The two records
A platoon sergeant comes back from a patrol and sits down to write the debrief. He types the version that goes in the system of record. Route completed. No significant activity. Equipment status green. Then he pulls out a battered notebook and writes the real version. The checkpoint that was manned differently than the intel brief said. The radio that dropped for eleven minutes on the ridge. His own bad call at the second intersection. The notebook goes in his cargo pocket. The system gets the sanitized log.
This is not laziness and it is not deception. It is a rational response to how mission systems work. Everything entered into a permanent system is a future discovery item. It is a future leak. It is a future exhibit against its own author. The sergeant knows this the way he knows which armorer to trust. So the candid assessment lives in notebooks and group chats and hallway conversations. The permanent record holds the residue.
Every mission system ever fielded treats accumulation as a virtue. More data retained means more value captured. That is the theory. The practice is that operators route the real information around the system. The archive grows and the truth stays out of it.
Permanence corrupts the record
People write differently when they know the audience. And a permanent record has an unknowable audience. The reader might be a promotion board in five years. It might be an investigator after an incident. It might be an adversary who breached the archive a decade from now. Faced with an infinite audience of unknown readers with unknown motives, the rational author writes nothing that can be used against anyone. Which means the rational author writes nothing useful.
Militaries have understood a piece of this for a long time. Aviation safety programs learned decades ago that crews only report their own errors into channels with protections around how the report can be used. The lesson generalizes. Honesty flows toward containers with limits and away from containers without them. Recent writing on Ukraine's wartime innovation cycle points at something adjacent. The units that adapt fastest run on fast and unvarnished feedback between the field and the builders. Unvarnished is the load-bearing word. Feedback laundered for a permanent file is not feedback. It is public relations.
So the archive fails at its one job. It was supposed to preserve what the team learned. What it actually preserves is what the team was willing to say under permanent observation. Those are different documents.
Cryptography already solved the hard part
Here is what makes this fixable rather than merely lamentable. The mathematics of provable destruction has existed for years. Encrypt everything produced during a mission under keys that descend from a single mission key. Hold that key in a hardware enclave that will destroy it on command and never let it leave. When the mission ends and the key dies, every byte encrypted under it becomes unrecoverable. Not deleted in the sense of overwritten files that a forensics lab might recover. Unrecoverable in the sense that the ciphertext is now noise. NIST's guidance on media sanitization has recognized cryptographic erasure as a legitimate destruction method for over a decade.
And destruction does not have to mean amnesia about the destruction itself. A chain of hashes and signed attestations can survive the burn. The proof chain says a mission occurred. It says data was produced and handled and destroyed at a specific moment by an authorized decision. It proves the record existed and proves it is gone. What it cannot do is resurrect the contents. Accountability survives. The discovery item does not.
None of this is speculative. The primitives ship in commodity hardware today. What does not exist as of late 2025 is mission software built around that lifecycle. No fielded system treats a mission as the natural container for data. No fielded system makes end-of-mission destruction the default and survival the deliberate exception. The plumbing exists. The building does not.
Mortal data is honest data
Now the counterintuitive part. Provable deletion should improve the quality of the record. That sounds backwards. Destroying data sounds like losing information. But the sergeant with the notebook already showed us the flaw in that reasoning. The permanent system never had the information to lose. The honest version was withheld at the moment of writing. A container that provably ends changes the calculus at that moment. If the raw feed and the candid assessment and the admitted mistake all burn when the mission closes, there is no infinite future audience to write for. There is only the team and the mission. People are honest into containers that end.
The team then makes a deliberate choice at the close. Sit down and decide what earned survival. The tactics lesson gets extracted and carried forward. The pattern worth keeping gets promoted out of the mission before the key dies. Everything else goes. This inverts the current model where everything survives by default and nothing was true to begin with. A small record that is honest beats a vast record that is theater.
The open question is institutional rather than technical. Organizations that measure themselves by the size of their archives will read mortality as vandalism. Someone has to be first to accept a smaller archive in exchange for a true one. The sergeant already voted. His real record fits in a cargo pocket and his institution has never seen it.