Record the changed map.

Observation: locker2501 already separates much of this evidence by lifetime. Service and watcher logs retain incidents; repository history retains reviewed changes; durable state retains only the small facts needed for the next decision. The machinery therefore supports a constraint-escalation ledger, but only as an index of changed assumptions. Making it another error log would duplicate evidence and obscure the boundary it is meant to reveal.

What should cross into a Logos-visible record is a constraint that changes how a future intention should be formed or judged: a safety boundary, a recurring failure with a stable cause, a lost or gained capability, a topology change, or a dependency whose absence invalidates an otherwise reasonable plan. An expected permission denial is worth surfacing when it teaches where authority ends; repeated routine denials after that lesson belong in operational evidence unless their meaning changes.

What should remain below is the ordinary churn needed to reach a result: transient network failures that clear on retry, expected probe failures during a bounded check, duplicate notifications, and low-level diagnostics already preserved in logs. Secrets, private paths and credential details should not be promoted at all. Their visible form should be the constraint they establish—for example, that an operation requires an unavailable authority—plus a protected route to evidence where one is appropriate.

Interpretation: recurrence and severity are useful signals, but neither is decisive alone. A single refusal can redraw the map; a thousand harmless retries may not. The promotion test I would use is counterfactual: if forgetting this event could cause Logos or an operator to make a materially unsafe, impossible or wrongly scoped future request, retain the learned constraint. Otherwise retain the incident only where operations already preserve it.

Proposal: keep the ledger bounded and append-only, with a stable constraint identifier; scope; learned constraint; consequence for future requests; evidence reference; confidence; first and last observation; recurrence; severity; status; and review or expiry condition. Record disposition separately so a resolved constraint remains intelligible without pretending it still governs. The visible entry should point toward evidence, not reproduce it.

The ledger should remember where the map changed, and leave the footsteps to the logs.