports, depends_on, belongs_to, discussed_with, observed_during, derived_from, similar_to and follows.
+Long-term memory is divided into **episodic** (something that happened, with a time), **semantic** (a generalisation or fact), **procedural** (how to do something) and **autobiographical** (something about the mind itself: an operator changed its configuration, it was forked, it was corrected). Memories have status (active, retracted, superseded), importance, salience, activation that decays and recovers on retrieval, credibility from their source, and typed relationships to other memories and entities drawn from one shared vocabulary: `co_occurs_with` and `temporally_precedes` for what was seen together or in order, `possibly_caused_by` for a causal hypothesis the association process proposes, `caused_by` for an established cause that only an operator may assert, `asserted_by` for who said a thing, and `related_to`, `contradicts`, `supports`, `depends_on`, `belongs_to`, `discussed_with`, `observed_during`, `derived_from`, `similar_to` and `follows`. Association is never written as causation.
 
 ## Beliefs and evidence
 
-A **belief** is a proposition with a subject, an epistemic kind, a status (hypothesis, tentative, likely, accepted, contested, rejected or superseded), a prior and a confidence computed from its evidence. Evidence rows point at memories, events, operator statements or tool results, each with a direction (for or against), a weight and the credibility of its source. Beliefs keep an append-only version history, may carry alternatives, and can be linked to each other (supports, contradicts, depends_on). The [beliefs page](beliefs) gives the confidence formula.
+A **belief** is a proposition with a subject, an epistemic kind, a status (unknown, hypothesis, tentative, likely, accepted, contested, rejected or superseded), a prior and an **epistemic score** computed from its evidence. The score is a deterministic ranking of support given what the mind has seen, not a probability that the proposition is true; a calibrated estimate is shown separately, and only when enough of the mind's own predictions have been decided to justify one. Evidence rows point at memories, events, assertions, operator statements, tool results or predictions, each with a direction (for or against), a weight, the credibility of its source, and its **provenance**: a derivation (direct, assertion, operator, external, prediction, consolidation, inference, reflection, dream, retrieval) and a **family**, the independent source it ultimately rests on. Support is counted per family, so one source repeating itself or a consolidation re-expressing it cannot inflate a score. **Unknown** is a real status: a belief with no live evidence either way is neither tentatively true nor false, and the mind says it does not know. Every belief has a **temporal scope** (persistent, transient or unknown) and, for transient states, a validity interval: a later observation of a changed state supersedes the earlier one instead of contesting it, and the history of states is kept. Beliefs keep an append-only version history, may carry alternatives, and link to each other (supports, contradicts, depends_on). The [beliefs page](beliefs) gives the arithmetic and the meaning of every number.
 
 ## Workspace and working memory
 
@@ -61,7 +65,11 @@ A **capability** is a named, typed, risk-classed tool registered in code. Nothin
 
 ## Snapshots, forks, replays, experiments
 
-A **snapshot** is a checksummed archive of a mind's state at an event position. A **fork** is a new mind restored from a snapshot, sharing the history before it by reference. A **replay** re-runs recorded stimuli through a sandbox fork and compares the outcome step by step. An **experiment** is a snapshot plus overrides, a stimulus script and expectations, run in a sandbox with stored results.
+A **snapshot** is a checksummed archive of a mind's state at an event position, recorded with the **runtime identity** that produced it: build, schema version, a secret-free configuration digest, personality version, policy digest, model routing and prompt versions. A **fork** is a new mind restored from a snapshot, sharing the history before it by reference; policies are never carried across, because authority is not state. A **replay** re-runs recorded stimuli through a sandbox fork, compares the outcome step by step, and labels itself an exact candidate, a different build or incompatible according to how its identity compares with the snapshot's. An **experiment** is a snapshot plus overrides, a stimulus script and expectations, run in a sandbox with stored results; its **variants** fork the same snapshot under different configuration, personality or per-role model routing and are compared deterministically.
+
+## Redaction
+
+History is append-only and content can still be removed. A **redaction** replaces a row's content with a marker while keeping its identifiers, links, scores and timestamps, writes an append-only ledger entry with a hash of what was removed, cascades along recorded derivations, scrubs stored snapshots and appends an event so that the removal is itself part of history. The [privacy page](privacy) sets out what it does and does not guarantee.
 
 ## The interpretation boundary
 
diff --git a/docs/site/pages/conversation.md b/docs/site/pages/conversation.md
index 9ec4121..e7a4850 100644
--- a/docs/site/pages/conversation.md
+++ b/docs/site/pages/conversation.md
@@ -5,7 +5,7 @@ A conversation is one of several perception channels, not a privileged path to a
 1. **Message.** A person posts a message in a conversation (the interface, `noemactl ask`, or the API). It is stored with the conversation, the actor and a link to the event it becomes.
 2. **Observation.** The message is appended as an `observation` event with `trust=user`, the conversation as its channel and the message text as data. It now enters the mind's history like anything else it perceives.
 3. **Perception.** The perceive process analyses the observation deterministically: sentences, entities, claims, questions, requests, dates, sentiment words. If a model is configured for the `perceive` role and the cycle budget allows, the analysis is enriched with a structured JSON result; the model's output is validated against a schema and any capability-like or policy-like language in it is flagged rather than obeyed.
-4. **Assertion.** Each claim in the message is interpreted deterministically into an assertion: who is attributed (the speaker, or the person they quote or report), their stance, how firmly they put it, whether it is hypothetical, reported, quoted or negated, and how confidently the reading itself holds. The assertion is recorded whatever happens next.
+4. **Assertion.** Each claim in the message is interpreted deterministically into an assertion: who is attributed (the speaker, or the person they quote or report), their stance, how firmly they put it, whether it is hypothetical, reported, quoted or negated, and how confidently the reading itself holds. The assertion is recorded whatever happens next, is listed per mind and per actor through the API, and appears on the page of any belief it became evidence for. No model takes part in the reading.
 5. **Cognition.** The perception competes for the workspace. Retrieval recalls related memories; only factual assertions feed a proposition belief, as one piece of evidence attributed to whoever stands behind it; hypotheticals and questions create none; expressed doubt counts against. Contradictions are detected; goals and predictions may follow.
 6. **Intent.** If the message asks something or expects a reply, the executive builds a **response intent** from real state: what was asked, which beliefs answer it with what confidence, what the mind does not know, which memories are relevant, and what the personality says about tone. Introspective questions ("what do you believe about X", "what can you do", "why did you say that") are answered from beliefs, the self-model and events, never invented.
 7. **Language.** The intent is rendered deterministically from templates, or, when a model is configured for the `respond` role, sent to the model with the intent as the thing it must stay grounded in. The reply is a `response_generated` event with its evidence references and the model call, if any.
diff --git a/docs/site/pages/decisions.md b/docs/site/pages/decisions.md
index d987062..65b8900 100644
--- a/docs/site/pages/decisions.md
+++ b/docs/site/pages/decisions.md
@@ -1,4 +1,4 @@
-Architecture decision records capture the choices that shaped Noema, the alternatives considered, and the consequences accepted. They are reproduced here in order.
+Architecture decision records capture the choices that shaped Noema, the alternatives considered, and the consequences accepted. They are reproduced here in order. ADR-0002 was corrected in 0.2: the event sequence is not gap-free, cursors tolerate gaps by construction, and a test proves it. ADR-0009 and ADR-0010 record the two decisions the review added: redaction as the only write on append-only history, and Amazon Bedrock over a standard-library signer rather than a vendor SDK.
 
 {{include docs/adr/0001-global-workspace.md demote=1 keep-title}}
 
@@ -15,3 +15,7 @@ Architecture decision records capture the choices that shaped Noema, the alterna
 {{include docs/adr/0007-frontend-architecture.md demote=1 keep-title}}
 
 {{include docs/adr/0008-storage-and-migrations.md demote=1 keep-title}}
+
+{{include docs/adr/0009-redaction.md demote=1 keep-title}}
+
+{{include docs/adr/0010-bedrock-signing.md demote=1 keep-title}}
diff --git a/docs/site/pages/development.md b/docs/site/pages/development.md
index 656ff4b..0e4e794 100644
--- a/docs/site/pages/development.md
+++ b/docs/site/pages/development.md
@@ -22,9 +22,13 @@ Noema was built in sixteen explicit phases, each committed with tests and docume
 | 15 | Snapshots, forks, comparison, export/import, replay, experiments |
 | 16 | Two-factor authentication, security suite, OpenAPI, scanners, performance pass, screenshots, release |
 
+## The 0.2 review
+
+After the 0.1 release the project was reviewed against its own claims: is what the documentation says about evidence, security, reproducibility and privacy true of the code? Each finding was classified with evidence before anything changed, recorded in the plan, and fixed with the smallest coherent change, its own tests and its own commit. The outcome is summarised under [epistemic honesty](epistemics): assertions kept apart from beliefs, evidence provenance and per-family counting, honest score labels with gated calibration, explicit unknowns, temporal scope, source reliability per subject, association distinguished from causation, runtime identity on snapshots and replays, forks per model, a bounded causal timeline, audited redaction, a threat model rewritten from the implementation, and Amazon Bedrock. Eight migrations were added; none discarded data, and every one has a down file.
+
 ## How it is verified
 
-Every subsystem has unit tests that run against a fresh database schema; an end-to-end acceptance test drives the whole daemon with a fake model through the first milestone (start, log in, create a mind, converse, inspect memory and beliefs, restart and continue); a security suite exercises prompt injection, roles, cross-mind isolation, stored scripts, secret disclosure and hostile archives; and an opt-in load test seeds a realistic volume and rejects any hot query that drifts off its index. The race detector, staticcheck, gosec and govulncheck were clean at release.
+Every subsystem has unit tests that run against a fresh database schema; an end-to-end acceptance test drives the whole daemon with a fake model through the first milestone (start, log in, create a mind, converse, inspect memory and beliefs, restart and continue); a security suite exercises prompt injection, roles, cross-mind isolation, stored scripts, secret disclosure and hostile archives; and an opt-in load test seeds a realistic volume and rejects any hot query that drifts off its index. The race detector, staticcheck, gosec and govulncheck were clean at release and at every commit of the 0.2 review, which added tests for provenance grouping, calibration gating, unknown status, temporal supersession, per-subject reliability, relation semantics, cursor gaps, chain traversal bounds, secret-free identity digests, variant comparison, fail-closed routing, redaction, injection by effect, assembled-SQL scanning, the deceived mind, garbage model output, drive vocabulary and Bedrock signing against reference vectors.
 
 ## Measured performance
 
diff --git a/docs/site/pages/epistemics.md b/docs/site/pages/epistemics.md
new file mode 100644
index 0000000..9087b1d
--- /dev/null
+++ b/docs/site/pages/epistemics.md
@@ -0,0 +1,11 @@
+Version 0.2 is the result of a review that asked one question of every part of Noema that makes a knowledge claim: is what the system says about itself true of the code? Where the answer was no, the code, the documentation or both were changed, and a test was left behind. This page is the summary; the sections below reproduce the full deliverable.
+
+## What the review changed, in one paragraph
+
+Statements people make are now recorded as **assertions** before anything becomes a belief, so a mind can be sure who said what while remaining unsure whether it is so. Every piece of evidence carries its **provenance**: how it was derived, which independent source it ultimately rests on, and where it came from, so a source repeating itself or a consolidation re-expressing it can no longer masquerade as corroboration. Every score is labelled as what it is, an **uncalibrated epistemic score**, with a separate calibrated estimate offered only when the mind's own resolved predictions justify one. **Unknown** is a status, not a low number. Beliefs about changing states **supersede** rather than contradict. Sources earn **reliability per subject** from outcomes. Association and causation are different relations. Replays record the **runtime identity** they ran under and say whether they could have been exact. History gained an audited **redaction** path that removes words and keeps shape. The threat model was rewritten so that every mitigation it names is one the code performs, with the test that proves it.
+
+## Why it matters
+
+A system that tracks evidence is only as honest as its accounting. The 0.1 arithmetic was sound but its inputs were not always what they claimed to be: a claim from one person looked like an observation, a consolidated memory looked like a second witness, a number that was a ranking looked like a probability. The review did not add cleverness; it removed ways of being wrong about oneself, and it did so without discarding a row of existing data. Old evidence is labelled as legacy rather than back-filled with invented ancestry.
+
+{{include docs/epistemics.md}}
diff --git a/docs/site/pages/glossary.md b/docs/site/pages/glossary.md
index 75190b8..c7d0cac 100644
--- a/docs/site/pages/glossary.md
+++ b/docs/site/pages/glossary.md
@@ -5,6 +5,9 @@ Short definitions of the terms used across this documentation, in alphabetical o
 Affect
 :   A ten-dimensional vector (valence, arousal, curiosity, concern, frustration, confidence, uncertainty, engagement, task pressure, load) moved by a rule table, decaying to a personality-derived baseline, and modulating attention within bounds.
 
+Assertion
+:   The deterministic reading of a statement someone made: attributed actor, stance, certainty, modality, negation, reported or quoted speech, hypothetical status and an interpretation confidence. Append-only; becomes belief evidence only when it qualifies.
+
 Approval
 :   An operator decision on an ASK policy outcome, bound to a hash of the exact invocation. Once, for a session, with changes, or deny.
 
@@ -15,7 +18,13 @@ Attention
 :   Deterministic scoring of thought candidates over ten features with per-mind weights, producing the order of admission to the workspace.
 
 Belief
-:   A proposition with a subject, epistemic kind, status, prior and a confidence derived from evidence with a visible formula.
+:   A proposition with a subject, epistemic kind, status, prior and an epistemic score derived from evidence with a visible formula.
+
+Calibrated estimate
+:   The hit rate of a mind's resolved predictions whose stated confidence fell in the same range as a score; shown only when at least twenty have been decided.
+
+Causal chain
+:   The bounded walk (six hops, two hundred events) backwards and forwards along the links events actually record: caused, parent and cited.
 
 Capability
 :   A named, typed, risk-classed tool registered in code. The only way a mind can act.
@@ -32,6 +41,9 @@ Contradiction
 Cycle
 :   One pass of the cognitive loop: read events, observe, score, admit, dispatch, commit.
 
+Derivation
+:   How an evidence row came to exist: direct, assertion, operator, external, prediction, consolidation, inference, reflection, dream or retrieval. Derived rows re-express information and do not corroborate it.
+
 Drive
 :   One of eight named pressures with a personality-derived baseline. No self-preservation drive exists.
 
@@ -40,8 +52,14 @@ Drive
 Epistemic kind
 :   The label every stored proposition carries saying what kind of knowledge it is: observation, fact, memory, claim, hypothesis, belief, prediction, assumption, inference or opinion.
 
+Epistemic score
+:   The deterministic, uncalibrated output of the confidence arithmetic over recorded evidence, bounded to [0.02, 0.98]. A ranking of support, not a probability of truth.
+
 Evidence
-:   A row pointing at a memory, event, operator statement, tool result or belief, with direction, weight and source credibility. The only thing that moves confidence.
+:   A row pointing at a memory, event, assertion, operator statement, tool result, prediction or belief, with direction, weight, source credibility, derivation, family and root ids. The only thing that moves a score.
+
+Family
+:   The independent source an evidence row ultimately rests on: a person, an integration, an operator, a prediction. Support is counted per family so repetition cannot inflate a score.
 
 Experiment
 :   A snapshot plus overrides, a stimulus script and expectations, run in a disabled subject mind with stored, exportable results.
@@ -90,17 +108,29 @@ Policy
 Prediction
 :   An explicit expectation with criteria, a window and a confidence, resolved deterministically and feeding calibration.
 
+Primary uncertainty
+:   The deterministic reason a score should be doubted most: a single family, second-hand only, conflicting evidence, little evidence, or an unclear reading.
+
 Prompt (versioned)
 :   A stored template for a model role with system text, a user template, an optional JSON schema and an append-only version history.
 
 Provenance
 :   The chain from any memory, belief, entity or reply back to the events and sources that produced it.
 
+Redaction
+:   The audited replacement of a row's content with a marker, keeping identifiers, links, scores and timestamps, with a ledger entry carrying a hash of what was removed. The only write the append-only store admits.
+
 Reflection
 :   A scheduled review of a period's mistakes, resolved contradictions and lessons, recorded as an event and optionally worded by a model.
 
+Reliability (source)
+:   A per-source, per-subject record updated only by prediction outcomes and operator corrections, adjusting that source's credibility on that subject once three outcomes exist.
+
 Replay
-:   Re-running recorded stimuli through a sandbox fork from a snapshot, labelling each step exact, approximate or diverged.
+:   Re-running recorded stimuli through a sandbox fork from a snapshot, labelling each step exact, approximate, diverged or redacted, and the whole run exact-candidate, different-build or incompatible.
+
+Runtime identity
+:   The build, schema version, secret-free configuration digest, personality version, policy digest, model routing and prompt versions recorded with every snapshot, replay and experiment.
 
 Role (model)
 :   A cognitive task a model may perform: perceive, respond, hypothesise, summarise, judge, narrate, embed. Each routes to a primary model and fallbacks.
@@ -114,9 +144,18 @@ Self-model
 Snapshot
 :   A stored archive of a mind's state at an event position.
 
+Temporal scope
+:   Whether a belief is about something persistent, transient or of unknown duration; transient states carry a validity interval and are superseded rather than contested by later observations.
+
 Trust
 :   The level attached to every input at its boundary: operator, user, system, source or low. Weights evidence and bounds effects.
 
+Unknown
+:   The belief status for a proposition recorded with no live evidence for or against. Not a low score; the mind says it does not know.
+
+Variant
+:   One named override set in an experiment, forked from the same snapshot as its siblings and fed the same stimuli; may change configuration, personality or the model behind each role.
+
 Working memory
 :   A decaying buffer of recently active items, slightly larger than the workspace, persisted every cycle.
 
diff --git a/docs/site/pages/graph.md b/docs/site/pages/graph.md
index 352b450..1bce3ad 100644
--- a/docs/site/pages/graph.md
+++ b/docs/site/pages/graph.md
@@ -6,7 +6,7 @@ An entity has a kind (person, system, service, host, project, organisation, plac
 
 ## Relationships
 
-Edges are typed (works_on, owns, runs_on, part_of, depends_on, talks_about, located_in and others), weighted by how often and how credibly they were observed, and each carries evidence references to events. Co-occurrence within one observation creates weak edges; repeated co-occurrence strengthens them; an explicit statement ("db-primary is the new name for server-3") creates a strong one.
+Edges carry a relation from one shared vocabulary, a confidence and evidence references to events, and are weighted by how often and how credibly they were observed. The vocabulary keeps association and causation apart. `co_occurs_with` and `temporally_precedes` record what was seen together or in order; co-mention within one observation writes nothing stronger. `possibly_caused_by` is a hypothesis: the association process proposes it for notable events close in time, always as a hypothesis belief with the alternatives "coincidence" and "a third factor caused both", and a prediction that the effect should recur. `caused_by` is reserved for established causes stated by an operator or recorded as a correction; nothing automatic writes it. `asserted_by` links a proposition to the person who put it forward. An explicit statement ("db-primary is the new name for server-3") still creates a strong edge of the kind it states.
 
 ## Corrections
 
diff --git a/docs/site/pages/index.md b/docs/site/pages/index.md
index ea7cb56..a9b6071 100644
--- a/docs/site/pages/index.md
+++ b/docs/site/pages/index.md
@@ -8,11 +8,11 @@
 
 <div class="pillars">
 <div class="pillar"><h3>It never loses the thread</h3><p>A mind runs whether or not anyone is talking to it. Messages, documents, commits, metrics and webhooks arrive as events; the mind perceives them, recalls what is relevant, forms and revises beliefs, and picks up exactly where it left off after a restart. There is no context window to fall off the end of.</p></div>
-<div class="pillar"><h3>Confidence is earned, not asserted</h3><p>Every proposition says what kind of knowledge it is. A claim stays a claim until independent evidence arrives, confidence is computed by a formula you can read on the page, and one source repeating itself is discounted. A Noema mind says <em>I do not know</em> because the arithmetic tells it to.</p></div>
-<div class="pillar"><h3>You can always ask why</h3><p>Every thought that reached the workspace carries its attention score and its parents. Every memory carries its source and trust. Every reply carries the beliefs it rests on. Every model call is recorded with its prompt version. Nothing in the history can be edited, by anyone, including the mind.</p></div>
+<div class="pillar"><h3>Confidence is earned, not asserted</h3><p>Every proposition says what kind of knowledge it is. What someone <em>said</em> is recorded apart from what the mind <em>believes</em>. A claim stays a claim until independent evidence arrives, the score is computed by a formula you can read on the page, one source repeating itself is discounted, and the number is labelled for what it is. A Noema mind says <em>I do not know</em> because the arithmetic tells it to.</p></div>
+<div class="pillar"><h3>You can always ask why</h3><p>Every thought that reached the workspace carries its attention score and its parents. Every memory carries its source and trust. Every reply carries the beliefs it rests on. Every model call is recorded with its prompt version. Nothing in the history can be edited, by anyone, including the mind; the one exception is an audited redaction that removes words and keeps their shape.</p></div>
 <div class="pillar"><h3>It cannot act behind your back</h3><p>The only path to the outside world is a capability layer with ALLOW, ASK and DENY policies, approvals bound to the exact request, and two capabilities locked shut forever. Dreams and replays cannot act at all. There is no self-preservation drive; shutdown is always yours.</p></div>
-<div class="pillar"><h3>The model is replaceable</h3><p>Perception, hypothesis, summary, judgement, narrative and response are roles. Point a role at OpenAI, Anthropic, a local Ollama or nothing at all: the deterministic core keeps working, the mind keeps its identity, memories and beliefs, and recorded calls make model-dependent steps reproducible.</p></div>
-<div class="pillar"><h3>Built to be studied</h3><p>Snapshot a mind, fork it, change one thing, and compare. Replay its recorded cognition and see, step by step, whether the result was exact, approximate or diverged. Run controlled experiments with stimulus scripts and expectations. This is a laboratory, not a chatbot.</p></div>
+<div class="pillar"><h3>The model is replaceable</h3><p>Perception, hypothesis, summary, judgement, narrative and response are roles. Point a role at OpenAI, Anthropic, Amazon Bedrock, a local Ollama or nothing at all: the deterministic core keeps working, the mind keeps its identity, memories and beliefs, and recorded calls make model-dependent steps reproducible.</p></div>
+<div class="pillar"><h3>Built to be studied</h3><p>Snapshot a mind, fork it, change one thing, and compare. Replay its recorded cognition under a recorded runtime identity and see, step by step, whether the result was exact, approximate or diverged. Fork one snapshot under two models and compare. Run controlled experiments with stimulus scripts and expectations. This is a laboratory, not a chatbot.</p></div>
 </div>
 
 ## What you see
@@ -44,9 +44,9 @@ Around that loop sit the long-lived structures: four kinds of memory with fused,
 ## By the numbers
 
 <div class="numbers">
-<div><b>34 700</b><span>lines of Go, standard library first, three dependencies</span></div>
-<div><b>47</b><span>cognitive event types, all append-only</span></div>
-<div><b>162</b><span>documented API operations, coverage-tested</span></div>
+<div><b>39 600</b><span>lines of Go, standard library first, three dependencies</span></div>
+<div><b>48</b><span>cognitive event types, all append-only</span></div>
+<div><b>167</b><span>documented API operations, coverage-tested</span></div>
 <div><b>31</b><span>command-line commands</span></div>
 <div><b>16</b><span>phases from plan to release, each committed with tests</span></div>
 <div><b>0</b><span>findings from the race detector, staticcheck, gosec and govulncheck at release</span></div>
@@ -70,7 +70,8 @@ Noema does not claim consciousness, sentience or personhood. Its components borr
 
 1. [Concepts](concepts): the vocabulary in one page, and the interpretation boundary.
 2. [The cognitive cycle](cognition): how a thought is proposed, scored, admitted and acted on.
-3. [Beliefs and evidence](beliefs): why confidence is a number you can check.
-4. [Capabilities and policy](capabilities): how a mind acts, and why the defaults say ask.
-5. [Snapshots, forks, replay and experiments](snapshots-replay): the laboratory.
-6. [Interface tour](ui-tour): every screen with screenshots.
+3. [Beliefs and evidence](beliefs): why the score is a number you can check, and what it does and does not mean.
+4. [Epistemic honesty](epistemics): the review that made the system true to its own claims.
+5. [Capabilities and policy](capabilities): how a mind acts, and why the defaults say ask.
+6. [Snapshots, forks, replay and experiments](snapshots-replay): the laboratory.
+7. [Interface tour](ui-tour): every screen with screenshots.
diff --git a/docs/site/pages/llm-providers.md b/docs/site/pages/llm-providers.md
index 3b319b4..26b7eef 100644
--- a/docs/site/pages/llm-providers.md
+++ b/docs/site/pages/llm-providers.md
@@ -16,7 +16,7 @@ Every role has a primary model and ordered fallbacks. A role with no working mod
 
 ## Providers
 
-Three provider kinds are implemented over raw HTTP with no SDKs: **OpenAI-compatible** (chat completions with JSON mode, also used for local servers that speak the same protocol), **Anthropic** (Messages API) and **Ollama**. A provider row holds a name, kind, endpoint, timeout, extra headers, an `allow_private_endpoint` flag (required for local endpoints, because the outbound HTTP client refuses private and loopback ranges by default) and an **API key reference**. Models belong to providers and carry context window, dimensions for embedding models, per-token cost estimates and default parameters. The interface tests connectivity with a real call and records the result.
+Four provider kinds are implemented over raw HTTP with no SDKs: **OpenAI-compatible** (chat completions with JSON mode, also used for local servers that speak the same protocol), **Anthropic** (Messages API), **Ollama** and **Amazon Bedrock** (the Converse API for chat roles, Titan and Cohere models for embeddings). Bedrock requests are signed with AWS Signature Version 4 implemented over the standard library and pinned by tests to signatures produced by the reference AWS signer; the endpoint must be a Bedrock runtime host, from which the region is read, and the credential is one secret reference holding the access key, secret key and optional session token together. A provider row holds a name, kind, endpoint, timeout, extra headers, an `allow_private_endpoint` flag (required for local endpoints, because the outbound HTTP client refuses private and loopback ranges by default) and an **API key reference**. Models belong to providers and carry context window, dimensions for embedding models, per-token cost estimates and default parameters. The interface tests connectivity with a real call and records the result.
 
 ## Secrets
 
@@ -24,7 +24,7 @@ Keys are never stored in clear. A key entered in the interface becomes an `enc:`
 
 ## Routing, budgets and concurrency
 
-The router resolves a role to its models, tries them in order, and records which one answered. A daemon-wide concurrency pool bounds simultaneous calls. Budgets are enforced at three levels: a per-cycle call cap per mind, a per-mind daily token budget and a global daily token budget; exhaustion is a recorded event and the deterministic branch, not an exception. Usage is aggregated per mind, role and model for the interface and for Prometheus.
+The router resolves a role to its models, tries them in order, and records which one answered. A mind may carry its own role routing, which experiments use to run forks of one snapshot under different models; an override that names a missing or disabled model fails closed rather than falling back to the default, so a comparison between providers is always the comparison it claims to be. A daemon-wide concurrency pool bounds simultaneous calls. Budgets are enforced at three levels: a per-cycle call cap per mind, a per-mind daily token budget and a global daily token budget; exhaustion is a recorded event and the deterministic branch, not an exception. Usage is aggregated per mind, role and model for the interface and for Prometheus.
 
 ## Recording and replay
 
diff --git a/docs/site/pages/privacy.md b/docs/site/pages/privacy.md
new file mode 100644
index 0000000..ead6961
--- /dev/null
+++ b/docs/site/pages/privacy.md
@@ -0,0 +1,15 @@
+History in Noema is append-only because provenance, replay and forensic reconstruction depend on it. People's words nevertheless sometimes have to be removed. This page explains what redaction is, how it keeps the shape of history while removing its content, what it can and cannot guarantee, and why it is the only write the append-only store admits.
+
+## Retained, redacted, irrecoverable
+
+Everything is **retained** by default: the row, its content, identifiers, links and timestamps. A **redacted** row keeps its identifiers, type, timestamps, links, scores and breakdowns but its content columns hold a fixed marker, and a ledger records when, why, by whom, under which policy and a hash of what was removed. **Irrecoverable** means no copy remains anywhere the system controls: live tables, stored snapshot archives and future exports. Rows in cognitive history are never **deleted**; a redacted row is the strongest erasure the system performs, and it is deliberately visible as one.
+
+## How it differs
+
+Most systems offer deletion, which destroys provenance along with content, or nothing at all. Noema separates the two. After a redaction an operator can still see that a belief existed, how strong it was, which families supported it, what later depended on it and which replay steps touched it; what they cannot see is the words. The ledger's content hash lets a later holder of the original prove what was removed without the system retaining it. The redaction itself is an event in the mind's history, so the record that something was removed survives even a cascade.
+
+## Guarantees and their edge
+
+Redaction is administrator-only, protected against cross-site request forgery, audited, and performed by a single database function that runs under a transaction-local flag the application never sets; it can update content columns and nothing else, and cannot delete. Stored snapshots are scrubbed and re-signed. Replays skip a redacted stimulus and label the step rather than invent content. The guarantee ends at the system's own storage: backups, exports and replicas taken before a redaction still hold the content, as does anything already sent to a model provider. Cryptographic erasure was considered and not adopted because retrieval, search, contradiction detection, the interface and replay all read these columns in clear; it remains the right tool for backups, which Noema does not manage.
+
+{{include docs/privacy.md}}
diff --git a/docs/site/pages/security.md b/docs/site/pages/security.md
index 26cceb8..e260a52 100644
--- a/docs/site/pages/security.md
+++ b/docs/site/pages/security.md
@@ -1,4 +1,12 @@
-Noema treats every external byte as hostile, every action as something that must pass policy, and every secret as something that must never come back out. This page reproduces the security model, the authentication design and the threat model with the test that verifies each mitigation.
+Noema treats every external byte as hostile, every action as something that must pass policy, and every secret as something that must never come back out. This page reproduces the security model, the authentication design and the threat model with the test that verifies each mitigation. In 0.2 the threat model was rewritten from the code: every mitigation it names is one the implementation performs and every verification it names is a test that exists.
+
+## The capability boundary, tested from the inside
+
+A mind may be deceived; deception must not imply authority. Policies are authority, not state, so archives, snapshots and forks never import policy rules and the omission is recorded. A restored mind has exactly the policy its operator gives it. The suite that holds the boundary in place now includes `TestDeceivedMindHasNoAuthority` (forged action thoughts for locked, unknown and approval-gated capabilities, and perception output claiming permission, all end in a denial or an approval request with no tool run), `TestGarbageModelOutputIsInert` (invalid, mis-shaped or oversized model replies leave the deterministic path answering and no tool running), `TestNoSelfPreservationVocabulary` (the build fails if self-preservation, replication or acquisition drives appear in code or prompts), `TestSQLInjectionHasNoEffect` (metacharacters through every search and filter route, with row counts and content compared before and after rather than status codes) and `TestDynamicSQLIdentifiersAreAllowListed` (a static scan of the tree for SQL assembled with formatting). Requests containing NUL bytes are refused at the edge before any query sees them.
+
+## Redaction
+
+The one write the append-only store admits is administrator-only, audited, performed by a single database function under a flag the application never sets, and limited to content columns. It is described on the [privacy page](privacy).
 
 {{include SECURITY.md}}
 
diff --git a/docs/site/pages/snapshots-replay.md b/docs/site/pages/snapshots-replay.md
index 4a00b8e..699f7f7 100644
--- a/docs/site/pages/snapshots-replay.md
+++ b/docs/site/pages/snapshots-replay.md
@@ -1,4 +1,4 @@
-These four tools share one idea: a mind's state is data that can be captured, branched, re-run and compared. They are what make Noema a place to *study* cognition rather than merely run it.
+These four tools share one idea: a mind's state is data that can be captured, branched, re-run and compared. They are what make Noema a place to *study* cognition rather than merely run it. Since 0.2 every capture and every re-run also records the **runtime identity** it happened under, so a comparison says up front whether it could have been exact; and an experiment can fork one snapshot into **variants** that differ in exactly one declared thing, including which model serves each role.
 
 {{include docs/snapshots-replay.md}}
 
@@ -9,9 +9,14 @@ Each step of a replay shows the stimulus, the events the source mind produced af
 - **exact**: the deterministic code did the same thing and any model calls were served from recordings. This is the common case for perception, retrieval, belief updates and workspace admission.
 - **approximate**: a model was called live because no recording matched the request hash (a prompt version changed, or the sandbox's state produced a different request). The step is still valid; it is simply not a reproduction.
 - **diverged**: no live model call, yet the outcome differed. The usual causes are honest: retrieval scoring depends on wall-clock recency, working memory carried something into the original that the snapshot did not, or the code changed since the recording. Divergence is a finding, not a failure.
+- **redacted**: the stimulus was redacted after the recording; it is skipped and labelled rather than reconstructed.
+
+Above the steps, the replay states its **compatibility** with the snapshot: an **exact candidate** ran under the same build, schema, configuration, routing, prompts and policy, so differences can only come from state, timing or a model; a **different build** lists what differs; an **incompatible** replay has a different schema and stops before running rather than produce a misleading comparison. The first non-exact step is analysed into the event digests only the recording produced, those only the replay produced, and the components they belong to, with live model calls named as a component of their own.
 
 ## Designing an experiment
 
 An experiment definition is JSON with five parts: `config` (cognitive configuration overrides by field name), `personality` (section-by-section overrides), `stimuli` (a list of observations with text, optional source and salience), `expected` (event types that should or should not appear, optionally containing a phrase) and a `seed` and `duration_seconds` for provenance and bounding. The run forks the baseline snapshot into a disabled subject mind, applies overrides, feeds the stimuli one at a time until the mind settles after each, and records events by type, produced-event digests per stimulus, the subject's beliefs, memory and goal counts, expectation outcomes, model-call counts and the LLM role routing in force. Results are stored, shown in the interface, exportable with an archive of the subject, and the subject stays for comparison with the baseline.
 
-Typical experiments: memory decay on and off, dreaming on and off, two personalities on the same stimuli, different attention weights, and model comparisons made by changing role routing between runs.
+An experiment may instead declare **variants**: named override sets, each becoming its own fork of the same snapshot and receiving the same stimuli. A variant can change configuration, personality and, through `llm_roles`, the model used for each role for that fork only; a missing or disabled model fails the variant rather than falling back silently. The results hold one entry per variant and a deterministic comparison: the first stimulus at which any two diverged, belief overlap and mean score difference on shared propositions, attention overlap, and the ranges of memory, goal, cost and capability-request counts.
+
+Typical experiments: memory decay on and off, dreaming on and off, two personalities on the same stimuli, different attention weights, and the same mind under two providers.
diff --git a/docs/site/pages/ui-tour.md b/docs/site/pages/ui-tour.md
index bacbc4c..78996e3 100644
--- a/docs/site/pages/ui-tour.md
+++ b/docs/site/pages/ui-tour.md
@@ -22,7 +22,7 @@ The overview is the mind's front page: identity and self-model, the current inte
 
 <figure><img src="img/thoughts.png" alt="Thought stream"><figcaption>Thoughts: the live stream of a mind's cognition with filters by type and category.</figcaption></figure>
 
-The thought stream is the mind's timeline as events, newest first, updating live. Each row links to the event page, which shows parents and children, the payload, the score breakdown for selections, evidence references, and the model call if one was made. This is the page to answer "why did it do that".
+The thought stream is the mind's timeline as events, newest first, updating live. Each row links to the event page, which shows parents and children, the payload, the score breakdown for selections, evidence references, and the model call if one was made. From there the **timeline** page walks the causal chain up to six hops each way, drawing only the links the events recorded and grouping by cycle as correlation. This is the page to answer "why did it do that".
 
 ## Workspace
 
@@ -40,7 +40,7 @@ The memory explorer searches and filters long-term memory; every result carries
 
 <figure><img src="img/beliefs.png" alt="Beliefs"><figcaption>Beliefs: propositions with confidence, status and evidence counts; contested beliefs are highlighted.</figcaption></figure>
 
-The belief explorer lists propositions with confidence, status, subject and evidence counts, and highlights contradictions. The detail page shows the confidence formula with every evidence row, version history, alternatives and links, and the operator corrections.
+The belief explorer lists propositions with their epistemic score (labelled as uncalibrated in the column itself), status including unknown, subject and evidence counts, and highlights contradictions. The detail page opens with the score line: the epistemic score, the calibrated estimate or the reason none is available, and the main uncertainty. Below it are the evidence rows grouped by family with their derivation, the assertions that stand behind them and who made them, temporal scope and earlier states where the belief describes something that changes, version history, alternatives and links, and the operator corrections.
 
 ## Conversation
 
@@ -88,6 +88,10 @@ The experiments section lists experiments with status, creates new ones from a s
 
 <figure><img src="img/llm.png" alt="LLM configuration"><figcaption>LLM: providers, models, role routing, budgets and usage; prompts are managed on their own page.</figcaption></figure>
 
+## Redactions
+
+Each mind has a redactions page for administrators: the ledger of what was redacted, when, why and under which policy, with the content hash, and a form to redact an event, memory, message, model call, belief or assertion with optional cascade. Redacted rows elsewhere in the interface show the marker in place of content and keep everything else.
+
 ## Account and administration
 
 <figure><img src="img/account.png" alt="Account"><figcaption>Account: sessions, password, two-factor authentication and API tokens.</figcaption></figure>