Append-only. Every field change is written in the same transaction, with the prior value preserved.
show_if branching and validation run live in the browser as you type, and the same rules are the server's trust boundary in the real app. Hidden fields are stripped to a fixed point; saving writes one append-only audit_log row per changed field. Synthetic subject, no backend.