Three failure modes that make investigation workflows non-defensible under regulatory or legal scrutiny.
Making a point-in-time query reproducible usually means copying the full index at that moment. The storage cost scales with the graph, and "restore the snapshot" is a multi-step procedure — not an API call. For long-running investigations, the snapshots accumulate faster than they are reviewed.
An investigation started on Monday finishes against a different graph on Friday, with no record of what changed in between. Two analysts working the same case against the current graph may reach different conclusions. There is no mechanism to prove which graph version produced which answer.
When a sanctions clearance is challenged, you need to reproduce the exact evidence basis the analyst saw at decision time. Without session pinning, re-running the query gives you today's graph — not the one that drove the decision. The evidence basis is gone.
A session pins to a graph version at open time. Every query inside the session — regardless of when it runs — resolves against that pinned version. No configuration, no snapshot trigger, no separate archive step. The version is addressed by the session; the session is addressed by the API caller.
The pinned version is reconstructed from a base snapshot plus incremental deltas, with periodic full checkpoints bounding reconstruction cost — not a copy of the graph. Holding a session open prevents compaction of the deltas needed to reconstruct the pinned version; overhead grows with the delta history between the pin and the present, not with a full graph copy per session.
When session_refresh is called, it atomically advances the pin and returns a migration report — a structured record of which clusters in the working set split, merged, or changed attributes since the pinned version. The decision is whether and when to call session_refresh, not whether to adopt a separately previewed diff.
When an alert fires, its webhook payload carries the graph_version at which the triggering event occurred. The recipient opens a session pinned to that version and investigates in the exact graph state that produced the alert — not the live graph as it now stands. Sessions are downstream of alerts, not configured in advance of them.
The pinned version is reconstructed from a base snapshot plus incremental deltas, with periodic full checkpoints bounding reconstruction cost — it is not a copy of the graph. The same query, run against the same session, returns the same result however many ingest batches have arrived since the pin. Holding a session open prevents compaction of the deltas needed to reconstruct the pinned version; overhead grows with the delta history between the pin and the present, not with a full graph copy per session.
Calling session_refresh atomically advances the pin and returns the migration report — a structured record of which clusters in the working set split, merged, or changed attributes since the pinned version. The decision is whether and when to refresh, not whether to adopt a separately previewed diff.
"'Reproducibility' usually means 're-run the query and hope.' Here it means a guarantee — and a deterministic address is what makes it one."
Foundational provenance layer for all graph state. Every evidence record is written once and never overwritten, providing the permanent audit trail that makes investigation results reproducible. Version-pinning machinery builds on top of this immutable record.
Read the pageThe cluster layer whose state the session preserves. When clusters split or merge in the live graph, the session surfaces a migration report without adopting the change.
Read the pageThe primary use case for point-in-time pinning: onboarding decisions that must survive replay months later, pinned to the graph version current at adjudication time.
Read the pageThirty minutes with engineering. We open a live session, pin it, run ingest against the live graph, then replay the original queries — identical results, identical evidence basis, with a migration report showing what changed.