A figure produced by an extraction system and a figure typed by a person look identical once they are in a database. Same type, same precision, same absence of any indication of how much you should trust it. The difference only becomes legible when something downstream disagrees, and by then the question is not what the number is but where it came from.
So we treat provenance as a property of the value rather than as a log. No figure exists in the system without a link back to the message it arrived in, the attachment it was read from, and the span inside that attachment. Not a timestamp and a job id — the actual evidence, one click away, from every screen the number appears on.
This changes what the system is allowed to do. An output with receipts can be pushed into a system of record, because a dispute has a resolution procedure that does not involve anyone's memory. An output without receipts cannot, no matter how accurate it is on average, because the recovery path when it is wrong is guesswork.
It also changes the review posture. A reviewer who can see the source in one click checks differently than one who has to go looking for it — faster, and more often. The cost of verification determines how much verification happens, and that cost is an architectural decision made long before anyone is asked to review anything.
The rule we hold ourselves to is short. If a number on a screen cannot be opened to the thing it came from, it is not finished.