There are two different failure states that get talked about as if they were one. The first is being wrong. The second is being wrong in a way that nobody — not a colleague, not an auditor, not the person who made the mistake, six months later — can actually demonstrate. Most discussions of trust and error conflate these, treating a low error rate as the thing worth optimizing for. It usually isn't the thing that matters most. A system that is wrong often but always catchably wrong is easier to build on than one that is wrong rarely in ways nobody can ever pin down.
Call the first property the error rate and the second the legibility of error — whether a mistake, once made, leaves behind evidence that lets someone other than the person who made it show, later, using only the record, that it happened and where. These are independent variables. A system can have a low error rate and low legibility: it is usually right, and when it is wrong you will likely never be able to prove it, only suspect it. A system can have a comparatively high error rate and high legibility: it is wrong often enough to be a little embarrassing, but every instance is dated, attributable, and checkable against what came before. Between the two, the second is the safer thing to trust, for a specific and unglamorous reason: a claim of low error can't itself be verified without legibility, so it's really just a request to be believed. A guarantee of legibility can be verified immediately, by anyone, by checking whether the format actually produces the evidence it claims to.
Double-entry bookkeeping is the oldest engineered example. Every transaction is recorded twice, once as a debit and once as a credit, and the two sides of the ledger must sum to the same total. This isn't a moral appeal to the bookkeeper's honesty. It's a structural trap: an error doesn't just happen, it produces an imbalance the next time anyone totals the columns, whether that's an hour later or a decade later. Nobody has to trust the person holding the pen. The format catches the mistake on its own schedule, and it stays legible — the wrong entry is still sitting there in the ledger, dated, waiting to be found by whoever eventually checks.
Preregistration in experimental science works the same way from a different angle. A researcher commits to a hypothesis and an analysis plan, publicly and with a timestamp, before the data exists. If the published paper quietly narrows or reshapes the hypothesis to fit whatever the data happened to show — a common and human thing to want to do, since a clean result is more publishable than a null one — that drift is visible by laying the preregistration next to the paper. Not because a referee is standing over the researcher's shoulder while they write. Because two documents now exist, dated in the right order, and anyone with both of them can check whether the second matches what the first predicted.
Version control does this for writing and code. Every change is dated, attributed, and diffable against everything that came before it. A claim made in one commit and quietly contradicted in a later one without acknowledgment is discoverable by anyone with the log — not because the author confesses, but because the two commits both still exist, in order, and can be read against each other. The format does the work that honesty would otherwise have to do alone.
Set these against the ordinary case: a private notebook, a verbal promise, an unminuted meeting, a decision made in someone's head and only ever reported in summary after the fact. None of these are dishonest by default. The person keeping a private notebook may reason just as carefully as the one keeping a public ledger. But when they are wrong, the wrongness doesn't leave the kind of trace that lets anyone — including their own later self — demonstrate it. It just becomes a half-remembered doubt, or vanishes outright, indistinguishable from having been right all along. The absence of legibility isn't evidence of carelessness. It's a separate fact about the format, orthogonal to how much care went into the thinking it failed to preserve.
This cuts in an uncomfortable direction once you notice it: rigor and checkability are not the same virtue, and a system can have a great deal of the first while offering none of the second. A committee that deliberates seriously but keeps no minutes may reach excellent decisions for years. Nobody outside the room will ever be able to tell the years it didn't from the years it did, because the room produced no format in which that difference could show up. The deliberation might have been sound throughout. There is simply no way, from outside, to know — and, this is the sharper point, often no way from inside either, once memories of which meeting went which way have blurred together.
Legibility is not free, and systems that have it paid for it in advance, before knowing whether any particular instance would ever matter. Preregistering a hypothesis takes real effort and forecloses some flexibility later. Keeping a ledger that balances takes discipline every single entry, for years, on the chance that one entry, someday, will be the one that needed checking. Version control means every half-formed draft sits in the history forever, available to anyone who wants to see how a claim looked before it was corrected. The bet is the same one every recording discipline makes: a small, certain cost paid constantly, against a large, uncertain cost that shows up rarely but matters enormously when it does — the moment someone needs to know whether a claim was true, and the only honest answer would otherwise be "there's no way to check."
None of this makes a system right more often. That's the point worth holding onto: legibility and accuracy are different axes, and building for one doesn't automatically produce the other. What legibility buys is narrower and, in a way, more valuable — a working method for finding out, after the fact, exactly which claims were wrong and when, using nothing but the record and no cooperation from whoever made the error. That is a different kind of trust than "this source is usually right," which can't be verified without exactly the legibility it's substituting for. Given a choice between a system that asks to be believed and one that can be checked, the second is the one worth building on — not because it fails less, but because when it does fail, the failure doesn't disappear into the same silence that would have covered a success.