Provenance is not a log kept beside the data. It is part of the fact. When Ontonio answers a question, the answer can say which system said so and when, because that is what it read.
Every connector, sensor and actor writes with its own name on the fact. A fact that cannot be placed, because its object is unknown or its shape is wrong, is parked where a person can see it. It is never silently dropped.
Superseding, not overwriting, is what makes the history honest. The delivery date an order carried in March and the one a customer messaged in June are both there, each with its source, and the system can say which is current and why.
Worked example · A customer message
A customer messages "we'll be there around nine". The message proposes a fact, expected arrival 21:00, with source customer message, the time it arrived and the thread it came from. The order's original arrival time is not replaced. The two now disagree, which is the next page.
a worked example in generic terms; every operation renames the labels, the shapes do not change