Eleven months after the project closed, the email arrived with a subject line that makes a localization lead's stomach drop: "Regulatory audit, German IFU batch, evidence request, response due in five business days." A medical-device manufacturer was being audited by a notified body, and one of the documents in scope was an instructions-for-use leaflet that Marisol's team had localized into German under an MT-first pipeline almost a year earlier. The auditor did not want a reassurance. The auditor wanted to know, for a specific safety warning on a specific page, exactly how that German sentence came to exist: what produced the first draft, whether a machine had touched it, who had reviewed it, against which approved terminology, how it had been scored, and who had signed it off as fit to ship. The old Marisol, three years and one pipeline ago, would have spent those five days in a panic, emailing freelancers who had moved on, grepping through TMS exports, reconstructing a story from fragments and hoping it held together. The new Marisol opened one file. It was a structured export keyed by segment id, and for that one warning it carried a complete chain: the source string, the risk tier assigned at intake, the engine and engine version that drafted it, the termbase and translation-memory entries the engine was grounded on, the raw machine output, the post-edited target, the edit the linguist made and why, the error category and severity, the gate decision, and the name and date of the human who signed the delivery. She did not reconstruct the answer. She retrieved it. The audit response took an afternoon, not five days, and it closed without a finding. This lesson is about that one file, the artifact that turned a year-old delivery into something she could prove rather than remember: the quality record, captured as full segment-level provenance.

What Provenance Means Here, and Why a Score Is Not Enough

Earlier in this program you built a quality record in the narrow sense: a severity-scored error report, one row per finding, that a client and an auditor could read to reconstruct a pass/fail verdict. That artifact is real and it is essential, and this lesson does not replace it. This lesson widens it. The error report answers one question, "what was wrong and how serious was it." A full provenance record answers a larger one: where did every shipped string come from, what happened to it on the way to delivery, and who is accountable for it. The error report is a slice of the provenance. The provenance is the whole chain.

Some vocabulary, defined precisely, because the entire value of a provenance record is that it is precise enough to survive a stranger reading it without you in the room. Machine translation (MT) is any system that renders text from a source language into a target language with no human writing the words. A large language model (LLM) is a general-purpose text predictor that produces translation as a byproduct of broad training, and which is more fluent and more confidently wrong than classic neural MT (NMT, the dedicated translation model that preceded it). Machine-translation post-editing (MTPE), often shortened to PE, is the workflow where a human edits machine output instead of translating from scratch. A segment is the unit a translation tool works in, usually a sentence or short block, the numbered row a linguist sees inside a CAT tool (a computer-assisted translation tool, the editing surface) running on top of a TMS (a translation-management system, the platform that moves files, jobs, and assets through the pipeline). A translation memory (TM) is the database of previously approved source-target pairs the pipeline leverages; a termbase is the database of approved terminology. MQM is Multidimensional Quality Metrics, the analytic error typology that classifies translation defects by dimension (accuracy, terminology, locale, fluency) and severity. QE is quality estimation, an automatic confidence score on a raw segment that routes human effort but never clears a segment by itself.

Now the two terms this lesson turns on. Provenance is the documented chain of where a translation came from and what happened to it: who or what produced each segment, what assets it was grounded on, who changed it, why, against what rule it was judged, and who signed off. A quality record, in the full sense this lesson teaches, is the persistent artifact that captures that provenance at segment granularity for every shipped string, so that a delivery can be reconstructed by a client or an auditor who was not present when it was made. The standards make this concrete. ISO 18587 is the post-editing standard, in DIS ballot with publication targeted for late 2025 into 2026, whose revision expands scope from machine translation to AI and LLM "non-human translation output" and insists the post-editor hold full professional-translator competence. ISO 5060:2024 is the international standard, published in 2024, that formalizes the MQM-aligned analytic evaluation model, the Critical, Major, and Minor severities that decide whether a file ships or fails. ISO 17100 is the human-translation services baseline the others build on. Conformance to all three is a claim. The quality record is the evidence behind the claim.

A score tells you the file passed. Provenance tells you how the file came to exist, asset by asset, edit by edit, and who stood behind it. An auditor does not want your verdict. They want the chain that produced it.

The Question an Auditor Actually Asks

It helps to internalize what conformance evidence is actually for, because it is easy to imagine an audit as a hostile interrogation when it is closer to a reconstruction request. The notified body auditing Marisol's IFU did not believe the translation was wrong. They had no opinion on the German at all. Their job was to verify that a controlled process had produced it and that a competent human was accountable for the result, because under the regulation the manufacturer is liable for the leaflet, and the manufacturer outsourced the language work to Marisol's provider. The audit question, stripped to its core, is always a variant of: "Show me that this specific output was produced under your stated process, and show me who owns it." A pipeline can be excellent and still fail that question if it kept no record, because excellence that leaves no trace is, to an auditor, indistinguishable from luck. The quality record exists to make the process legible after the fact. It is provenance precisely so that the answer to "show me" is "here," not "let me reconstruct that for you."

What Full Provenance Captures, Field by Field

A provenance record is, at its core, a table with one row per shipped segment, and the columns are the chain. The earlier error report carried roughly nine fields and listed only the defective segments. A full provenance record is wider and it covers every segment, not just the broken ones, because the auditor's segment of interest is usually one nobody flagged as an error. Here is the anatomy of a complete provenance row, grouped into the four things it must establish: origin, grounding, human action, and accountability.

Origin: Where the String Came From

The origin fields establish what produced the first draft of this segment and under what classification it entered the pipeline. They are:

• Segment id. The stable, tool-native identifier the CAT tool or TMS assigns. This is the anchor that lets a second person navigate straight to the exact row in the exact bilingual file. Without it the record is hearsay; with it, every claim is independently verifiable. Use the tool's own id, never an ad hoc numbering, so the record aligns one-to-one with the file the client can open.
• Source segment. The exact source string, verbatim, because every downstream judgment is a relationship to the source and is meaningless without it.
• Risk tier. The classification the content received at intake: low-risk marketing string, medium-risk UI, or high-liability regulated content. This is the field that proves the right level of scrutiny was applied, and it is the first thing an auditor checks, because a safety warning routed as a low-risk string is a process failure visible from the risk tier alone, before anyone reads the German.
• Engine and version. What produced the raw draft, named precisely: the specific NMT engine or LLM, its version or build, and the date it ran. "An engine translated it" is not provenance. "Engine X, build 2026-02, run on 14 March" is. Engine version matters because engines change behavior between versions, and a known regression in a known build is something an auditor can map to known affected output only if the version is on the record.
• Raw MT output. The unedited string the engine produced, captured before any human touched it. This is the field most pipelines drop, and dropping it is the single most expensive omission, because the raw output is what proves the human added value. Without it, you cannot show what the machine got wrong and you corrected; you can only assert it.

Grounding: What the Engine Was Told

An MT-first pipeline worth its name does not let the engine answer from the open web. It grounds the engine on the client's own approved language through retrieval over the TM, the termbase, and the style guide. The provenance record captures that grounding, because "the engine was grounded" is a claim and the retrieved context is the evidence:

• TM matches applied. Which translation-memory entries, at what fuzzy-match percentage, fed this segment. A 100% match that was reused without change is a different provenance story than a no-match segment the engine drafted from nothing, and the difference matters to anyone reconstructing how confident the output should have been.
• Termbase entries enforced. Which approved terms applied to this segment, and whether the delivered target honored them. This is the field that converts "we enforce terminology" from a slogan into a per-segment, checkable fact. When a client disputes a term choice, the record shows the approved entry and the delivered string side by side, and the dispute is over.
• QE score, where used. The automatic quality-estimation confidence on the raw segment, if the pipeline used QE to route effort. This is not a quality verdict, and the record must never present it as one; it is a routing signal, the field that explains why this segment got light review and that one got full scrutiny. Recording it makes the routing decision auditable instead of arbitrary.

Human Action: What the Linguist Did

This is the heart of the record, the part that proves a competent human owned the quality rather than rubber-stamping a machine. The earlier error report lived entirely here. The fields are:

• Post-edited target. The final delivered string, the one that actually shipped. Paired with the raw MT output above, this single comparison is the quiet proof of human value: the reader can see exactly what changed between machine and delivery.
• Edit distance or change flag. A measure or marker of how much the human changed the raw output, from "accepted unchanged" through "minor edit" to "substantially rewritten." This field tells an honest story about effort and lets an auditor or a reviewer find the segments where the human did the most work, which are usually the most interesting segments in the file.
• Error category and severity. Where the human marked a defect, the MQM dimension (accuracy, terminology, locale, fluency) and the Critical/Major/Minor severity, exactly as in the error report. On a clean segment these fields are empty, which is itself information: it says a human looked and found nothing wrong. Severity is the field that drives the gate, so it must carry, beside it, the one-line consequence rationale that makes a Critical undisputable: "marked Critical because a reader acting on the inverted instruction would be exposed to a hazard."
• Term decision. Where the linguist made a deliberate terminology choice, especially a non-obvious one, the decision and its basis: "rendered Anschluss as the approved port per termbase entry 0114, not the literal connection." Term decisions are the provenance an auditor in a regulated domain most often probes, because terminology consistency is frequently a regulatory requirement, not a stylistic preference.
• Query, where raised. Where the source itself was ambiguous, contradictory, or wrong, the flag the linguist raised to the client rather than silently guessing. A query does not score against the translation, because the defect is upstream of the linguist, but it belongs in the record because it is the row that protects everyone when a later dispute lands on that segment. The record that separates "I made an error" from "the source was unclear and I told you" is the record that survives the year-later audit.

Accountability: Who Stands Behind It

The last group is the spine of the entire standards regime, because "the engine wrote it" is never an answer when a Critical ships, and the revised ISO 18587 insists a named, full-competence human owns the quality. The fields are:

• Evaluator and post-editor. The named humans accountable for the segment: who post-edited it and, where evaluation is separate, who scored it. A record with no name on it satisfies no standard and defends no one.
• Gate decision. Whether the segment, and the file it belongs to, cleared the severity-scored delivery gate, with the Critical count shown as its own field. The gate decision is what links the segment-level evidence to the file-level go/no-go, and it must show the gate as a hard visible rule: if Critical count is greater than zero, the file's status is FAIL regardless of the computed score.
• Sign-off and timestamp. The named human who signed the delivery as fit to ship, and when. This is the field that closes the chain, the equivalent of a signature on a controlled document, and it is the first thing an auditor looks for when they ask "who owns this."

Origin, grounding, human action, accountability. Four groups, one row per shipped segment. Each group answers a question an auditor will ask, and the record exists so the answer is "here," retrieved in seconds, not "let me reconstruct that," argued over five days.

How the Record Is Produced as a Byproduct, Not Extra Work

The honest objection to everything above is the same one that kills most quality discipline: this looks like an enormous amount of clerical work, and a pipeline that buries linguists in form-filling will erase the MTPE economics that made it worth running. The objection is right about the destination and wrong about the route. A provenance record built by asking humans to fill in twenty fields per segment by hand would indeed be unaffordable and would never survive a deadline. The insight that makes it affordable is this: almost every field in the record already exists somewhere in the pipeline at the moment the segment moves through it. The record is not new data you generate. It is existing data you capture instead of discarding.

Walk the fields against the pipeline and the point lands hard. The segment id and source come from the file the moment it is segmented. The risk tier was assigned at intake, the very first control in the pipeline, and it is already a field on the job. The engine and version are known to the MT integration that called the engine; the system knows exactly what it ran. The raw MT output passes through the system before the linguist ever sees it, and the only thing required to keep it is to not throw it away when the post-edited target overwrites it. The TM matches and termbase enforcement are computed by the CAT tool to populate the segment in the first place; that grounding context is already in memory. The QE score, where used, was the number that routed the segment. The post-edited target is the linguist's delivered work. The evaluator, post-editor, and sign-off identities are known to the TMS because it assigned the jobs and tracked the logins.

The fields that genuinely require human input are a short list: the error category and severity on the segments that had defects, the consequence rationale on a Critical, a term decision where it was non-obvious, and a query where the source was ambiguous. Those are exactly the fields a disciplined evaluator is already producing when they do the work, the marks they make in the moment of catching and fixing a problem. Everything else is plumbing. The record becomes a byproduct when the pipeline is built to persist what flows through it rather than to ask humans to re-enter it.

The Capture Discipline: Persist, Do Not Reconstruct

That reframing turns the whole problem from a clerical one into an engineering one, and engineering problems are solvable once. Three habits make the record nearly free on the files that need it.

First, capture at the moment of flow, never by reconstruction. The worst way to build a provenance record is to ship the file and then assemble the chain afterward from TMS exports and memory, which is both slow and lossy, the exact five-day panic the old Marisol lived in. The pipeline must snapshot each field as the segment passes the stage that owns it: stamp the engine and version when the MT integration runs, persist the raw output before the post-edit overwrites it, write the linguist's marks as they fix, record the sign-off identity when the human clicks accept. By delivery, the record is already complete because it was assembled in motion, not after the fact.

Second, let the machine draft the clerical fields for human verification. Modern CAT and TMS platforms can log category and severity against a segment as the linguist edits, and an LLM-assisted step can draft the raw-versus-fixed comparison and a first-pass error category for a human to confirm or correct. The human's irreducible job is judgment, deciding the severity, articulating the hazard, making the term call; the machine's job is the typing. Collapsing the clerical cost is what keeps the record from eating the throughput gains, the lift from roughly 2,000 words a day to 5,000-plus that made the pipeline worth building.

Third, standardize one schema and never reinvent it. A record whose columns change job to job is a record nobody can aggregate, audit, or trust, and one a linguist will skip under deadline. One fixed schema, the same field names, the same category typology, the same severity definitions, the same gate rule, reused on every file, makes the record a reflex and makes the output comparable across files, languages, and years. The auditor who can read one of your records can read all of them, which is itself a conformance argument.

The record is not a second job after the work. It is the pipeline keeping a copy of what it already did. Persist what flows through, let the machine draft the clerical fields, standardize one schema, and provenance becomes a byproduct instead of overhead.

How the Record Reconstructs a Delivery for a Client or Auditor

A provenance record proves its worth in exactly two situations, and both are adversarial in tone even when the people are not: a client dispute and a formal audit. In both, someone who was not present when the file was made needs to reconstruct what happened to a specific output, and the record is the only thing that lets them. Understanding the reconstruction is understanding why every field above earns its place.

The Client Dispute: One Segment, Resolved in Minutes

A client's in-country reviewer flags a delivered German segment as "wrong" and demands a re-do at the provider's cost. Without a record, this is opinion against opinion, and opinion against a paying client loses. With the provenance record, the reconstruction is mechanical. You pull the segment id the reviewer cited and read the row. The row tells you the complete story: the source string, the risk tier it was handled at, the raw MT output the engine produced, the term that the termbase enforced, the post-edited target that shipped, the linguist's note, and the sign-off. In the great majority of these disputes, one of three things is true and the record shows which: the reviewer is asserting a preferential rewrite the record proves was a valid approved-term choice (term decision field, citing the termbase entry); the reviewer has found a genuine defect the record proves was already caught and corrected, or already scored and gated; or the reviewer has landed on a segment the record shows was a logged query, where the source was ambiguous and the client was told. Each of those is a minutes-long answer backed by a citable field, not an argument. The dispute ends because the record converts the reviewer's opinion into a question with a documented answer.

The Audit Reconstruction: The Whole Chain, On Demand

The audit is the harder test, and the one Marisol faced. The auditor is not disputing quality; they are verifying that a controlled process produced a specific output and that a competent human owns it. The reconstruction they need is the full chain for the segment in scope, and the record produces it as a single retrieval:

• Was the right scrutiny applied? The risk-tier field shows the safety warning was classified high-liability at intake and routed to full post-editing with full evaluation, not light-touch review. The process was correct before anyone reads a word of German.
• What produced the draft? The engine-and-version field names the exact engine and build, so the auditor can map the output to a known engine behavior, and the raw-MT field shows what it produced.
• Was it grounded on approved language? The termbase field shows the approved device term was enforced and the delivered target honored it, satisfying the terminology-consistency requirement the regulation imposes.
• Did a competent human own it? The post-editor and evaluator names, the edit captured between raw and delivered, the severity marks, and the sign-off identity and timestamp show a named, qualified human reviewed, scored, and signed the segment, exactly what ISO 18587 requires.
• Did it pass a real gate? The gate-decision field shows the Critical count was zero on delivery and the file cleared the one-Critical-fails gate against a pre-declared threshold, so "it passed" means something specific and pre-agreed, not a feeling formed after the fact.

Notice that the reconstruction does not depend on anyone remembering anything. The freelancer who post-edited the file eleven months earlier could have left the industry; it does not matter, because their judgment was externalized into the record at the moment they made it. This is the deepest reason provenance beats memory: memory is perishable, personal, and unavailable on demand, while a provenance record is durable, transferable, and retrievable by anyone with access to the file. The record is the institution remembering what the individual cannot be relied on to.

A Worked Provenance Record for One Segment

Theory settles only when you watch a real record take shape, so let us build the complete provenance for the single segment that the auditor in the opening story asked about. The file is a German instructions-for-use leaflet for a portable oxygen concentrator, localized under an MT-first pipeline with grounded retrieval, full post-editing, severity-scored evaluation, and a one-Critical-fails gate. For readability the strings are rendered in English; in the real record they are the actual German. The segment is a safety warning, and it is the most dangerous kind of segment there is, because the machine produced a fluent inversion of it.

The Header Block

Every record opens with a header that fixes what was localized, against what rule, under what standards, because provenance starts before the first segment:

• File: oxygen-concentrator-ifu_DE.xliff, 1,840 words, 142 segments, full file evaluated.
• Languages: source English (en-US), target German (de-DE).
• Pipeline: risk-tiered intake, grounded MT (retrieval over client TM, termbase, and style guide), full post-edit, analytic evaluation, one-Critical-fails gate, human sign-off.
• Scoring profile: MQM-aligned, weights Minor 1 / Major 5 / Critical gate, ISO 5060-conformant typology, pass threshold pre-declared, Critical gate active.
• Standards asserted: ISO 17100 (human-translation baseline), ISO 18587 (post-editing, full-competence post-editor), ISO 5060:2024 (analytic evaluation).
• Sign-off: named, qualified linguist, with date.

The header already does defensive work. It names the standards and the profile, so the rules are not invented after the dispute. It states the threshold, so "pass" is specific and pre-agreed. It declares the pipeline, so the auditor knows what controlled process is being evidenced. A client cannot later claim the bar was higher, or the process looser, than what is written on the face of the record they accepted at delivery.

The Segment Row, Field by Field

Now the segment the auditor asked about. Here is its complete provenance row, group by group.

Origin. Segment id: 0041. Source: "Do not cover the air intake while the device is operating." Risk tier: high-liability (regulated medical device, safety warning), routed to full post-edit and full evaluation. Engine and version: vendor NMT, build 2026-02, run 14 March. Raw MT output: "Keep the air intake covered while the device is operating." Read that raw output against the source and the hair stands up: the engine dropped the negation and inverted a safety prohibition into a safety recommendation, in perfectly fluent German that a skimming eye would never catch. This is the silent critical error in its natural habitat, and the raw-MT field is the only reason the record can prove the machine produced it.

Grounding. TM matches applied: none (no fuzzy match above threshold; the segment was drafted from nothing, which the record flags as a higher-attention origin). Termbase entries enforced: "air intake" mapped to the approved German device term per termbase entry 0072; the delivered target honored it. QE score: the automatic quality estimation on the raw segment returned a middling confidence, which under the pipeline's routing rule sent a high-liability no-match segment to full human scrutiny regardless, the routing the risk tier would have forced anyway. The grounding fields show the segment was both correctly grounded on the approved term and correctly routed to a human who would read it carefully.

Human action. Post-edited target: "Do not cover the air intake while the device is operating." Edit distance: substantially rewritten (the negation restored, the meaning inverted back to the source). Error category: accuracy, subtype omission of negation producing a mistranslation. Severity: Critical. Consequence rationale: "marked Critical because the device's pressure relief depends on an unobstructed intake; a reader covering the intake on the engine's inverted instruction would be exposed to a hazard." Term decision: approved device term applied per entry 0072. Query: none on this segment. The human-action group is the proof that a competent linguist read the fluent inversion, recognized the dropped negation, restored it, and graded the machine's error at the severity its consequence demanded.

Accountability. Post-editor and evaluator: named linguist, qualified per ISO 18587. Gate decision: the raw MT carried one Critical, which triggers the one-Critical-fails gate; the delivered target, after the post-edit, carried zero Criticals, zero Majors, zero Minors on re-evaluation, status PASS. Sign-off: named linguist, dated, fit to ship. The accountability group closes the chain: a named human caught the hazard, fixed it, scored it, cleared the gate on the corrected target, and signed the delivery.

The Two-State Story the Record Tells

The single most valuable thing this row captures is that it tells a two-state story, and the two states are the whole argument for the pipeline. As the raw machine produced it, segment 0041 failed catastrophically: a Critical safety inversion, gate triggered, the file disqualified. As the named post-editor delivered it, the Critical was caught and corrected, the gate cleared on the corrected target, and the segment shipped clean. The record does not merely claim the delivered file was good. It proves that a human caught and corrected a hazard the machine produced, which is precisely the value ISO 18587 says the post-editor adds and precisely what the auditor needed to verify. A record that kept only the delivered target would show a clean segment and prove nothing about who made it clean. The raw-MT field, the edit distance, and the severity mark together convert a clean delivery into documented evidence of human accountability. That is the difference between a translation that happens to be correct and a translation you can prove was made correct on purpose by a person who owns it.

The raw machine inverted a safety warning. A named human caught it, fixed it, scored it, and signed it. The provenance row that shows both states is the artifact that proves the human, not the engine, owns the quality, the exact thing an auditor came to verify a year later.

The Record as Capstone Deliverable and Business Asset

This lesson closes Level 3, and it closes it on the artifact that the level's capstone is built to produce. The L3 capstone is a deployed or pilot MT-first pipeline with four parts: grounded retrieval over your linguistic assets, human sign-off, a severity-scored delivery gate, and a quality record. The first three parts are the machine that produces quality. The quality record is the part that proves it. Without the record, a capstone pipeline is a quality claim; with it, the pipeline is a quality asset, something an auditor can verify, a client can buy, and a business can be built on. Everything you have learned across this level, mapping the process, tiering risk at intake, grounding the engine, matching post-editing effort to consequence, scoring severity, holding the one-Critical-fails gate, converges into the record, because the record is where all of those controls leave their evidence.

Protection for the Linguist, Product for the Provider

For the working linguist, full provenance is body armor that does not expire. The MT era loaded an asymmetric risk onto the post-editor: you inherit a file the machine drafted, you put your name on the delivery, and if a silent Critical slips through, the accountability is yours and "the engine wrote it" is no defense. The provenance record is the only thing that converts your invisible diligence into durable, dated, named evidence that holds for years, long after you have forgotten the job and possibly left the client. The auditor's request that would have been a five-day panic becomes an afternoon retrieval. And the discipline of producing the record disciplines the work itself: you cannot write "Critical" in a cell without articulating the hazard, and the act of articulating it catches the cases where you were about to over-grade a harmless slip or under-grade a real one.

For the language-service provider (LSP, the vendor that delivers the localization), the provenance record is the product differentiator that survives the race to the bottom. The market is full of vendors selling raw machine output at MTPE prices and hoping nothing critical slips. Anyone can sell cheap words. What a vendor cannot easily copy, and what a sophisticated regulated client will pay a defensible premium for, is provable, retrievable, audit-ready quality: "here is the risk tier each content type received, here is the grounding on your approved assets, here is the ISO 5060 error score with zero Criticals on delivery, here is the named human accountable for every segment, and here is the full segment-level provenance record, defensible under the revised ISO 18587, retrievable on demand a year from now." That sentence is a sales weapon a raw-MT vendor cannot say, because they have no record to point to. The provenance record is what lets a provider sell a quality tier instead of a price, and in a market where words themselves are nearly free, selling a tier is the only way to keep a margin. It is also, quietly, what lets a provider take on regulated work at all, because no serious medical, legal, or financial client will route liability-bearing content to a vendor who cannot reconstruct a delivery on request.

Key Takeaways

• Provenance is the documented chain of where each translation came from and what happened to it, and a full quality record captures that chain at segment granularity for every shipped string, so a client or auditor can reconstruct a delivery without anyone present who made it. The earlier severity-scored error report is one slice of this; full provenance is the whole chain.
• A complete provenance row establishes four things: origin (segment id, source, risk tier, engine and version, raw MT output), grounding (TM matches, termbase entries enforced, QE score where used), human action (post-edited target, edit distance, error category and severity with a consequence rationale, term decisions, queries), and accountability (named post-editor and evaluator, gate decision with Critical count, sign-off and timestamp). Unlike the error report, it covers every segment, not just the defective ones.
• The auditor's question is always a variant of "show me this output was produced under your stated process, and show me who owns it." Excellence that leaves no trace is, to an auditor, indistinguishable from luck; the record exists to make a controlled process legible after the fact.
• The record is affordable because almost every field already exists in the pipeline at the moment a segment moves through it. It is not new data you generate but existing data you persist instead of discard: the risk tier from intake, the engine and version from the MT integration, the raw output before the post-edit overwrites it, the grounding from the CAT tool, the identities from the TMS. The genuinely human fields are a short list: severity, consequence rationale, term decision, query.
• Three capture habits make it a byproduct rather than overhead: snapshot each field at the stage that owns it rather than reconstructing after delivery; let the machine draft the clerical fields (raw-versus-fixed, first-pass category) for human verification so judgment stays human and typing does not; and standardize one schema you never reinvent so the output is comparable and aggregable across files and years.
• The record reconstructs a delivery in two adversarial situations. In a client dispute, one segment row resolves the question in minutes by showing the term decision, the caught-and-fixed defect, or the logged query. In an audit, the full chain retrieves on demand to prove the right scrutiny was applied, the draft's origin, the grounding on approved terms, a competent named human's ownership, and a real gate decision, none of it dependent on anyone remembering anything.
• In the worked oxygen-concentrator record, segment 0041's raw MT inverted a safety warning by dropping a negation, in fluent German; the named post-editor caught it, restored the negation, graded it Critical with a hazard rationale, cleared the gate on the corrected target, and signed off. The two-state story, raw-failed-then-human-fixed, is what proves the human owned the quality, exactly what an auditor came to verify eleven months later.
• The quality record is the part of the L3 capstone pipeline (grounded retrieval, human sign-off, severity-scored gate, quality record) that turns a quality claim into a quality asset. For the linguist it is durable, named protection that ends a dispute or audit in an afternoon instead of a five-day panic. For the LSP it is the audit-ready product that sells a defensible quality tier a raw-MT vendor cannot, and the precondition for taking regulated work at all.