Two clocks, one truth

The board deck says Q1 revenue was one number. The system, this morning, says it was a slightly different number.

Both are met with the same question — which one is right? — and the question has a better answer than anyone in the room expects.

Both.

They are answers to two different questions wearing the same words. What did Q1 revenue turn out to be? is a question about what happened. What did we believe Q1 revenue was when the deck was printed? is a question about what was known, and when. A customer credit landed in April for a March invoice. The event belongs to March. The learning belongs to April. Neither fact is wrong. They are two clocks, reading two real times.

Most record-keeping has room for one clock. When the credit lands, the system updates the number — and the update destroys the previous answer. What you believed in March is gone, overwritten in place, recoverable only by archaeology: version exports, email attachments, the deck itself as the accidental archive of what the company used to know.

That archaeology has a familiar name in finance. It is most of what an audit is.

---

TallyUp’s record keeps both clocks, as a property of how every fact is written.

Nothing in the record is overwritten. When the credit arrives, the old figure is not edited — a new fact is written that supersedes it, stamped with when it was learned, pointing back at what it replaced and at the evidence that caused the change. The superseded fact stays exactly where it was, still true as an answer to the question it answered: this is what the record knew, until the eleventh of April.

So the awkward board-meeting question becomes a query. What did we believe on March 1? — answered. What do we believe now? — answered. What changed between, and why, and on what evidence? — answered, with the chain attached: the figure, the credit that revised it, the bank line and the contract term behind the credit. The two clocks are kept the way the web’s provenance standard defines them, not as a homegrown audit-log bolted on after the fact.

A correction is not an edit. It is a new fact about an old fact — and a record that keeps both can prove itself on any date you name.

What that buys, concretely:

The restatement stops being a forensic project. The before, the after, the cause, and the timing are one traversal, not a weekend.

The audit inverts. Instead of assembling a binder that reconstructs support for the numbers, the support is the record’s native shape — every figure carries the trail to the bank line, invoice, or term that produced it. The auditor samples; the record answers.

The forecast gets honest about its own history. What did the model assume in January, and which assumptions broke? is a question the record can answer, because January’s beliefs were never destroyed by February’s news.

And the operator gets the thing the two clocks are really for: trust at decision speed. You can act on this morning’s number because you can see exactly what this morning’s number knows — and what it learned overnight.

---

The honest boundary: the rails proven in production today are bank and ledger, founder-run, every day. The two clocks are not a roadmap item on those rails — they are how the record is built, all the way down. Everything written to it gets both timestamps; nothing written to it can be silently rewritten.

For four centuries the discipline of the books has been defensibility after the fact — close the period, bind the support, be ready to show your work. The two clocks keep all of that and add the part the ledger could never hold: what the business believed along the way. One truth, fully timestamped, queryable from either side.

The deck and the system can disagree, and both can be right — provably, on click.