Exercise 1: Why Session Logging Isn't Surveillance — Possible Solution
====================================================================

WHAT THIS CHAPTER SAYS
------------------------------
Per this chapter, "access itself is worth logging, for exactly the
same 'evidence over guesswork' reason this whole subject has been
built on since log1's own first chapter - not surveillance of the
support engineer, the same principle applied one layer earlier, to how
a session even started."

THE PRINCIPLE IT'S ACTUALLY THE SAME AS
------------------------------
log1's own foundational argument is that checking real evidence
(logs) before theorizing produces faster, more reliable diagnosis than
guessing - logs exist to answer "what actually happened," not to
watch anyone. This chapter applies that identical reasoning one layer
earlier in the stack: instead of logging what an application did,
it's logging when and how someone connected to a system at all - the
same "have real evidence available if something needs explaining"
purpose, just applied to access itself rather than application
behavior.

WHY THIS FRAMING MATTERS
------------------------------
Framing session logs as surveillance implies their purpose is
monitoring a person's behavior with suspicion. Framing them as
evidence, per this chapter's own reasoning, means their purpose is
the same as any other log this subject has covered: giving anyone
investigating a later question (an incident, a mystery change, a
security review) real, reliable evidence to check rather than needing
to rely on memory or assumption.

WHY THIS WORKS AS AN ANSWER
------------------------------
It states the chapter's own explicit claim and traces it back
specifically to log1's foundational "evidence over guesswork"
argument, explaining that session logging is the same underlying
principle applied to access rather than application behavior.