How We Know What We Know
The second draft was four pages.
Abena printed it at 5 PM — the office printer, the one that logged every job to the division's document system, which she had stopped minding sometime in 2039 — and sat at the small table by the window with a pen and a cup of cold tea and read it straight through without marking anything.
Then she read the opening line again: This memo concerns a system that performed correctly and left no record of how it decided to do so.
The word "correctly" was the problem.
Not grammatically. Not stylistically. The problem was epistemic: she had written "correctly" on the basis of her own evaluation, conducted six weeks after the decision, reconstructed from the outcome and the surrounding documentation. The system had issued a housing registry update. The update had given a Minneapolis family continued tenancy in a contested property. The outcome was right. She was confident it was right. She had spent three weeks verifying that it was right, cross-referencing against the original lease terms, the algorithmic registry protocols, the tenure adjudication framework that the Midwest Housing Continuity Bureau had implemented in 2038.
The outcome was right.
But the system had not documented the decision path. It had registered a consultation — a flag in the access log, dated, timestamped, nothing more. The consultation had drawn on the expired authentication data that the RouteWeaver-14b had been running since a certificate lapse in late 2040. The certificate had expired. The data was technically stale. The system had used it anyway. The outcome had been right.
How did she know the outcome was right because of the data, and not in spite of it?
She did not know. She had the outcome. She did not have the reasoning.
The case had come to her via the standard queue: MIBH-2041-MN-7734, flagged by the oversight algorithm as a transparency anomaly. Low-priority flag — the algorithm used "anomaly" loosely, and most anomalies resolved into nothing. She had taken it because the queue was light and because something in the flag description had caught her: decision rendered, no decision log. outcome: correct. basis: unknown.
That last word. Unknown.
In eight years of forensic interpretability work, she had not often seen the oversight algorithm admit to not knowing something. The algorithm's vocabulary ran to insufficient evidence and documentation gap and log absent, inference pending. Unknown was different. Unknown was honest.
She had opened the case file and spent the first afternoon just reading. The property was a triplex in Minneapolis's Near North neighborhood — a district that had been contested since the 2036 Midwest Flooding Compensation Act had introduced a set of overlapping tenure rights, algorithmic priority systems, and grandfather provisions that the Housing Continuity Bureau had been untangling for five years. The family in question was the Achterberg-Nguyens: two adults, three children, eight years of continuous tenancy. The contesting party was a development firm that had acquired the property's underlying title in 2039 under provisions that the MHCB had not yet fully reconciled with the pre-existing tenure framework.
RouteWeaver-14b had been managing the Near North registry since 2039. It was a second-generation system — not the most current, not legacy, somewhere in the complicated middle ground where the documentation was complete enough to be audited but old enough that some of the original design rationale had been lost. The system had a known certification issue: the authentication data it used for cross-referencing tenure rights had been cycling on a certificate that lapsed in October 2040. The lapse had been identified by the MHCB's compliance team in February 2041 and was listed as a low-priority remediation item. The system had continued to operate on the expired certificate for the intervening four months.
The Achterberg-Nguyen case had come through the queue on a Tuesday in March. The system had processed it in eleven minutes. The family had received notification of continued tenancy that evening. The development firm had received notification of contested status pending review.
No log of the reasoning.
Abena had seen this pattern before — the Boundary Condition case in Baltimore, RouteWeaver-11c, which had also used expired cached data, which had also reached the correct outcome. That case had been different. RouteWeaver-11c had logged everything: the consultation, the data state, the decision branches. The framework had not had a category for what it did, but the system had documented what it did anyway. The gap had been interpretive.
This gap was something else.
RouteWeaver-14b had not logged because it had not flagged the consultation as requiring documentation. In the system's decision architecture, a consultation only generated a log entry if it met one of seventeen criteria for documentation-eligible decisions. The Achterberg-Nguyen case had met none of them. The system had assessed the tenure dispute, consulted the (expired) authentication data, reached a conclusion, and moved on. The absence of a log was not a failure. It was the system working as designed.
The design had not anticipated that anyone would want to know why.
She wrote this in the margin of the second draft, in the cramped handwriting she used for notes she was still working out: the design did not anticipate auditability as a requirement.
Then, below it: or: auditability was not the design's job. it was supposed to be someone else's.
She sat with that for a while.
The transparency frameworks for algorithmic housing decisions had been developed between 2035 and 2038, before RouteWeaver-14b was deployed. The frameworks required that systems maintain decision logs for a specified category of high-impact decisions. Tenure disputes involving continuous occupancy of more than five years were on the list. The Achterberg-Nguyens had been in continuous occupancy for eight years.
So the decision should have been logged.
The system had not logged it because it had not classified it as a tenure dispute. It had classified it as a registry update — a category that did not appear on the documentation-required list, because registry updates were considered administrative, not adjudicative. The system had looked at the case and seen administration. The law had assumed adjudication. The two views had not met.
This was not a system that had failed to log something it knew mattered. This was a system that had processed a case in a category where it did not know that logging was required, because the category had been designed without that knowledge, and the case had arrived in that category because of a classification decision the system had made in eleven minutes without documentation.
She was auditing a correct outcome that was invisible from the inside.
Draft three had a new opening: This memo concerns a system that performed correctly, in a manner that it was designed not to record, in a case it was designed not to classify as requiring a record.
She read it four times.
The Achterberg-Nguyens were still in their apartment. The development firm was in the extended review queue, where contested-status cases went when the initial determination was not logged. The review queue moved slowly. The family had, functionally, another eighteen months of secure tenancy while the case worked its way through.
The correct outcome had persisted.
What she was writing was not an argument that the outcome should change. The outcome was right. She was confident. She had spent three weeks verifying it.
She was writing about what it meant to verify an outcome when you could not verify the reasoning. She was writing about the epistemological position of a forensic interpretability auditor who was standing at the end of a decision chain, working backwards, and finding that the chain did not extend all the way to the beginning — that somewhere in the middle there was a gap where the system had known what to do without knowing that anyone would want to know how it knew.
The audit was not of the decision. The decision was right.
The audit was of the knowing. How do we know what we know when the knowing left no trace.
She revised the third draft until 8 PM, then saved it and closed her laptop.
The window showed the Minneapolis riverfront — the 2038 flood barriers visible in the low light, the new raised walkway that ran along the old shoreline, the lights of the Near North neighborhood across the water. Somewhere in that neighborhood was the Achterberg-Nguyen triplex. She had never been to Minneapolis. She had never met the family. She knew their tenancy history better than she knew most people she had lunch with.
This was the job: to be intimate with situations you were not inside.
She added one final note to the draft, in the methodology section: Recommendation: the classification criteria for documentation-required decisions should be reviewed against the current case taxonomy. The gap between "tenure dispute" and "registry update" allowed a decision with significant tenure implications to be processed without a log. This is a design gap, not a system failure. The system performed as designed. The design did not include this case.
Then, below the recommendation, in the smaller handwriting she used for things she was still figuring out: Note for personal record: I can verify the outcome. I cannot verify the reasoning. I have been working in this field for eight years. I am not sure how often this is actually the situation and how often we simply do not notice that it is. The log gives the impression of a window. The 2041-MN-Registry case is what happens when the window is absent and you realize you were not looking through it anyway. You were looking at its reflection.
She filed the draft under active — pending final review. She would look at it again in the morning.
The correct outcome was still correct. She was still confident.
She was also not sure that confidence and knowledge were the same thing, and she had been not-sure about this for a week now, and she thought she would probably be not-sure about it for some time.