behaviour as a lens over the record

The record describes participants as actors. That framing is familiar and it arrives with baggage: an actor needs mutable state and an inbox, which this same design forbids storing, because its records are immutable. One half of the design says the state is append-only; the other half says participants act.

The tension is auditability against agency. An immutable record is a filing cabinet. A mutable actor is a box with a mailbox, and everything worth checking about it happens somewhere an auditor cannot see.

The decision makes the actor a lens over the record rather than a second store. What a participant may do is derived from the agreement governing it and the messages it has already received, so the two readings — the auditor reading the record, the peer reading a live participant — are two views of one object rather than two objects kept in step. Nothing about behaviour gets its own history, because the history is the record.

What it costs is computation on the read path, since behaviour has to be derived and replayed rather than remembered, and the loss of anything an actor would have kept in memory without writing down. It also loads the claim that the two views really are the same object: if they ever diverge, the audit becomes fiction.

What it proves is that the team took a familiar model of concurrent behaviour and refused to let it become a second source of truth. The harder arrangement is the one that keeps the audit honest, and it was chosen with the cost stated.