GRACE lang — history

The dated record of how GRACE lang got here, moved out of the grammar because a reader does not need it to use the grammar today: the Watch list’s history on 2026-10-22, and the Changes section, Section 23, on 2026-10-23 at v0.66; and the v1 baseline, frozen on 2026-10-30 and released on 2026-11-05, with the empty v2 list it held. The grammar keeps its rules and its live Watch list, and its Section 23 points here; everything smaller is in git log -- GRACE-lang.md.

The v1 baseline (released)

GRACE-lang v0.69 and the Execution Contract at grace-commons cab291d were the v1 baseline from 2026-10-30 11:12Z until the maintainer released it on 2026-11-05 at 01:29Z (“cool, we can release the freeze now”); the v2 list was empty at release, since the cap once unit of 2026-11-03 17:15Z had stated all four names it held. From the release a change to an existing obligation in either may land as a unit, and a repeated form may be stated once by a sweep. What the release leaves as it was: the delta rounds for reopened pages (next-round.py --kind), the reach rule (cites.py --reach) that decides what a change reopens, the quiet window that a change to a shared method page waits for (settle.md step 5), the 2026-11-03 17:15Z ruling that a repeat at five is stated once, and the V1 release marker of 2026-10-31 16:22Z, which is separate from the freeze.

Changes

The grammar’s Changes section, newest first. From v0.66 each version’s entry is written here; the entries from v0.65 back moved from Section 23 on 2026-10-23, word for word.

NOTE: v0.69, editorial (2026-10-30): Term MAY rule says what an ONLY IF tail does: a MAY rule carrying one leaves the act unpermitted wherever the tail’s condition does not hold, cited beside Timing 12, which writes a strict lower bound in that form; every other MAY rule is satisfied vacuously and obliges nothing, as before. The 27 rules in nine specifications that carry Timing 12’s form already oblige it, so the sentence states once what the pages oblige: the version stands and no round is owed. Ruled by the maintainer on 2026-10-30 at 21:09Z, on the escalation of 19:28Z (R3), after readers on four model families had read Session’s Capability requirement 11 as binding nothing, four rounds running.

NOTE: v0.69, editorial (2026-10-30): Section 13 points to where the words outside the grammar live, a specification’s own words in its Terms section (spec-format.md) and the few English words whose ambiguity leaks into specifications in glossary.md: a pointer, never a mirror, carrying nothing (Surface 3) and obliging nothing, so the version stands and no round is owed. Asked by the maintainer on 2026-10-30 at 20:02Z.

NOTE: v0.69 (2026-10-30): a rule of the Invariant family claims only what holds in every reachable state and obliges no act (Standard label 13, Standard label 14), so a page writes a move as what may not happen or as where a record stands, the State family’s EXACTLY ONE OF, never as a move a record owes, and tools/grace/check.py’s R-invariant-move gates MUST move inside the family; this document’s record verbs gain oblige. Term blank names whitespace: the code points with the Unicode White_Space property, the set Notification’s Final Critique 6 declared for its recipient reference, the first page to name one, so every page that reads a whitespace-only input reads one set. Ruled by the maintainer on 2026-10-30 at 11:09Z (yes to all), on two escalations of 2026-10-29 15:25Z: the modal with no temporal scope at five specifications, and Notification’s direction (b). Six specifications had cured the modal, five by deleting a status rule to State 1 and Session by deleting its lapse rule to Operation 27, and no rule of the corpus carried it when the check landed.

NOTE: v0.68 (2026-10-26): arithmetic carries no order of operations. In a rule an arithmetic expression is two operands joined by one of +, - and * inside one pair of parentheses (Term arithmetic expression, Sugar 11, Hard invariant 24); in a declaration, declared arithmetic sets every operator inside a pair of its own, a single one included, and pairs may nest (Term declared arithmetic, Closed vocabulary 31, Hard invariant 35); a division appears only in a declaration, which names its rounding — rounded down, rounded up, or rounded to nearest with ties to even (Term rounding, Closed vocabulary 32 and 33, Hard invariant 36 and 37); no operand is a negative literal (Closed vocabulary 34); the parser reads × as * (Sugar 12); Term arithmetic operator loses its precedence sentence, and Closed vocabulary 9 names a term for anything beyond one arithmetic expression. The Execution Contract states once that the arithmetic is exact (Logic confinement 9), which Cart’s Capability requirement 4 had stated for one atom. Ruled by the maintainer on 2026-10-26 at 18:42Z after Grok’s review, closing the loophole of a long formula wrapped in one pair of parentheses; the arithmetic sweep wrote 105 formulas on 98 declarations in 22 specifications in the new form, each grouped as the retired precedence read it and so to the same value, and this document’s two examples with them.

NOTE: v0.67 (2026-10-23): the Execution Contract’s family answers belong to every action’s outcomes without being written on its signature (Closed vocabulary 30). An action’s outcomes are its signature block together with the answers the contract’s families give every action, today Read 1’s state-unavailable; a rule may land one its block does not carry, and Value set 3 counts them as written. Closed vocabulary 21, 22 and 29 cite it. Ruled by the maintainer on 2026-10-23, direction (a) of the 02:32Z escalation: Observation Final Critique 5’s (O6), carried in five settles’ For Scott lists and placed foundational by Event Log Final Critique 8’s blind second triage, found that, read literally, Closed vocabulary 21, 22 and 29 kept Read 1 off every action once the read sweep took state-unavailable off every signature. The read sweep’s signatures stand: state-unavailable goes back on no signature. Execution Contract Conformance 4, which admits a reason named in the spec or in the contract, already agreed and is unchanged. No specification restated the point, so none changed, and no round is owed.

NOTE: v0.66 (2026-10-23): the grammar compressed, 89,170 bytes to 52,003, on the maintainer’s ruling that it take the compressed text: every labelled rule and every term kept word for word, the WHYs cut to what a cold reader needs, and this Changes section moved here, Section 23 pointing to it, with the Watch list as it stood. The Watch list keeps one line per live name, with its shape, its count and its specifications, so the Repeats rule and lint.py’s W-stale-census read it as before; the fresh holder value, which Recoverable Invocation’s Final Critique 18 added after the compressed text was drawn, keeps its line. Three changes the maintainer ruled the same day ride with it. Earned vocabulary 18 carried two obligations against Rule shape 3 and is split: Earned vocabulary 18 compares two instants with PRECEDES, and Earned vocabulary 20 forbids comparing them with EXCEEDS. Closed vocabulary 29 moved after Closed vocabulary 28, its number kept. Inline arithmetic is admitted as the grammar’s one symbolic sugar (Sugar 4 through 10, Term arithmetic operator, Term operand, Term arithmetic expression): a rule may carry +, -, * and /, with their usual meaning and precedence, over declared fields, declared terms and numbers, inside one pair of parentheses that nests no other, reading no clock, carrying no call and writing nothing, and the parser reads each expression as an unnamed term, so the sugar adds no meaning; a quantity the domain names keeps its term. Banning every symbol from the rules was an overreach, the maintainer ruled: the corpus carries 33 arithmetic terms across 16 specifications that exist only to feed one rule, which is recurrence. Hard invariant 24 now rejects arithmetic outside one pair of parentheses, Earned vocabulary 16 and Term rule symbol leave the operators to an arithmetic expression, Closed vocabulary 9 names a term only for arithmetic one pair cannot carry, and the locked forms say the same; check.py’s A-arith and D-rule-symbol read the form. No specification changed; a writer may inline a nameless term later, editorially.

NOTE: v0.65 (2026-10-22): a rule whose subject takes in several actions binds each only where the action’s signature block carries the outcome the rule lands (Closed vocabulary 29). Five Final Critiques had narrowed such a rule’s subject to the actions whose signatures carry the outcome, one specification at a time — Session, Capability, Party Identity, Provenance and Medication Order — and the maintainer ruled the category reach stated once, here, with four repeated cures stated once in the Execution Contract the same day: the wiring read from the deployment’s own declaration (Conformance 9), an atom’s no-removal rules binding the atom’s own actions (Database 6), a rule saying what an action does holding only for a call the action admits (Read 4), and a ban on refusing reaching only the refusal or the ground it names (Refusal 1). The Watch list is now the count of repeated cures not yet stated once, one line per live entry; the five, every other name that had left the list, its council reads and its superseded counts moved to the grammar’s history.

NOTE: v0.64 (2026-10-21): a refuses line lists its refusals in the order they answer. Closed vocabulary 23 now leaves only an answers line’s arms unordered, Closed vocabulary 28 keeps a refuses line’s order, and Term signature form says so; the rule the order serves is the Execution Contract’s (Refusal 1: where more than one refusal applies to one call, the one listed first answers). Ruled by the maintainer after Final Critiques had ordered refusals firing together on one call one specification at a time, each with a declared term and a rule evaluating it, which the parser needed because it infers nothing from rule order; the refusal order and the failed read leave the Watch list, each stated once in the Execution Contract.

NOTE: v0.63 (2026-09-25): notation is law (Principle 12 through 14; Term corpus, Term retired form, Term retirement, Term historical record). A form the rules forbid is forbidden in every file the repository tracks except a dated historical record, and a retirement closes only when no appearance survives outside the records; a code span may still name a retired form, since naming a form is not writing in it. Proposed and ruled by the maintainer after the front-door census found the section sign retired from the rules at v0.56 and still written in 579 places of prose, the agent instructions and the format guide among them. The section sign’s retirement is the first one this reopens: it stays open until the sweep that follows closes it (council read 206).

NOTE: v0.62 (2026-09-24): Scope vocabulary, Verdict and Retention asymmetry promoted to the standard label families — the maintainer’s ruling on the three candidates Standard label 4 had named, and the first time three crossed together. The drift pass Standard label 7 requires found one concept in each. Scope vocabulary, in Shared Todo, Privileged Access Provisioning and Multi-Party Approval: the scopes the composition defines for its Permissions instance and the action each gates — Shared Todo maps eight actions to seven scopes, the other two define three scopes and name the one gate they refuse to add, the same concept stated from its two sides. Verdict, in Chain of Custody, Forensic Recovery and Immutable Transaction Ledger (now Immutable Ledger): how a verification read resolves what it reads into its answer — the first two compose an overall verdict from named classes, the third a binding verdict and per-entry authenticity, each a total function over evidence the read gathered. Retention asymmetry, in those three, Propagate Consent Revocation Downstream and Multi-Party Approval: how the spec answers where a record — an accounting record, a consent record, a chain, a lifecycle entry — outlives the audit events that attest it, read as lawful destruction and never as an orphan or a gap. Standard label 9’s positions follow where the naming specs already file them: every one places Scope vocabulary and Verdict last in Composition logic and Retention asymmetry under Edge cases, so the first two take the end of Composition logic’s placed rows — Scope vocabulary first, by the table’s interim alphabetical order — and Retention asymmetry an Edge cases row between Indeterminate outcome and String policy, by the same order. A placed heading precedes every unplaced one, so five specs that carried an unplaced heading ahead of the newly placed one are reordered, text unchanged. Council read 198.

NOTE: v0.61 (2026-09-21): one operator, one operand type. EXCEEDS compared quantities, lengths and instants, which is the multitasking-token row’s second member — EXISTS split at v0.52, and this is EXCEEDS. Instants now compare with PRECEDES, negated DOES NOT PRECEDE (Term condition operator, Earned vocabulary 18, Earned vocabulary 19); EXCEEDS keeps quantities and lengths and nothing else. The form is one word, not a phrase: the maintainer ruled against composing a pair where a single word serves, so there is no IS AFTER and no IS BEFORE, and the negative reuses the shape DOES NOT EXCEED already set. PRECEDE joins EXCEED as a reserved grammar verb, so an ordering invariant reads A commitment's confirmed at MUST NOT PRECEDE the commitment's placed at. No plural form is admitted: a comparison has one subject and one object, so PRECEDE after a modal is the only inflection a rule carries. The corpus had already earned it — 19 rule sites wrote precedes in lower case before the operator existed, which no instrument read, because W-comparator’s word list never carried it. 20 instant comparisons moved off EXCEEDS, 11 lower-case uses were raised, and D-condition-form now reads the operand beside each comparison in both directions. FOLLOWS was refused on measurement rather than taste: follow and follows sit at 18 rule sites in three senses — temporal, ordering and conformance — and a word meaning three things makes a bad operator. Ruled by the maintainer. Council read 146.

v0.60 (2026-09-18): instance and section are rule nouns (Term rule noun, Term instance, Term section). Both waited on a rename. Instance meant one deployed copy of a pattern everywhere but State Machine, which called its running record an instance until council read 108; it is written 253 times in the rules of 31 of the 41 migrated specifications, and the nineteen declarations that carry the word — store instance in fourteen atoms, event log instance, party retention instance — qualify it rather than redeclare it. Section meant both a titled part of a document and the host-supplied lock until council read 111 named the lock a critical section; it is written 173 times in the rules of fourteen specifications, most of them the citation form the section titled X that council read 121 settled and lint.py’s X-section-title resolves. Neither is declared bare by any specification (council read 128).

NOTE: v0.59 (2026-09-17): clock is a rule noun (Term rule noun, Term clock). It is written 122 times in the rules of 35 of the 41 migrated specifications, declared in none, and headed 102 unresolved noun phrases — most of them the deployment’s clock obligations, the clock’s monotonicity, honesty, timezone handling, synchronization and skew, restated as capability requirements in 25 specifications. Its spread is the spread of the first six rule nouns, which the maintainer’s v0.53 ruling gives to the grammar, and Term instant already named it (council read 119).

NOTE: v0.58 (2026-09-17): act is a rule noun (Term rule noun, Term act). The noun reader’s next most common miss after critical section and instance was act, unresolved at 52 sites in six specifications and used 126 times in the rules of eleven — Recoverable Invocation 54, Audit Trail 27, Attributed Permissions Admin 16, Defensible Retention 13. Each means its own thing done: Recoverable Invocation’s call of the bound act, Audit Trail’s record action or cascade, Actor Suspension’s suspension, Consent’s processing act. Declared in each, the word would have taken four meanings inside one composition tree, since Actor Suspension, Customer Onboarding, Defensible Retention and Recoverable Invocation compose Audit Trail. The maintainer ruled it the grammar’s, as the six rule nouns of v0.53 are: one sense, something done that a record accounts for, and each specification’s own declarations say which (council read 117).

NOTE: v0.57 (2026-09-17): EXCEEDS has an English negative, DOES NOT EXCEED (Earned vocabulary 17, Hard invariant 34). Four conditions spelled at most as NOT EXCEEDS — Capability’s ttl, Medication Order’s dose, Credential’s expires_at, Session’s session_duration — and three spelled at least as x EXCEEDS y OR x EQUALS y, which read 31 found had no one-arm cure between numbers; y DOES NOT EXCEED x is that cure, and Audit Trail’s Invariant 3.1, Recoverable Invocation’s reconcile step 5.1 and its aged term take it. Retention Window’s the duration is not positive and the max_purge_delay is negative read DOES NOT EXCEED the zero duration and the zero duration EXCEEDS the max_purge_delay. The maintainer kept EXCEEDS for instants as for quantities and lengths: it means later or greater in the value’s order on any ordered value, as EQUALS means the same on any value, and an obligation needs it after a modal (MUST NOT EXCEED), where is after does not parse. W-ge-disjunction gates. Council read 104.

NOTE: v0.56 (2026-09-16): symbols leave the rules. The maintainer’s ruling at council read 99 kept = and | for value-set declarations alone, and 86 symbols still sat in rule text across eleven specifications, with eight more in this document’s own rules: 25 <kind> templates, 23 section signs, 11 arrows, 7 brace pairs, 7 bars, 5 en dashes in step ranges, 4 slashes and 4 asterisks. Each became words — the section titled Conformance in execution-contract.md, the event’s event_id mapped to the attestation_id, answering attestation_id, carrying invocation_id and intent_event_id, recording-failure(step-2) and recording-failure(step-3), steps 2 through 5 — or, where it is a code spelling, a code span (<kind>.intended, audit.*); this document’s own rules name the lock list rather than §21. Term rule symbol, Earned vocabulary 16; check.py’s D-rule-symbol gates. Council read 103.

NOTE: v0.55 (2026-09-16): a record’s state is tested as a value. Conditions asked it two ways — IF the session stands in active and IF the party's state EQUALS verified — and the maintainer ruled the second: the state is a declared value set, so the test names it, the session's status EQUALS active, the order's state IS IN the pre-dispensing states (Earned vocabulary 15). 178 rule and declaration lines in twenty-nine specifications moved, the state named by each specification’s own value set — status, state, pool state, hold state, unit state, chain state, retention state, lifecycle state. Stand stays the verb of the write that moves a state. check.py’s D-condition-form gates stands in and stands outside in a condition. Council read 102.

NOTE: v0.54 (2026-09-16): a term entry’s code-spelling line is Projection:, not Projects:. Every other label on a term entry names a thing — Kind:, Role:, Wire: — and Projects: was the one verb; the line holds the projection a name lowers to, and under the v0.53 ruling it is where the code spelling lives. 757 lines renamed in fifty-three specifications, migrated or not, with their aligned blocks re-padded, and the term registry’s introduction in twenty-three; term-adapter.mjs reads the new label and writes projections into the derived manifest. Proposed by the maintainer. Council read 101.

NOTE: v0.53 (2026-09-16): the rule nouns are the grammar’s. Read by a part-of-speech tagger over 7,869 rules, 3,665 of 21,031 noun phrases resolved to no declared name, and the everyday nouns led: call undeclared in 32 of the 36 specifications that use it, write in 29 of 35, instant in 26 of 27, field in 25 of 25, answer in 24 of 29. call, answer, write, input, field and instant are now declared once here (Term rule noun), a specification writes no declaration for one (Earned vocabulary 13), and each is written under its own name (Earned vocabulary 14) — argument, a second name for input, is gone from 91 rules and declarations in twenty-one specifications, opaque argument with it. Unresolved noun phrases fall to 3,211. Instance waits: State Machine declares it as one workflow where the other specifications mean one deployed copy of a pattern. The maintainer ruled the spelling that comes next — English names in rules, derived word for word from the code spelling, which lives in Projects: — and it is not swept here. check.py’s D-rule-noun gates. Council read 100.

NOTE: v0.52 (2026-09-16): one condition operator, one sense, in English words. EXISTS carried at least eight senses across 314 sites in forty-one specifications — a caller’s argument (123), a stored record (72), an event or condition (31), membership in a set (30), a deployment setting (24), a stored field (17), a record’s state (16) and a constituent’s read (1) — and step_id NOT EXISTS and the assignment_id NOT EXISTS meant the caller sent nothing and no record carries the id, told apart by an article. Now EXISTS says a thing is there, and no thing EXISTS says it is not (the absence form; NOT EXISTS retired); a missing value is EQUALS blank (161 sites, is blank among the retired spellings), and blank is declared once here, where twenty-five specifications had declared it word for word and defined it by the operator beside it; membership is IS IN and IS NOT IN, a record’s state among them. = and != became EQUALS and DOES NOT EQUAL at 151 tests, and a write that sets a field says field set to value at 40 sites, so = and | stay only where a value set is declared. The maintainer ruled English over symbols: read aloud by a screen reader, != is exclamation equals or nothing. Earned vocabulary 6 through 12, Hard invariant 32 and Hard invariant 33 added, Hard invariant 14 reworded; check.py’s D-condition-form gates. Council read 99.

NOTE: v0.51 (2026-09-16): a backtick quotes literal text and never marks a name (Term code span, Surface 30). The declaration form lost its backticks at v0.45; the names a declaration lists — value-set members, fields, outcome codes, vocabulary entries, and in this document the reserved tokens and the standard label families — kept them, and so did the prose that mentioned them. 5,346 code spans unwrapped across this document and forty-one specifications; code spellings, expressions, file names, wire tokens and quoted forms keep theirs. The maintainer ruled the reach: every name the specification itself declares, snake and kebab spellings included. Formatted strictly: check.py’s D-code-span gates. Council read 92.

NOTE: v0.50 (2026-09-16): brackets point only to actions and terms. A rule naming another specification carried a Markdown link, [Permissions](./permissions.md), which renders nowhere inside a fence and reads there as a bracket marker Surface 26 cannot resolve; it now names the specification alone (Surface 29), as Hard invariant 28 already writes a cross-spec label. 218 links removed from 217 rules in twenty-nine specifications, each link’s text the linked specification’s own title. Formatted strictly: check.py’s F-bracket gates a link in a rule and a bracket marker that lands on no term entry. Council read 91.

NOTE: v0.49 (2026-09-16): one fence kind. A block of rules was a fence marked text, a signature block a fence marked with nothing, and the two marks said nothing the first line did not already say — so the mark goes and the first line decides (Surface 18, Term bare fence). A block that carries a labelled rule under a first line that opens nothing is still rejected (Surface 19), which is what the text mark used to guard. 982 fences unmarked across the grammar, spec-format.md and forty-one specifications. Formatted strictly: check.py’s D-fence-form gates a fence still marked text. Council read 90.

NOTE: v0.48 (2026-09-15): a signature is written in words — name(inputs, optional input), an answers line, a refuses line (Term signature form, Closed vocabulary 24 through 27) — replacing the arrow, the trailing ?, the braced or bracketed record and the rejected(…) wrapper. A record an action answers is a declared term, as an inner choice became one at council read 84. 171 signatures in 51 blocks across forty specifications; the wrapper also left 69 rules and 115 prose and example sites, where the outcome now stands by its own name. Admitted with the syntax table, formatted strictly: check.py’s D-signature-form gates. Council read 89.

NOTE: v0.47 (2026-09-15): a run of labels is written one way, Family N through M (Term range citation, Hard invariant 29 through 31), replacing the dash, the repeated family, the plural family and to. 379 citations converted across sixty-two files; two degenerate ranges, Capability requirement 2–2, became the one label they cited. Admitted with the syntax table, formatted strictly: lint.py’s F-range-form gates every Markdown file in the repository. Council read 88.

NOTE: v0.46 (2026-09-15): a tombstone is its own line, Deleted: Label. The owner, and why., and no longer a NOTE: whose text happens to begin with a label and the word deleted. NOTE: now means one thing — this line binds nothing — where it had meant that and, in one shape, reserve this label forever; and because a tombstone is no surface prefix, Surface 18 counts it with a labelled rule when it classifies a fence, so a tombstone written first no longer demotes the rules beneath it, the trap F-prefix-first caught twice. 297 tombstones converted, words kept. Council read 87.

NOTE: v0.45 (2026-09-15): the declaration form is Term name: definition. — the name runs to the first colon, bare, and the definition ends with a period — replacing Terms › name: definition., whose separator no keyboard carries and whose backticks gave a declared name a second job beside quoting literal text. Admitted with the syntax table, formatted strictly: a line that opens with Term or with the old separator and does not match the form is a gating finding (check.py’s D-decl-form). 1,649 declarations converted across the grammar and forty-one specifications; no definition changed. Council read 86.

NOTE: v0.44 (2026-09-15): Standard label 11 narrowed from a specification MAY omit a standard label family to omitting one only where spec-format.md §Heading standard does not require its heading, and Standard label 9 and Standard label 12 now cite that section, which replaced §Required sections as the owner of every heading’s name, level, parent, order and requirement. The maintainer’s rulings, made the same day: a spec carries every heading its shape requires and may skip the rest, and one order governs. Standard label 11 and spec-format.md had given two answers on whether a standard family may be omitted — a blanket MAY here, required-with-an-escape there — and the narrowed rule is the one answer. The outlier v0.43 recorded is gone: Idempotent Reservation’s Housekeeping now sits after Wiring decision, placed by the sweep H-heading drove to zero. Council read 80.

NOTE: v0.43 (2026-09-15): Housekeeping promoted to the standard label families, closing the pair Reconciliation opened one version earlier. Three specifications name it and the drift pass Standard label 7 requires found one concept: each leg runs outside every invocation, owes no closure window, refuses to repair what it finds, and refuses a constituent’s write. The apparent divergence is the declaration’s own two poles — Idempotent Reservation’s leg removes where Authenticated Actor’s and Attributed Permissions Admin’s report — which it may report, it may remove already admits, and the section each takes or refuses tracks whether the leg writes at all rather than what the family means. Standard label 9’s position is the pair’s rather than the majority’s: two of the three place the family after Wiring decision, where Reconciliation already sits, and Idempotent Reservation places it second — an outlier that predates the pair’s cut and is a conformance finding against that spec rather than a second position. Council read 71.

NOTE: v0.42 (2026-09-15): Audit arm and Reconciliation promoted to the standard label families — the promotion path’s second use, and the first time two families crossed on one migration. Four specifications name each, and the drift pass Standard label 7 requires found one concept in each across all four. Audit arm’s concept is the mapping of the substrate’s record_action taxonomy at the composing boundary: which arm is retryable, which arm arrives with the record already appended, which is a pageable deployment fault, and what the composition owes on each — stated by step in Login and Defensible Retention, by step and position in Customer Onboarding and Actor Suspension, which is the same concept with an export the first two did not need. Reconciliation’s concept is the awaited leg, and all four members answer council read 64’s axis the same way: each escalates against a declared window (Login’s reconciliation window, Defensible Retention’s and Customer Onboarding’s compensation window, Actor Suspension’s completion window), which is precisely what Housekeeping’s two members owe none of. Standard label 9’s position is derived rather than assigned: all four specifications already place Audit arm before Action wiring and Reconciliation after Wiring decision, so the promotion records the order the corpus had already agreed on. Council read 69.

NOTE: v0.41 (2026-09-14): Wiring decision promoted to the standard label families — the promotion path’s first use, and the first family the corpus has promoted at all. Seven specifications name it and the drift pass Standard label 7 requires found one concept across all seven, in one invariant shape: a rule naming the decision positively, and one or more rules forbidding the wiring the decision rejected. The argument that decided it is not the count. spec-format.md already requires The load-bearing wiring decision as a composition-shape section, so the family is a container the corpus already carries having its rule form named, and Standard label 9 gives it the position every one of the seven already sits in — promotion reconciles two documents that agreed, where declining would have left them drifting. Council read 64.

NOTE: v0.40 (2026-09-12): cited and composing pattern added to the category value set. Both are categories in active use — cited in two compositions, composing patterns in one — and absent from the set that is supposed to enumerate the categories a vocabulary may carry, which Value set 3 forbids and Closed vocabulary 2 needs. check.py already carried both names in two hard-coded category sets, so the instrument recognized them before the grammar did; the checker now derives the set from this line instead of holding its own copy, so the two cannot drift again. Council read 29.

v0.39 (2026-09-12): sentence case added to the casing tier value set. The tiers shipped with three members against a census that counted 104 word-named label families in sentence case — a member in active use and absent from its own set, which Value set 3 forbids and Casing 6 needs. Council read 27.

NOTE: v0.38 (2026-09-12): Authority 3 widened from two specs to two rules, so one proposition owned twice inside a single spec is a finding rather than a preference. Admitted on Principle 2’s two halves — the shape recurs in every migrated spec, and the contested half is council read 26’s count of 46 duplicate pairs in Capacity alone, seven of them verbatim under two labels. tools/grace/check.py reports W-duplicate-proposition. No form admitted or withdrawn; a scope widened.

NOTE: v0.37 (2026-09-12): card renamed to term entry (Surface 25, Surface 27, §21). A rename only — no rule changed, no form admitted or withdrawn. Card named a presentation; the object is structured knowledge about a declared term — its definition, kind, relationships and projection token — and a Grace UI may render it as a card, a tooltip, a panel or nothing at all. Declared lower case, like every sibling term in this document’s vocabulary (bracket marker, normative block, text fence, casing tier), because Casing 4’s title case is the bracket marker’s and a grammar term is not one. Council approved.

NOTE: v0.36 (2026-09-12): the casing tiers declared (Casing 1 through 6) — upper case is reserved, an initial capital names a label family or a bracket marker, lower case is the specification’s own. Already in force in nineteen documents and drifting at 471 sites inside normative rules, which is Principle 2’s two halves. Council read 24.

NOTE: v0.35 (2026-09-11): local specs declare domain meaning, not GRACE meaning (Principle 9 through 11); the standard label families declared once, here (Standard label 1 through 3); the signature block admitted with one line per action, and the rejected(…) wording it carried from Recoverable Invocation dropped; the term entry and the bracket marker read as the surface nothing, the Terms › declaration the one owner (Surface 25 through 27). Council read 8.

NOTE: v0.34 (2026-09-11): labels are words — the name of the heading a rule sits under, then a number (Rule shape 7, Rule shape 8); every label in this document, Recoverable Invocation, Audit Trail and Lease relabelled; a cross-spec reference names the spec before the label (Hard invariant 28). No form admitted or removed.

NOTE: v0.27–v0.33, the council’s reads and the labels before v0.34 are archived in git history (git log -- GRACE-lang.md, last commit before the relabel e80fd21).

Left the Watch list at the allocated id unit, 2026-11-05

The mayor stated it once at five in the Execution Contract, by the 2026-10-22 placement (how the system behaves lives there, settle.md Repeats; the maintainer’s 2026-11-03 17:15Z ruling that a repeat at five is stated, not parked), in the quiet window as the held cure of Gift Card Final Critique 2, and reports it as a ruling the maintainer may reverse by one line. Logic confinement 16 obliges the host never to supply an id it allocates to two calls of one instance, the stronger of the entry’s two readings, since an id fresh only against the stored ids reaches two calls in flight; a specification’s own rule that an id names no record already held stands beside it (Credential Capability requirement 34, Gift Card Capability requirement 1 and Capability requirement 2). No atom or composition changes; the flags the five pages carry are relocations, and no round is owed.

• the id the host supplies to two calls: an id the host injects at the seam, distinct across calls or only from the ids already stored, so a deployment judging freshness against the stored ids alone supplies one id to two calls in flight, or a counter restarting with the process supplies one twice, and two records share it; each cure obliges the deployment never to supply one id to two calls. Five: Credential (Capability requirement 35), Defensible Retention (Capability requirement 63), Gift Card (Capability requirement 10 and Capability requirement 11, its Final Critique 2), Login (Capability requirement 16) and Selective Disclosure (Capability requirement 1). Stated once at Execution Contract Logic confinement 16.

Left the Watch list at the cap’s floor unit, 2026-11-05

The mayor stated it once at five in the Execution Contract, by the 2026-10-22 placement (how the system behaves lives there, settle.md Repeats; the maintainer’s 2026-11-03 17:15Z ruling that a repeat at five is stated, not parked), in the quiet window as the held cure of Tamper Evidence Final Critique 16, and reports it as a ruling the maintainer may reverse by one line. Input 2 now bars a deployment’s cap of zero on the length of a string, which refuses every string a caller supplies and leaves no id the host can allocate, and its closing clause covers both floors. No atom or composition changes; the five flags (Permissions, Notification, State Machine, Actor Identity, Tamper Evidence) are relocations, and no round is owed.

• the cap’s floor: a deployment’s string cap of zero, which refuses every caller’s string and leaves no id the host can allocate (Execution Contract Input 2 allows a deployment’s cap and bars only a cap below a held value); each cure either calls the cap of zero the deployment’s degenerate configuration in Term string cap, or bars it in the page’s Capability requirement (MAY declare the string cap ONLY IF the string cap EXCEEDS 0). Five: Permissions (Term string cap), Notification (Term string cap, its Final Critique 6), State Machine (Capability requirement 7, its Final Critique 14), Actor Identity (Capability requirement 5, its Final Critique 15) and Tamper Evidence (Capability requirement 6, its Final Critique 16).

Left the Watch list at the malformed instant unit, 2026-11-05

The mayor stated it once at seven in the Execution Contract, by the 2026-10-22 placement (how the system behaves lives there, settle.md Repeats; the maintainer’s 2026-11-03 17:15Z ruling that a repeat at five is stated, not parked), in the quiet window as the held cure of Observation Final Critique 7, and reports it as a ruling the maintainer may reverse by one line. Input 3 now holds a supplied instant that a rule compares to the type instant and answers a value that is not one with invalid-request unless the specification states its own answer (Observation keeps invalid-observation). No atom or composition changes; the flag in Observation (Operation 63) is a relocation, and no round is owed.

• the malformed supplied instant: an instant a call may supply, which the page compares (PRECEDES or EXCEEDS) and so Execution Contract Input 3 does not default, with no rule naming the refusal for a value that is not an instant, so one build answers the refusal Input 2 names (invalid-request) and another the page’s own content refusal; each cure writes one Operation rule on the admitting action, IF a supplied <instant> is malformed THEN <action> MUST answer <refusal> (Execution Contract Input 1). Seven: Approval Step (Operation 63 and Operation 64), Consent (Operation 66 and Operation 67), Credential (Operation 80 and Operation 81), Medication Order (Operation 86), Selective Disclosure (Operation 38), State Machine (Operation 65 and Operation 66) and Observation (Operation 63, its Final Critique 7). Stated once at Execution Contract Input 3.

Left the Watch list at the required setting unit, 2026-11-04

The mayor stated it once at nine in the Execution Contract, by the 2026-10-22 placement (how the system behaves lives there, settle.md Repeats; the maintainer’s 2026-11-03 17:15Z ruling that a repeat at five is stated, not parked), and reports it as a ruling the maintainer may reverse by one line. Logic confinement 15 makes a setting with no default a required setting the deployment sets, with no start while it is blank; four of the cures were caps already given a default by Input 2. No atom or composition changes; the flags are relocations, listed in the v3 batch.

• the unset setting: a deployment setting a start condition or a rule reads, declared with a default of none and nothing that sets it or refuses the start without it, so where the setting is left blank one build refuses the start and another starts and runs on it; each cure refuses the start on the blank setting or writes the rule that sets it. Nine: Audit Trail (Instance start 1 through 14, 20, 24 and 30), Recoverable Invocation (Instance start 3, its Final Critique 26; read cap 1 and intent candidates cap 1, its Final Critique 25), Capacity Constraint Enforcement (String 3, its Final Critique 10), Defensible Retention (Capability requirement 14 and 16, its Final Critique 16), Gift Card (Capability requirement 6, its Final Critique 1), Shared Cart (Capability requirement 3, its Final Critique 1), Session-Gated Authorization (Primitive policy 1, its Final Critique 9), Privileged Access Provisioning (Capability requirement 33, its Final Critique 3) and Propagate Consent Revocation Downstream (Capability requirement 36, its Final Critique 11). Stated once at Execution Contract Logic confinement 15, and at Input 2 for the four caps cured by a default.

Left the Watch list at the filter value and allocated id unit, 2026-11-04

The mayor stated three names once in the Execution Contract, by the 2026-10-22 placement (how the system behaves lives there, settle.md Repeats; the maintainer’s 2026-11-03 17:15Z ruling that a repeat at five is stated, not parked), in the 2026-11-04 quiet window, and reports them as a ruling the maintainer may reverse by one line. Input 2 now says the host allocates an id that is not blank and does not exceed the cap, counted as the host allocates it; Query 5 says a filter’s value on a string axis is held to the cap and is not blank, a blank id among them, and the read answers it with its malformed-query refusal. Consent’s Final Critiques 17 to 19 had paid one end of the allocated id each round. No atom or composition changes; the clauses the pages carry are relocations, listed in the v3 batch.

• the id’s length against the cap: a host-allocated id longer than the string cap or the length bound leaves its record unaddressable, with no rule obliging the allocator to stay under it. Seven: State Machine (Identity 17, Identity 18), Observation (Identity 2, its Final Critique 6), Consent (Identity 2, its Final Critique 17 to 19), Medication Order (Capability requirement 16, its Final Critique 6), Selective Disclosure (Identity 2, its Final Critique 14), Credential (Capability requirement 39) and Party Identity (Capability requirement 14). Stated once at Execution Contract Input 2.
• the blank filter value: a read’s refusal of a blank filter value written for reference filters alone, so a blank value on the record’s own id meets no refusal and one build answers it as matching nothing where another refuses it; each cure carries the refusal to every filter the id’s axis is among. Five: Observation (Operation 48), Approval Step (Operation 45), Multi-Party Approval (Term query), Party Identity (Term query axes) and Medication Order (Operation 85, its Final Critique 6). Stated once at Execution Contract Query 5.
• the filter value over the cap: a read’s filter value is a string input to the cap, and Execution Contract Input 2 binds writing actions only, so a filter value over the cap meets no refusal and one build answers the empty sequence where another refuses it; each cure states the read’s own invalid-query for a filter value over the cap. Seven: Observation (Operation 61, its Final Critique 6), Approval Step (Operation 66), Selective Disclosure (Operation 45), State Machine (Operation 79), Medication Order (Operation 84, its Final Critique 6), Multi-Party Approval (Term query, its Final Critique 14) and Consent (Operation 76, its Final Critique 19). Stated once at Execution Contract Query 5 (and Input 2, whose floor already binds a writing action’s string).

Left the Watch list at the degenerate bound, 2026-11-04

The mayor stated it once at six, by the 2026-10-22 placement (how a rule reads lives here, settle.md Repeats; the maintainer’s 2026-11-03 17:15Z ruling that a repeat at five is stated, not parked), and reports it as a ruling the maintainer may reverse by one line. The cure every site made is the grammar’s own: Timing 9 writes a closed bound as term MUST NOT EXCEED term and Timing 12 a strict one as actor MAY action ONLY IF term EXCEEDS term, so equality falls on a named side. The entry had stood at five since before the v0.65 compression; Compensable Workflow’s Final Critique 5 (Capability requirement 9 and 10: a lease length pinned equal to the step completion bound, so the halt owed at the bound landed on the expiry instant) made it six. The sentence added to Timing’s WHY names the home. The two NOTE: watch the degenerate bound flags (Duplicate Prevention, Compensable Workflow) stay and are listed in assets/v3-batch.md for the batch to cut; no atom or composition moves.

• the degenerate bound: an inequality or bound whose two readings make different rules real. Six: Lease (two), Duplicate Prevention, Retention Window, Provenance and Compensable Workflow (Capability requirement 9 and Capability requirement 10, Term step completion bound, its Final Critique 5).

Left the Watch list at the read order and bound unit, 2026-11-03

The maintainer ruled on 2026-11-03 (“so make it DONE”) that Execution Contract Read 5 states once the order a read answers in where its specification names none, and Read 6 that a read answers the whole match, a deployment paging it in the same order. The order is the standing posture the entry below counted (every history surface answers ascending); the departure is its Read 5, citing Logic confinement 10 for the tie. Five specifications left the order open (Session, Capability, Invitation, Permissions, Actor Identity), and each now cites Read 5 in its Capability requirement.

• read-order polarity: a history surface answering reads in no stated order. Two postures: every history surface answers a read in ascending order, and Invitation’s Operation 41 answers its matching invitations in no stated order. Four flagged: Assignment (Operation 28) and Credential (Operation 69), whose reads named their order and no direction until Assignment’s Final Critique 6 and Credential’s Final Critique 14 wrote earliest first, Recoverable Invocation (read invocation 16), whose read named no order until the unit that cured its open lines wrote earliest first, and Party Identity (Operation 52), whose read answered a party’s two event lists in no stated order until its Final Critique 9 wrote insertion order.

Left the Watch list at the cap once unit, 2026-11-03

The maintainer ruled on 2026-11-03 (17:15Z, “YES! the process is way broken imho”) that Execution Contract Input 2 states once what a cap counts and what it refuses, and that a repeat at five is stated once, not parked: the refusal was escalated at five by Invitation’s Final Critique 9 (12:20Z) and the measure by Consent’s Final Critique 16 (12:54Z), each left unanswered while every later page paid a round for it, nineteen specifications carrying the two one-clause cures made atom by atom, the residue of the host obligations sweep that put a default cap into nineteen specifications without saying how it counts or what it refuses. Input 2 now says both; no atom or composition changes, and the clauses the pages carry are relocations, listed in the v3 batch. The same unit stated once, by the 2026-10-22 placement, every other name the list showed at five or past; each bullet below names where it now lives, and no atom or composition moves for any of them.

• the cap’s refusal: a cap the specification states under Execution Contract Input 2, whose refusal only a case-space row and a term entry name, both the reader’s copy (Surface 25 through 27), so Input 2 sends an over-cap call to the refusal the specification answers a malformed input with (Input 1) and no rule of the page names that refusal, and one build answers invalid-request where another finds none to answer (Hard invariant 16, Hard invariant 20); each cure names the refusal by an Operation rule on the action, as Permissions’ String 6 does. Seven: Actor Identity (Operation 37, its Final Critique 11), Tamper Evidence (Operation 34, its Final Critique 11), Selective Disclosure (Operation 44 and Operation 45, its Final Critique 13), Subscription (Operation 29, its Final Critique 8), Invitation (Operation 49 through 51, its Final Critique 9), Consent (Operation 70 through 73, its Final Critique 16) and State Machine (Operation 75 through 79 and Declaration 20, its Final Critique 11).
• the cap’s measure: a string cap stated as a length in Unicode code points, where Execution Contract Logic confinement 13 canonicalizes a reference at the seam before the transition compares it and a canonical spelling can differ in code-point count, so one build counts the value as the call supplied it and another its canonical form, and a call near the cap is refused by one and admitted by the other; each cure counts the value as the call carries it (Execution Contract Input 2 holds a cap to the call’s input). Seven: Approval Step (Term string cap and Term bounds, its Final Critique 13), Subscription (Term string cap and Term bounds, its Final Critique 9), Session (Term bounds, its Final Critique 16), Invitation (Term string cap, its Final Critique 9), Consent (Term string cap and Term bounds, its Final Critique 16) State Machine (Term string cap and Term bounds, its Final Critique 11) and Actor Identity (Term string cap and Term bounds, its Final Critique 13).
• the seam citation: Term seam, Term transition and Term business caller each saying the section titled Logic Confinement Principle in execution-contract.md declares it, where that section uses the three words and declares none, so the citation resolves to nothing (Closed vocabulary 16) while each declaration carries its own definition, which every rule reads; each cure drops the citation (Closed vocabulary 15), the page’s own definition standing. Fourteen: Session (Term seam, Term transition and Term business caller, its Final Critique 14), State Machine (Term seam and Term transition, its Final Critique 10), Provenance (Term seam and Term transition, its Final Critique 12), Personal Todo (Term seam, Term transition and Term business caller, its Final Critique 6), Selective Disclosure (Term seam, its Final Critique 11, its Term transition and Term business caller deleted with the rule that read them), Capability (Term seam, Term transition and Term business caller, its Final Critique 10), Party Identity (Term seam and Term transition, its Final Critique 8), Invitation (Term seam and Term transition, its Final Critique 8), Actor Identity (Term seam, Term transition and Term business caller, its Final Critique 11) and Tamper Evidence (Term seam, Term transition and Term business caller, its Final Critique 11) and Approval Step (Term seam, Term transition and Term business caller, its Final Critique 12) and Subscription (Term seam, Term transition and Term business caller, its Final Critique 8) and Notification (Term seam, Term transition and Term business caller, its Final Critique 7) and Message Preference (Term seam, Term transition and Term business caller, its Final Critique 10). Stated once at Execution Contract Logic confinement 14.
• the constituent’s failed read: a constituent call’s state-unavailable, which writes nothing (Execution Contract Read 3), landed by no rule of a composing action whose arms land only the constituent’s declared answers, so one build passes it through as the composing action’s own (Execution Contract Read 1), with no position where the action’s codes carry one, and another lands it as the composition’s own code; each cure lands it where the composition lands the constituent’s other answers that commit nothing. Seven: Defensible Retention (Action wiring 98, 109 and 111, its Final Critique 12; Action wiring 80 and Audit arm 23, its Final Critique 15), Audit Trail (Third half 16 and Compensation 18), Notification Fanout (Action wiring 4, its Final Critique 9), Recoverable Invocation (Primitive policy 45, Capability requirement 18, act section 17 and act section 20, its Final Critique 25), Verified Repair (Primitive policy 11 and Primitive policy 23, its Final Critique 23), Authenticated Actor (Action wiring 43 and Action wiring 44, its Final Critique 6) and Immutable Ledger (Audit arm 32 and Term no answer, its Final Critique 17). Stated once at Execution Contract Constituent failure 3.
• the retention step’s recording failure: Audit Trail’s recording-failure(step-4), which commits nothing, landed by no Audit arm of a composition whose arms land only the append step’s recording failures, so one build answers intent, another outcome and a third the step; each cure lands every recording-failure the substrate answers at the position it was written at. Eight: Multi-Party Approval (Audit arm 10), Actor Suspension (Audit arm 5, Audit arm 17), Capability-Backed Sharing (Audit arm 2, Audit arm 8), Execute Gated Workflow (Audit arm 11, its Final Critique 12; Term transient arm, its Final Critique 13), Propagate Consent Revocation Downstream (Audit arm 12, Audit arm 13, its Final Critique 10), Defensible Retention (Audit arm 21, Audit arm 22, its Final Critique 15), Verified Repair (Primitive policy 13, Primitive policy 15 and Primitive policy 17, its Final Critique 23) and Immutable Ledger (Audit arm 31, its Final Critique 17). Stated once at Execution Contract Constituent failure 4.
• the untyped input: a writing action’s input whose type the specification declares nowhere, though Execution Contract Input 1 asks each specification to declare each input’s type and the refusal a malformed input answers, so nothing but a reader’s inference holds the input to a type (Hard invariant 20) and no rule names what a value of another type answers; each cure declares the type and names the refusal, citing Input 1. Nine: Session (Term reason and Operation 57, its Final Critique 13), Invitation (Term window length and Operation 48, its Final Critique 8), Owed Record (Term due-by window and Term continuation key, Operation 40 and Operation 41, its Final Critique 1), Erasure Tombstone (Term window start, Term window end and Term continuation key, Operation 26 and Operation 27, its Final Critique 1) Subscription (Term subscriber reference, Term event scope and Term subscription id, Operation 30 and Operation 31, its Final Critique 8) and Notification (Term notification id and Term recipient reference, Operation 31 and Operation 32, its Final Critique 7, the payload left untyped: it is opaque content of any value) and Message Preference (Term preference id, Term principal reference and Term channel preferences, Operation 44 through 47, its Final Critique 10, the opaque preference values left untyped) and Consent (Term reason and Operation 74, its Final Critique 16) and Actor Identity (Term string input, its Final Critique 13); Capability writes a revocation reason untyped, and Provisional Commitment a duration. Stated once at Execution Contract Input 3.
• the required input no rule records: an input a call must supply, whose field a state rule makes the record carry and no rule sets from the call, so nothing but a reader’s inference keeps a build from recording another value (Hard invariant 20); each cure records the input by an Operation rule on the admitted action. Nine: Observation (Operation 57, its Final Critique 5), Approval Step (Operation 62, its Final Critique 10), Provenance (Operation 62, Operation 63, Operation 64 and Operation 65, its Final Critique 11; Operation 68, Operation 70, Operation 72 and Operation 74, its Final Critique 12), Session (Operation 50 and Operation 51, its Final Critique 7; Operation 30, its Final Critique 12), State Machine (Operation 67 and Operation 68, its Final Critique 9; Operation 74, its Final Critique 10), Selective Disclosure (Operation 39, Operation 40, Operation 41, Operation 42 and Operation 43, its Final Critique 11) Condition Register (Operation 38, Operation 39, Operation 40 and Operation 41, its Final Critique 1), Notification (Operation 30, its Final Critique 7) and Actor Identity (Operation 38 and Operation 39, its Final Critique 13). Stated once at Execution Contract Input 4.
• the deployment’s composition note: Composition note 1, A deployment MUST declare which composing patterns the deployment wired in, filed under the Composition note family, which this document gives to an obligation on a composing pattern (Term standard label family), where what the deployment supplies is a Capability requirement; each cure moves it there. Nine: State Machine (Capability requirement 6, its Final Critique 10), Provenance (Capability requirement 7, its Final Critique 12), Authenticated Actor (Capability requirement 15, its Final Critique 6), Selective Disclosure (Capability requirement 7, its Final Critique 11), Capability (Capability requirement 9, its Final Critique 10), Subscription (Capability requirement 8, its Final Critique 8), Notification (Capability requirement 7 and Capability requirement 8, its Final Critique 7, the fail-versus-expire declaration moved with it) and Message Preference (Capability requirement 10, its Final Critique 10) and Actor Identity (Capability requirement 7, its Final Critique 13); seventeen pages write the note uncured. Stated once at Execution Contract Conformance 9.
• the blank optional input: an optional input recorded by a rule written as what the call supplied or omitted, so a call carrying the input blank, supplied by Term call and left blank by Execution Contract Input 1, is recorded or dropped by readings no rule states, where Input 1 makes a blank input’s meaning its specification’s; each cure writes the rule in the grammar’s blank form (Earned vocabulary 7), recording the input where it DOES NOT EQUAL blank and none where it EQUALS blank. Eight: Invitation (Operation 10, its Final Critique 6), Consent (State 4, State 5, State 6 and State 16, its Final Critique 11), State Machine (Operation 56, Operation 59, Operation 70 and Operation 71, its Final Critique 9; Operation 60 and Operation 61, its Final Critique 10) Recoverable Invocation (read invocation 2 and read invocation 3, the input branched on rather than recorded, its Final Critique 25), Condition Register (Operation 40 and Operation 41, its Final Critique 1) Owed Record (Operation 33, the continuation key branched on rather than recorded, its Final Critique 1) and Erasure Tombstone (Term matching erasure tombstone, the continuation key branched on rather than recorded, its Final Critique 1) and Message Preference (State 3, State 4, State 5 and State 21, its Final Critique 10). Stated once at GRACE-lang Earned vocabulary 21 and Earned vocabulary 22.
• the allocation ban: an Identity rule, The transition MUST NOT allocate an id, restating Execution Contract Logic confinement 3, under which every identifier is injected as an explicit input and none is generated inside the transition (Authority 6); each cure tombstones it to Logic confinement 3. Nine: Actor Identity (Identity 3, its Final Critique 5), Provenance (Identity 5 and Identity 6, its Final Critique 12), Personal Todo (Identity 3, its Final Critique 6), Selective Disclosure (Identity 3, its Final Critique 11), Capability (Identity 5, its Final Critique 10), Tamper Evidence (Identity 3, its Final Critique 12), Notification (Identity 3, its Final Critique 7), Message Preference (Identity 3, its Final Critique 10) and State Machine (Identity 5 and Identity 6, its Final Critique 11); ten pages write the rule uncured (Approval Step, Assignment, Capacity Constraint Enforcement, Consent, Event Log, Legal Hold, Observation, Permissions, Retention Window and Session). Stated once at Execution Contract Logic confinement 3.
• the miss read before its rebuild: a rule answering or admitting on a derived index’s missing entry, which the Execution Contract makes a rebuild trigger, not data loss (the section titled Composition state in execution-contract.md), with nothing ordering the rebuild first, so one build rebuilds the entry from the records it derives from and decides on them while another decides on the miss; each cure orders the rebuild first in the form MUST NOT … BEFORE rebuilding, which the page already wrote for another of its reads. Five: Audit Trail (sealed through 3, its Final Critique 57), Capability-Backed Sharing (Action wiring 56, its Final Critique 7), Execute Gated Workflow (Action wiring 74, its Final Critique 12; Action wiring 77, its Final Critique 13), Multi-Party Approval (Composition state 21, its Final Critique 13) and Propagate Consent Revocation Downstream (Composition state 22, its Final Critique 10). Stated once at Execution Contract Derived index 1.

Left the Watch list at the host obligations sweep, 2026-11-02

The maintainer ruled on 2026-11-01 (21:45Z, “as recommended”) that what the host must bound takes one posture, a corpus default a deployment may override, stated once in the Execution Contract, and the sweep that landed it removed every flag the name carried. The name stood past the five at which this list asks the maintainer to rule once, at nineteen specifications. The ruling and the flags named Duplicate Prevention as the page that declares a cap; the page that does is Personal Todo (Capability requirement 5, Term description cap), and Duplicate Prevention states none.

• Host obligations, counted at nineteen: what the host must bound, which each specification answered for itself in one of three postures, a cap the specification declared, a cap the deployment had to supply, or none, so one kind of string input was bounded in one atom, left to the deployment in another and unbounded in a third, and a build could not tell which bound a deployment owed. Nineteen: Actor Identity, Approval Step, Cart (twice, an item reference and a count of lines), Consent, Credential, Invitation, Legal Hold, Medication Order, Notification, Observation, Party Identity, Permissions, Provenance, Provisional Commitment, Selective Disclosure, Session, State Machine, Subscription and Tamper Evidence. Now Execution Contract Input 2: a bound is a default cap, which a deployment may override by declaring its own; a cap is never left unstated, and a deployment never has to supply one. Each of the nineteen states its cap with a default and cites the label in a Capability requirement; the twelve that held no value, and the seven that left the value to the deployment, took one from their own domain and gave the reason in their Decisions entries. Cart took a second cap, on its lines, and a refusal for it. The host obligations row in open-questions.md keeps what the ruling left open.

Left the Watch list at the blank invariant and composer sweep, 2026-10-30

The maintainer ruled on 2026-10-30 (11:09Z, yes to all four entries) that the modal with no temporal scope is stated once in this document, with a check.py flag, and the reading composer’s write ban once in the Execution Contract, and the sweep that landed them removed every flag the two names carried. The modal was escalated at five by Notification’s Final Critique 6 (2026-10-29 15:25Z), and Subscription’s Final Critique 6 made it six before the ruling; the write ban at five by Capability’s Final Critique 9 (2026-10-29 22:25Z), and Consent’s Final Critique 13 made it six. The same ruling declared whitespace once, in Term blank, which no Watch list line had counted: Notification’s Final Critique 6 was the first page to name the set (the 15:25Z escalation’s direction (b)).

• The modal with no temporal scope, counted at six: a rule in the Invariant family, a property of every reachable state, written as a move a record owes, so MUST says always and eventually in one breath and one labelled rule carries a safety claim and a liveness claim; read as written it obliges every record to move, and each page’s own lawful states break it, a pending notification nobody resolves, an active grant nobody revokes. Six: Message Preference (Invariant 2.1, Invariant 2.2), Permissions (Invariant 2.1), Assignment (Invariant 3.1), Notification (Invariant 2.1), Subscription (Invariant 2.1) and Session (Invariant 5.3); the first five each a status rule written A status MUST move from …, deleted to State 1, and Session’s A lapsed session MUST reach [Revoke], deleted to Operation 27; the first measured instance was Provisional Commitment’s draft Invariant 2.3. Now Standard label 13 and 14, beside the Invariant family: a rule of the Invariant family claims only what holds in every reachable state and obliges no act, so a page writes a move as what may not happen (MUST NOT move to …) or as where a record stands (the State family’s EXACTLY ONE OF), never as a move a record owes; tools/grace/check.py’s R-invariant-move gates MUST move inside the family, and found no rule carrying it. The six cures’ tombstones stand, each naming the rule that still holds what its deleted rule meant.
• The reading composer’s write ban, counted at six: a constituent’s note that a composing pattern reading its records MUST NOT write to them, where a composition action’s Step 3 holds its constituent calls (the section titled The pipeline applies to composition actions in execution-contract.md) and a write is one change a system makes to a database (Term write), so the note forbids the write the composer is obliged to make through the atom’s own action, and one build obeys the note while another delivers the composer’s wiring; each cure tombstoned the note to the atom’s rules offering no edit or removal surface and Execution Contract Database 4. Six: Selective Disclosure (Composition note 9, its Final Critique 10), State Machine (Composition note 10, its Final Critique 7), Approval Step (Composition note 11, its Final Critique 9), Session (Composition note 10, its Final Critique 11), Capability (Composition note 7, its Final Critique 9) and Consent (Composition note 8, its Final Critique 13, the note written as a ban on standing a consent record in any state); three atoms wrote the note uncured (Capacity Constraint Enforcement, Composition note 8; Observation, Composition note 10; Provenance, Composition note 8). Now Execution Contract Atom interface 1, in the section titled The atom interface contract: a composing pattern changes a constituent’s records only through the constituent’s declared actions, and reading the records keeps it from no call of them. The three notes were cut, each tombstoned to the label, and the six tombstones now name the label alone. The label is written for the reading composer: a note keeping a named composer from a named call or change, such as Session’s Composition note 2 or Medication Order’s Composition note 10, is the page’s own and stands.

Left the Watch list at the checks registry and scheduler sweep, 2026-10-29

The maintainer ruled on 2026-10-29 (02:10Z) that the check no record answers, the registry outage and the supplied scheduler are each stated once in the Execution Contract, and the sweep that landed them removed every flag the three names carried. The check no record answers was escalated at five by State Machine’s Final Critique 8 (2026-10-28 01:29Z, direction (a), the re-read form stated once), the registry outage by Idempotent Reservation’s Final Critique 5 (11:39Z, passed through by default) and the supplied scheduler by Recoverable Invocation’s Final Critique 24 (12:58Z).

• The check no record answers, counted at eleven: a Generation acceptance check asking for an action’s answer, a refused call’s absent write or an auditor’s own reading, where the Execution Contract lowers every such check to a read query over the record set (the section titled Regulated atoms) and spec-format’s overlay makes a conformance check one an auditor answers by reading the records, so the check passes a deployment that breaks the rule it names; each cure tombstoned the check to the rule, or the check, that holds what it asked, or pointed it at the committed versions Execution Contract Database 5 keeps readable. Eleven: Selective Disclosure (Check 4.1, Check 4.2, Check 6.1, its Final Critique 10), Capability-Backed Sharing (Check 2.4, Check 3.5, Check 5.3, Check 5.5, Check 6.5, Check 6.7, its Final Critique 7), Chain of Custody (Check 2.2, Check 5.5, Check 6.2, Check 6.3, its Final Critique 10), Party Identity (Check 2.2, its Final Critique 7), State Machine (Check 1.1 and Check 5.3, a re-read compared with the prior read, pointed at the committed versions, its Final Critique 8), Approval Step (Check 6.1, Check 6.2 and Check 6.3, a later read compared with an earlier one, pointed at the committed versions, its Final Critique 10), Invitation (Check 6.2, Check 7.2 and Check 8.1, a later read compared with an earlier one, pointed at the committed versions, its Final Critique 7), Credential (Check 6.1, Check 7.1 through 7.3 and Check 8.1, a later read compared with an earlier one, pointed at the committed versions, its Final Critique 19), Duplicate Prevention (Check 1.2, Check 1.3 and Check 2.1, a reading compared across a call, Check 1.4, a landed record’s freshness, and Check 4.1, a record’s answer, each tombstoned to the rule it tests, its Final Critique 6), Provisional Commitment (Check 2.2, a later read compared with an earlier one, and Check 5.1, a re-read compared across a resolving action, each pointed at the committed versions, its Final Critique 6) and Idempotent Reservation (Check 5.1, a recovered entry’s mark, which no other record names, tombstoned to the rule it tests, its Final Critique 5); Legal Hold (Check 5.1) and Consent (Check 6.1, Check 6.2) carry it uncured, and seven atoms write the re-read form uncured, a check comparing an auditor’s later read with an earlier one: Event Log, Medication Order, Observation, Party Identity, Provenance, Selective Disclosure and Session. Now Execution Contract Generation acceptance 1, beside the section titled Regulated atoms: a check comparing a record with an earlier state reads the record’s committed versions, which Database 5 keeps readable, never an auditor’s earlier read. The sweep pointed the seven atoms’ re-read checks at the committed versions, and Execute Gated Workflow’s Check 2.3, which the list missed; every check that reads the committed versions cites the label, and Term committed version cites it on each page that declares it. Legal Hold’s Check 5.1 and Consent’s Check 6.1 and Check 6.2 ask for an action’s answer, which the label does not decide, and stand as they were; the section titled Regulated atoms lowers every check to a read query over the record set.
• The registry outage, counted at five: a constituent’s registry-unavailable, which Actor Identity’s attest and Retention Window’s place_under_retention answer when the host cannot read the registry at the seam, landed by no rule of the composition that calls it, so one build answers a code its signature does not carry and another a refusal its caller reads as final; each cure lands it where the composition lands that constituent’s storage-failure, or passes it through where no page composes the composition. Five: Audit Trail (record action step 2.14, 4.10), Defensible Retention (Action wiring 16a), Attributed Permissions Admin (Action wiring 87, 89, 93), Authenticated Actor (Action wiring 38) and Idempotent Reservation (place_hold’s refuses line, Composes 6). Now Execution Contract Constituent failure 2, beside Constituent failure 1: a constituent’s registry-unavailable is the composing action’s, which answers it unchanged unless the composition lands it as a code of its own by a rule that cites the label. The four pass-through rules were cut (Attributed Permissions Admin Action wiring 87, 89 and 93; Authenticated Actor Action wiring 38), and the three that land it as a code of their own cite the label (Audit Trail record action step 2.14 and 4.10, as recording-failure; Defensible Retention Action wiring 16a, as storage-failure). Customer Onboarding, Propagate Consent Revocation Downstream and Reserve from Pool, which landed it nowhere, need no rule.
• The supplied scheduler, counted at five: the facility that starts a scheduled run, which each specification obliges the deployment to supply, to start a run at restart and on the cadence and to survive the loss of a process, where the Execution Contract lowers a reconciliation to a scheduled leg and names no starter for it, so a page that writes the cadence and no starter lets one build run the sweep only at restart, or inside one process, while another keeps the window; each cure obliges the deployment to supply the scheduler, says when it starts a run and gates the start on it. Five: Audit Trail (reconciliation cadence 6, seal cadence 4), Defensible Retention (Capability requirement 51, Capability requirement 52), Preference-Aware Notification Fanout (Reconciliation 1, Reconciliation 2), Resolve a Person’s Data Rights (Capability requirement 38, Capability requirement 43) and Recoverable Invocation (Capability requirement 16, Capability requirement 17, its Final Critique 24). Now Execution Contract Scheduled leg 1, in the section titled Scheduled legs: the deployment supplies each scheduled leg’s starter, which starts the leg at every start of a process serving the instance and on the leg’s cadence and survives the loss of any one process, and an instance whose starter is absent does not start. The starter rules, terms, start gates and external checks were cut; each page keeps its cadence’s timing, and Resolve a Person’s Data Rights’ overrun alert is the deployment’s.

Left the Watch list at the input and seam sweep, 2026-10-28

The maintainer ruled on 2026-10-28 (01:18Z) that the untyped input, the instant left blank and the canonical form are each stated once in the Execution Contract, under the maintainer’s rule that how the system behaves goes there, and the sweep that landed them removed every flag the three names carried. The three were escalated together at five, 2026-10-27 21:30Z, by Approval Step’s Final Critique 8; State Machine’s Final Critique 7 made the first two six before the ruling.

• The untyped input, counted at six: a caller’s input that a rule compares or records with nothing holding the input to its type, so one build refuses a value outside the type and another records it; each cure refuses the value by a rule. Six: Capability (Operation 61 and Operation 67, a supplied max redemptions held to the whole counts and a supplied ttl to the window lengths), Credential (Operation 78, Operation 79, a supplied expiry instant held to the instants), Session (Operation 54, a supplied session duration held to the window lengths), Selective Disclosure (Operation 37, a supplied disclosure instant held to the instants), Approval Step (Operation 59 and Operation 60, a supplied submission, decision or withdrawal instant held to the instants) and State Machine (Operation 62 and Operation 63, a supplied instantiation or firing instant held to the instants). Now Execution Contract Input 1, in a family for every write beside the Query family: an input carries a value of the type its specification declares for it, and a call carrying another is malformed and answers the action’s refusal for a malformed input. The ten rules were cut; Approval Step’s Term attribution check and State Machine’s Term firing check name the label where they named the cut rules, so a malformed instant answers where it answered.
• The instant left blank, counted at six: a caller’s optional instant resolved from the injected now when the call leaves it blank, a rule each specification writes for itself. Six: Consent (Operation 21, Operation 38), Legal Hold (Operation 9, Operation 18a), Medication Order (Operation 4), Selective Disclosure (Term resolved disclosure instant), Approval Step (Term resolved decision instant, Term resolved submission instant) and State Machine (Term resolved firing instant, Term resolved instantiation instant). The sweep found it uncounted in Medication Order’s three event-instant terms and in Observation (Term resolved recording instant). Now Execution Contract Logic confinement 12: the instant of the act a call records, or the instant a read evaluates against, that the call leaves blank resolves to now, while an instant a call sets for later, such as an expiry, keeps its specification’s meaning. The five rules were cut, and each term for a resolved instant cites the label in place of its clause.
• The canonical form, counted at five: a deployment’s canonicalization of an opaque reference written with no reach, form or place, so a deployment canonicalizing as it writes records what another compares at the seam, and two deployments answer one filter differently while each agrees with itself; each cure canonicalizes at the seam, in a form the deployment owns, before the transition compares or records, and names in a note the references the page’s own Terms make it reach. Five: Session (String 8, its Final Critique 8), Capability (String 8, its Final Critique 7), Party Identity (Capability requirement 6, its Final Critique 7), State Machine (String 7, its Final Critique 6) and Approval Step (String 7, its Final Critique 8); five atoms wrote the rule uncured (Invitation, Medication Order, Observation, Provisional Commitment and Selective Disclosure), and the sweep found a sixth (Message Preference, Identity 11). Now Execution Contract Logic confinement 13: the deployment canonicalizes every reference a call carries at the seam, in a form it owns, before the transition compares or records it. The five cures and their reach notes were cut and the six uncured rules deleted to it; Credential keeps its own form (Capability requirement 13) and cites the label, and Notification’s business caller keeps the form it owns (String 7).

Left the Watch list at the routing and storage sweep, 2026-10-27

The maintainer ruled on 2026-10-27 (16:37Z, Grok concurring) that the unlanded storage failure, the routed instance and now are each stated once in the Execution Contract, under the maintainer’s rule that how the system behaves goes there, and the sweep that landed them removed every flag the two names carried. now was never a Watch list name: forty-one specifications declared it, thirty-three of them as a declaration the section titled Logic Confinement Principle did not make.

• The unlanded storage failure, counted at five: a constituent’s storage-failure, which under Execution Contract Database 1 fails the whole composition action, landed by no rule of the composition that calls it once its rewrite onto the Database contract took the storage arm away, so one build answers a code its signature does not carry and another runs on past the failed write; each cure lands it as a committed nothing: recording-failure carrying intent, or storage-failure where the page names no recording failure or already lands a constituent’s storage-failure so, or the page’s own positioned code. Five: Multi-Party Approval (Action wiring 23), Actor Suspension (Action wiring 90), Attributed Permissions Admin (Action wiring 88, 90, 95), Authenticated Actor (Action wiring 40, attest-failed naming the attestation) and Capability-Backed Sharing (Action wiring 54, 55, storage-failure, as it lands Capability’s at its other two actions); escalated at five, 2026-10-27 14:18Z. Now Execution Contract Constituent failure 1, in the section titled Substrate composition invocation: a constituent’s storage-failure surfaces as the composing action’s storage-failure unless the composition lands its own committed-nothing code. Fourteen rules that only restated it were cut, Attributed Permissions Admin’s three and Capability-Backed Sharing’s four among them, and every rule landing a page’s own committed-nothing code cites the label.
• The routed instance, counted at four: a deployment’s routing written route EVERY call to one database instance, which reads as each call reaching some instance or as every call reaching the same one, so a guarantee read over the records holds on one instance while a deployment splitting the calls answers otherwise — a subject read missing the records another instance holds; each cure routes the calls the guarantee reads to the same database instance. Four: Credential (Capability requirement 33, written by its Final Critique 7), Selective Disclosure (Identity 6, its Final Critique 9), Provenance (Identity 17, its Final Critique 9) and Party Identity (Identity 17, its Final Critique 7); eight atoms write the rule uncured (Approval Step, Consent, Invitation, Medication Order, Message Preference, Observation, Provisional Commitment and State Machine). Now Execution Contract Database 7, in Selective Disclosure’s words: every call goes to the same database instance. The twelve atoms’ copies were cut, with Credential’s Capability requirement 36.

Left the Watch list at the query and order sweep, 2026-10-27

The maintainer ruled on 2026-10-27 that a read’s query is stated once in the Execution Contract, beside the Read family, under the maintainer’s rule that how the system behaves goes there, and the sweep that landed it removed every flag the name carried.

• The range’s ends, counted at four: a read’s range filter with nothing saying whether its ends lie inside it or how two filters combine, so one query answers two sets in two builds; each cure declared the query in a term, a range holding both its ends, a record without the filtered value failing the filter and a combination matching each of its filters — Event Log, Legal Hold, Approval Step and Multi-Party Approval in Term query, with the question open on Consent, Observation, Party Identity, Provenance and State Machine. Now Execution Contract Query 1 through 4, beside which Event Log keeps its own range carrying no upper end.

Left the Watch list at the exception sweep, 2026-10-25

The maintainer ruled on 2026-10-25 (12:55Z) that the unstated exception is cured across the corpus in one unit, with a check that flags the pairs and the exception written into the broader rule, and no grammar change. The sweep that landed it removed every flag the name carried.

• The unstated exception, counted at three: an unconditional rule beside a narrower rule that forbids or replaces the same act in one state, which the grammar reads as two obligations and never as an exception (Principle 5, Hard invariant 20), so each cure writes the state into the first rule — Audit Trail (purge event step 0.6, 0.7, 2.1, 3.1 and 3.6, Per-act critical section 15), Cart (Operation 13) and Recoverable Invocation (reconcile step 2.1, Allowance 5). Now check.py’s W-unstated-exception flags each candidate pair for a reader, and the sweep wrote the narrower rule’s state into the broad rule, as the rule’s IF condition, at every site its reading found: Personal Todo (State 6, Operation 11 through 13), Session (Operation 16), Capability (Operation 26), Notification Fanout (Action wiring 8), Login (Action wiring 34), Capability-Backed Sharing (Reconciliation 9), Chain of Custody (Reconciliation 27), Authenticated Actor (Action wiring 9), Preference-Aware Notification Fanout (Action wiring 15, Reconciliation 24 and 31), Resolve a Person’s Data Rights (Reconciliation 18), Reserve from Pool (Action wiring 20), Actor Suspension (Reconciliation 17), Defensible Retention (Reconciliation 11, Concurrency 24), Multi-Party Approval (Action wiring 35 and Term terminating evaluation), Attributed Permissions Admin (Action wiring 79, through Term consistent attribution), Recoverable Invocation (close step 3.1 and 4.3, reconcile step 3.1) and Audit Trail (Second half 4 and 13, read record step 4.1 through 4.3, verify record step 3.5). The earlier cures that state their exception in the rule’s own words stand as written.

Left the Watch list at the contract sweep, 2026-10-25

The maintainer ruled on 2026-10-25 that two repeated cures are each stated once in the Execution Contract, under the maintainer’s rule that how the system behaves goes there, and the sweep that landed them removed every flag the two carried.

• The lost answer, counted at ten: an action whose answer never reaches its caller, so the caller cannot tell whether the call landed, an arm the Error model did not name; each cure stated what the caller does, reading before any retry or retrying and accepting a second record, or who owns that course — Approval Step, Credential, Event Log, Execute Gated Workflow, Medication Order, Notification Fanout, Party Identity and Verified Repair in an Indeterminate outcome family, Cart in an edge case and Audit Trail in seal now 28, with the same arm routed as open lines in Permissions, Assignment and Capability. Now Execution Contract Error model 1. The rules that only restated it are tombstoned to it, and each page’s own course, such as the record a caller reads before retrying, stays the page’s and cites the label.
• The computation at the seam, counted at four: a rule deciding on a cryptographic computation, which the core may not run (Execution Contract Logic confinement 1), so each specification declared the value as computed at the seam and injected — Actor Identity and Tamper Evidence in Term cryptographic material, Idempotent Reservation and Reserve from Pool in Term parameters digest. Now Execution Contract Logic confinement 8, which Credential’s seam, carrying the same reason for its derivation and check functions, cites too.

The Watch list at v0.65, before the grammar compression

The list as it stood on 2026-10-23 before v0.66 compressed it, under the same title, Watch list: repeated cures, counted until stated once, word for word, with its council reads and its counts. Section 18 restates each live name with its shape, its count and its specifications.

NOTE: A cure the corpus keeps making one specification at a time is counted here until the corpus states it once. A writer who makes a cure an earlier round made flags the cured site with NOTE: watch <name> beside the rule that strained, and the count is the specifications carrying the flag. A name that reaches five specifications goes to the maintainer once, who rules whether the Execution Contract or this document states it; a name stated once leaves the list with its flags. Most pressure is expected to collapse into declared domain terms rather than new grammar. What left the list, the council reads that counted it and the counts it superseded are in the grammar’s history. The rule: flag first, count recurrence, admit nothing until the corpus forces it (Principle 1 through 3).

• host obligations: an atom states its own posture on what the host must bound, such as a maximum length on a string input: a declared cap, a cap the deployment supplies, or silence. Eleven specifications: Actor Identity, Approval Step, Invitation, Medication Order, Notification, Observation, Party Identity, Provisional Commitment, Selective Disclosure, State Machine and Tamper Evidence; the host obligations row in open-questions.md holds the question.
• the state a refusal leaves: a rule that a refused action leaves its record in the live state, written for a refused write, which read alone binds the refusals that answer on a record in another state or on none. Three: Consent (Operation 32), Invitation (Operation 37) and Provisional Commitment (Operation 30).
• condition negation: a condition DOES NOT EQUAL, the absence form, IS NOT IN and MUST NOT cannot carry, such as one refusal answering in two rows of one precedence chain, so the answer alone does not say which guard refused. Three: Approval Step, Audit Trail and State Machine.
• applicability: a rule that wants WHERE, or feature-present gating, written with the applicability carried by its subject or a relative clause. Two: Audit Trail and Recoverable Invocation.
• persistent state: a rule that wants WHILE, written with the duration carried by a term or a phrase. One: Audit Trail.
• cardinality: a need beyond EVERY, EXISTS, EXACTLY ONE and EXACTLY ONE OF. One: Audit Trail.
• satisfaction: what a violation of WITHIN is, compensate or nonconform, where obey is not enough. One: Audit Trail.
• addressable sections: a rule naming a section as its subject or object, where the grammar labels rules and nothing labels a section. One: Recoverable Invocation.
• position scoping: every rule of a family scoped by a condition on position. One: Recoverable Invocation.
• negative capability: an obligation to discard a reply already in hand. One: Recoverable Invocation.
• rule inheritance: one action’s rules restated for another, where the grammar has no inheritance form. One: Recoverable Invocation.
• event versus state: where the distinction matters enough that declared terms alone become awkward. None flagged.
• contradiction: two rules normalizing to X MUST a and X MUST NOT a under identical conditions, nearly free to detect after normalization. None found.
• the wire layer: a term entry’s Projection: line, the one place a lowering token is written down, and the Wire: pinned field beside it, with no naming convention of the layer’s own. Fifty-three documents at council read 101; no finding against the layer itself yet.
• the term entry grammar: a term entry’s fields, Kind, Member of, Field of, Parameter of, Role, Projection: and Wire: pinned, drifting per document on the nothing surface. Nine at council read 12; the superset recurs in every migrated specification.
• a term entry’s kind: Kind: Field carrying stored, derived and pinned values alike, with only prose telling them apart. One: Retention Window.
• the cited line: the Term cited: line written in two shapes this document never states: runs of names each closed by the owner, or a document and what it supplies. Eighteen specifications: four write the first shape, sixteen the second, two both.
• the frozen surface’s edge: a citation across specifications freezes the cited family, and nothing says which families freeze. None standing since council read 13.
• the degenerate bound: an inequality or a bound whose two readings make different rules real. Five: Lease (two), Duplicate Prevention, Retention Window and Provenance.
• the auditor’s vocabulary: the verbs a Generation acceptance section needs, find, reproduce, compute, reconstruct and confirm, richer than the verbs an atom’s own rules use, with nothing owning the split. Not counted.
• a label family recurring across specs outside the standard set: a concept the corpus keeps declaring by heading: Clock semantics (24), Clock dependence (7), Concurrency (25), String (15), Atomic writes (4), Indeterminate outcome (10), Expiry (4), Instance (3), Action wiring (25), Correction (2), Durability (1), Instance start (2), Primitive policy (24), Composition state (24), Verification caching (2). The counts are tools/grace/cites.py --drift’s, and lint.py’s W-stale-census compares them with the corpus on every run.
• the comparator written in English: past, longer than, more than, short of, at most or advance past in a rule, where the condition operators are the whole set a condition may carry. Thirty-nine sites in nine specifications, check.py’s W-comparator: Recoverable Invocation 19, Audit Trail 11, Consent 3, and one each in Lease, Message Preference, Notification, Permissions, Session and Subscription.
• the unadmitted modal: can, could, would or should inside a rule’s subordinate clause, where a declared term or an EXCEEDS would carry the claim. Eleven sites in four specifications, check.py’s W-modal: Recoverable Invocation 7, Capability 2, Audit Trail 1 and Retention Window 1.
• who gates a write: two postures on one question with nothing declaring the fork: Legal Hold requires attribution on every write, and Message Preference accepts the identifier as the whole authorization. Two.
• the modifier class: a declared noun under an undeclared modifier, active, constituent, recorded, with nothing saying whether a modifier owes a declaration. 4,211 of 20,841 noun phrases at council read 105, by tools/grace/nouns.py.
• read-order polarity: every history surface answers a read in ascending order, and Invitation’s Operation 41 answers its matching invitations in no stated order. Two postures.
• the side-channel qualifier: a value riding beside an outcome on its own channel, with rules saying it may not fold into a reason, promote to an outcome or be carried by not-known. One: Audit Trail’s (compensation-window).
• the modal with no temporal scope: MUST saying always and eventually in one breath, so one labelled rule carries a safety claim and a liveness claim and its formal model checks one. One measured instance: Provisional Commitment’s draft Invariant 2.3.

• the window reading: a two-member value set reading a deadline against now with the boundary instant on the lapsed side, declared by each specification for itself, one name carrying two predicates. Three: Provisional Commitment (open

  lapsed), Invitation and Credential (live

  lapsed); both halves of Principle 2 are satisfied.

• the outcome that carries a value: a signature arm carrying a value inside the outcome or beside it, which Closed vocabulary 21 parses as one opaque token. Two: Invitation’s already-resolved(stored terminal) and Audit Trail’s (compensation-window).
• the wire surface: the places a name keeps its code spelling, which no rule enumerates: a term entry’s Projection: line, a formal: provenance line, a code span, a signature block, a fenced event schema, a braced shape inline, a dotted path or a call, the label position and a bounds parenthetical. Nine instances across four sweeps; a finding against the set itself is still missing.
• the external answer that moves: a verification reading a source the atom does not own, such as a registry’s public material or an external anchor’s records, whose answer can change between two calls, while the page’s binding and consistency invariants, or the checks that test them, were written as if it could not; each cure holds them to one answer of the source. Two: Actor Identity (Invariant 2.1, 3.1 and 7.1, Check 3.1 and 3.2) and Tamper Evidence (Invariant 3.1 and 7.1, Check 5.1).
• the host’s state: a rule keeping a verification from the host’s state beside a verification set closed with and nothing else that takes in a value the host injects, so the rule either forbids what the set has the verification consult or restates the set’s own bar; each cure deletes the rule to that bar. Two: Actor Identity (Invariant 6.2) and Tamper Evidence (Invariant 4.2).
• the lost answer: an action whose answer never reaches its caller, so the caller cannot tell whether the call landed, an arm the Execution Contract’s Error model does not name; each cure states in an Indeterminate outcome family what the caller does, reading before any retry or retrying and accepting a second record, or who owns that course. Eight specifications: Approval Step, Credential, Event Log, Execute Gated Workflow, Medication Order, Notification Fanout, Party Identity and Verified Repair.
• the fresh holder value: a composing pattern stating for itself that each take of a Lease carries a holder value no earlier take on the key carried, which Lease Identity 6 asks of every caller and Lease Composition note 5a makes the composing pattern’s to own. Four: Audit Trail (Per-act critical section 1c, Concurrency 1f), Defensible Retention (Concurrency 11), Recoverable Invocation (Term operator run id, Term run id) and Resolve a Person’s Data Rights (Concurrency 4).

Left the Watch list at the repeats sweep, 2026-10-22

The maintainer ruled on 2026-10-22 that the five names the Repeats rule had escalated are each stated once, four in the Execution Contract and one here, and the sweep that landed them removed every flag the five carried. Each had been cured one specification at a time by the Final Critiques before it was stated once.

• The wiring declaration, counted at twelve: the check that has an auditor identify which composing patterns a deployment wired in, which no record carries, moved from the conformance checks to the external checks — Actor Identity, Assignment, Capacity Constraint Enforcement, Legal Hold, Message Preference, Notification, Permissions, Retention Window, Subscription and Tamper Evidence, with Provenance and State Machine beside their external checks. Now Execution Contract Conformance 9.
• The composed erasure, counted at nine: a rule that no record leaves the database, or that no field of one changes, written with no actor beside a non-goal sending a purge or a scrub to a composing pattern — Selective Disclosure, Party Identity, Provisional Commitment, Observation, Capacity Constraint Enforcement, Message Preference, State Machine, Medication Order and Actor Identity, with Consent’s Invariant 8.2 uncured. Now Execution Contract Database 6.
• The admitted effect, counted at five: a rule obliging what an action does, written with a subject that takes in a refused call — Event Log, Duplicate Prevention, Provisional Commitment, Provenance and State Machine, seven atoms writing their admitted calls in one form, and 172 sites behind check.py’s W-unconditional-effect, which the sweep retired. Now Execution Contract Read 4.
• The refusal ban, counted at five: a rule that an action must not refuse, written with no ground — Retention Window, Permissions, Duplicate Prevention and Observation narrowed to their grounds, Medication Order restated as what an action may change, and Legal Hold’s Non-goal 4, Credential’s Non-goal 37 and Approval Step’s Non-goal 13 uncured. Now Execution Contract Refusal 1’s second sentence.
• The category reach, counted at five: a rule whose subject takes in several actions, obliging an outcome one action’s signature does not carry — Session, Capability, Party Identity, Provenance and Medication Order. Now Closed vocabulary 29 (v0.65).

The Watch list before the repeats sweep

The list as it stood on 2026-10-22 before the sweep, under its old title, Watch list — pressure the rewrite may find, flagged and counted, not admitted, word for word. Every entry it names as having left the list, every council read it records and every count the live list has since superseded is here; the live entries are restated one line each in Section 18.

NOTE: During the corpus rewrite, no grammar is added preemptively. A rewriter flags recurring pressure at the site, as NOTE: watch <pressure> beside the rule that strained, and recurrence is the count of flags across specs. Most of these are expected to collapse into declared domain terms rather than new grammar. Watched: persistent state (cases that want WHILE); applicability (cases that want WHERE, or feature-present gating); cardinality (needs beyond EVERY, EXISTS, EXACTLY ONE, EXACTLY ONE OF); condition negation (where DOES NOT EQUAL, the absence form, IS NOT IN and MUST NOT are not enough); event versus state (where the distinction matters enough that terms alone become awkward); contradiction (two rules normalizing to X MUST a and X MUST NOT a under identical conditions — nearly free to detect after normalization, and waiting for its finding); satisfaction (where obey is not enough: what a violation of WITHIN is, compensate or nonconform); addressable sections (a rule that names a section as subject or object — Recoverable Invocation’s journal_fence 2, Allowance 2, Instance start 1, Which closing stands 1 and Invariant 2.6 make section titles the subjects of authority claims, and this document’s value sets line once cited sections by ordinal; the grammar has labels for rules and nothing for sections; execution-contract.md’s rules carry labels since council read 124, and 220 specification citations name them, Execution Contract Logic confinement 7, while 253 cite a section by its title, which lint.py’s X-section-title resolves against the file’s own headings since council read 126). Also watched, and counted at fifty-three: the wire layer (a term entry’s Projection: line, named Projects: before v0.54 — the one place a lowering token is written down, on the nothing surface — joined by Wire: pinned, a second field Personal Todo alone carries; the line was counted in four documents when this entry was written and is in fifty-three at council read 101, the camelCase drift once counted here is gone, three tokens in Multi-Party Approval carry a capital (M-of-N), and the layer has no naming convention of its own. Recurrence is satisfied; a finding against the layer itself is not yet, so Principle 2’s second half is open. Council read 9, council read 10). Also watched: the frozen surface’s edge — a composition freezes an atom’s invariant numbers by citing them, and the corpus has begun citing other families across specs (a non-goal by number, in Tamper Evidence’s WHY before council read 13 removed it). Nothing says which families freeze, and cites.py --into counts citations without knowing which carry a contract (council read 13). Also watched, and counted at six: the total read — a query that refuses nothing, because a malformed input has a correct answer rather than an error (Duplicate Prevention’s check, Lease’s remaining, Actor Identity’s verify, Tamper Evidence’s verify, Subscription’s two queries, which is the first to state the principle, and Invitation’s read, which is the first to state it as a rule — Operation 44: [Read] MUST NOT refuse a filter). The enumeration and both counts are wrong: a mechanical pass over the migrated corpus returns 21 actions across 17 specs whose signature carries no rejection arm, Consent’s Operation 35 states it as a rule a day before Invitation’s, and Permissions and Session state it and are listed nowhere. One shared semantic no spec owns; grammar territory under Principle 9 through 11, with the count moved to open-questions.md until a detector draws the class’s boundary (council read 12, council read 48). Also watched, and counted at nine: the term entry grammar — Kind, Member of, Field of, Parameter of, Role, Projection:, and now Wire: pinned, drifting per document on the nothing surface, with a Field whose values are Members of a value set named by a term. The wire layer the list already counts is a subset of this; the superset recurs in every migrated spec and is contested by its own drift (council read 10, council read 11, council read 12). Also watched, and counted at eighteen: the cited line — the Term cited: line of the category Term category admits, which Closed vocabulary 15 and 16 govern, written in two shapes this document never states. Four specifications write runs of names each closed by the owner, take, expires_at: Lease.; sixteen cite a document and what it supplies, `execution-contract.md` §Logic confinement — the seam; two write both. tools/grace/nouns.py reads the first shape as declarations since council read 112, and nothing reads the second. A cited name is written bare in a rule, as Closed vocabulary 16 resolves it; Hard invariant 28 qualifies labels, not names (council read 113). Also watched, with a live specimen at last: addressable sections — Subscription’s Subscription Id term entry cited a Configuration section no atom shape carries, and no instrument reads a section citation (council read 12). Also watched: the degenerate bound — an inequality or a bound whose two readings make different rules real (Lease’s less, Duplicate Prevention’s window, Retention Window’s deleted Invariant 6.3 and its degenerate duration, Lease’s arrival-term boundary, Provenance’s sequence_range with no declared inclusivity): five instances, and the class wants a name before it wants a form (council read 11). Also watched: the auditor’s vocabulary — the verbs a Generation acceptance section needs (find, reproduce, compute, reconstruct, confirm) are richer than the verbs an atom’s own rules use, and nothing owns the split; the generation run is where an implementer becomes the auditor and this becomes the test language (council read 11). Also watched: a term entry’s Kind carrying stored, derived and pinned alike — Retention Window’s overshoot and active-overdue projections are Kind: Field beside stored fields, with only prose telling them apart; if the wire layer is admitted, Kind wants a projection member (council read 11). Also watched, and counted: a label family recurring across specs outside the standard set: Clock semantics (24), Clock dependence (7), Concurrency (25), String (15), Atomic writes (4), Indeterminate outcome (9), Expiry (4), Instance (3), Action wiring (25), Correction (2), Durability (1), Instance start (2), Primitive policy (24), Composition state (24), Verification caching (2). The Housekeeping / Reconciliation pair is now standard on both sides, and Section 5 declares each meaning once (Standard label 8). The boundary between them is the question the pair was cut on and is worth keeping where a reader meets the counts: does anything await the leg’s output? A leg nothing awaits is Housekeeping — it may report, it may remove, it may not close anything a promise names, and it owes no closure bound. A leg something awaits is Reconciliation, and the promised window is owed because of it. A further leg joins one of the two by answering that question rather than by resembling a member, which is the mistake the pair’s first cut made (council read 64), and the corpus has since used the question to overrule both a leg’s inherited name and three sibling compositions (council read 70). A family used in twenty specs is a concept the corpus keeps re-declaring by heading; the standard set is where it would be declared once. These counts are tools/grace/cites.py --drift’s, and lint.py’s W-stale-census compares every one of them against the corpus on each run — they went stale on arrival three reads running while they were hand-copied, which is the same failure the category set had before check.py derived it (council read 30, council read 33). Counts so far: Recoverable Invocation flags none yet (the pilot predates the list); Audit Trail flags six — applicability, persistent state, event versus state, cardinality, condition negation, satisfaction; Lease flags none. Lease’s two flags were raised by council read 8 and both dissolved the same day, neither into new grammar: temporal quantification (at every instant) was redundant once Section 5 declared what the Invariant family means, and the event in Operation 4’s condition (the arrival term elapses) was a comparison the admitted operators already carry. A flag is a claim that the grammar is short a form, and a claim that survives a rewrite in admitted forms is the only kind that counts. Also watched, and counted at thirty-eight: the comparator written in English rather than through an admitted operator — past, longer than, more than, short of, at most, advance past — where EXCEEDS, DOES NOT EXCEED, EQUALS, DOES NOT EQUAL, EXISTS, IS IN and IS NOT IN are the whole set a condition may carry. Most route through an admitted operator or a declared term and are repairs rather than pressure; the residue that cannot is the class, and Recoverable Invocation’s block longer than the remaining lease, at three sites, is the specimen that wants a term the grammar has no form for. Counted alongside it at ten: the unadmitted modal — can, could, would, should — every instance so far inside a subordinate clause where a declared term or an EXCEEDS would carry the claim. Both detectors were ported from the sweep parser council read 24 arrived with, which found them where this document’s own checker had no rule (tools/grace/check.py, W-comparator and W-modal; twenty-seven of the thirty-eight sit in Recoverable Invocation, and the atoms migrated in v0.35 carry one to four each — the distribution dates the class to before the split discipline matured rather than to the grammar). The fault ontology left this list for the docket at council read 19, on a second instance that disagrees with the first. Still watched, at one instance: who gates a write — Legal Hold requires attribution on every write, Message Preference accepts the identifier as the whole authorization, two postures on one question with nothing declaring the fork (council read 18). Left this list at v0.57, where DOES NOT EXCEED gave both numeric sites the one-arm cure the temporal ones already had (council read 104), and counted at two across two specs before it: the ≥ comparison spelled as a two-arm disjunction — IF x EXCEEDS y OR x EQUALS y THEN …, the same operand pair in both arms — because the condition operator set carries EXCEEDS and EQUALS and nothing between them. The two are Audit Trail’s Invariant 3.1 (sealed_through against an event’s sequence_number) and Recoverable Invocation’s reconcile step 5.1 (intent_age against at_risk_threshold). The count is two and not five: this entry said five for one version, because the hand census matched X EXCEEDS Y OR Y EQUALS none, which is two propositions and no comparison at all. check.py’s W-ge-disjunction now decides it by comparing both arms’ operands, so the number stops depending on who is reading. The class also splits, and the split is the ruling’s real input: a ≥ between instants has a one-arm cure — IF b precedes a THEN refuses exactly the values a ≥ b admits, which is how State Machine’s Operation 20 states its within-instance bound without a disjunction — while a ≥ between numbers or ordinals has none, because inverting it inverts the rule’s polarity rather than its spelling. Both surviving sites are numeric. So the question is not whether the corpus wants an operator but whether two numeric sites earn one, with the temporal sites already cured (council read 29, council read 31). One further census settles the surface half of it: 20 term entries across 10 specs carry ≥ as reader shorthand, and all but one sit in specs whose rule surface carries no disjunction at all — the symbol is established practice on the nothing surface, where Surface 27 says a term entry carries no obligation, and all but absent from the surface that does. Whatever the ruling decides about the two numeric rules, it decides nothing about the 20. That number was hand-counted twice and wrong twice — once at 36 across a spec count of 30 that was really 19, because the counter read every #### heading as a term entry and the adversarial-scenario headings are not — so lint.py’s W-stale-census now decides it, the same cure the family counts took one version earlier (council read 33, council read 34). Also watched, and measured by tools/grace/nouns.py: the modifier class — a declared noun under an undeclared modifier, active, constituent, recorded — 4,211 of 20,841 noun phrases at council read 105, a fifth, up from about 18% at council read 100; it is the quietest growing count the noun reader prints, and nothing yet says whether a modifier owes a declaration (council read 106). Absence-as-nonexistence left this list at v0.52: Term blank was declared word for word in twenty-five specs and defined by the operator it stood beside, and the grammar now declares it once (Earned vocabulary 7). Also watched, and counted at six: the query answering with data rather than a tag, which left this list for the docket at council read 14 and is recorded here only so the two counts agree. Also watched, at two postures: read-order polarity — every history surface in the corpus answers a read in ascending order, and Invitation’s Operation 41 answers every matching invitation and states no order at all, so a caller paging the result gets whatever the database gives twice running (council read 39). Also watched, at one specimen: the side-channel qualifier — Audit Trail’s (compensation-window) rides beside an outcome on its own channel, with rules saying it may not fold into a reason, may not promote to an outcome, and may not be carried by not-known. It is the WHY/UX surface discipline applied at the API layer, and no category owns the form (council read 29). Also watched, at one measured instance: the modal with no temporal scope — MUST says always and eventually in the same breath, so a rule can carry a safety claim and a liveness claim at once and no instrument separates them. Provisional Commitment’s draft Invariant 2.3 did, and the formal layer is what caught it: the model checks the safety half and drops the other silently, which makes the spec and its own .tla disagree about what one labelled rule means. That is the citation-aim class one layer down — a citation between a rule and a model that resolves and does not aim (council read 38). Also watched, and counted at three: the window reading — Provisional Commitment declares open | lapsed, Invitation live | lapsed, Credential live | lapsed again, all three in the same shape for the same comparison with the boundary instant on the lapsed side. None composes another, so none can cite another’s declaration; it is the blank class one layer up, where the shared semantic is a two-member value set rather than a single reading. The third instance also carries the first variation: Credential’s deadline is optional, so its live member covers both no deadline and deadline not reached, and the spec’s own Decisions entry says why a third member would be a distinction no rule consumes. Three is recurrence, and the contested half arrived with it: Invitation’s live requires a deadline and Credential’s live admits an absent one, so the corpus now has one name carrying two predicates across two specs migrated a day apart — the same address for a different building, where open beside live was only two names for one shape. Both halves of Principle 2 are now satisfied for this class (council read 38, council read 40, council read 41). Also watched, and counted at two: the outcome that carries a value — Invitation’s already-resolved(stored terminal), where the refusal names which resolution stands and a bare already-resolved is declared non-conformant, beside Audit Trail’s (compensation-window) riding on its own channel. The two differ in where the value sits — inside the outcome, or beside it — and agree on the thing the grammar has no form for: a signature block’s arms are names, and Closed vocabulary 21 reads the block as the value set of the action’s outcomes, which leaves a parameterized arm parsing as one opaque token. Both specs then need rules to say what the payload must and must not carry, which is the tell that the form is doing work the grammar is not (council read 38). EXISTS carrying several senses left this list at v0.52, split into EXISTS, EQUALS blank and IS IN (Earned vocabulary 6 through 10; council read 41, council read 99). Also watched, and counted at nine: the wire surface — the places a name keeps its code spelling, which no rule enumerates and which four sweeps have discovered one collision at a time. A term entry’s Projection: line and a specification’s formal: provenance line; a code span, which Term code span already names; a signature block; a fenced event schema, which opens { (council read 138, found by a sweep rewriting four of Undo History’s rows); a braced shape inline on a declaration line, the same surface standing somewhere else (council read 140); a dotted path or a call, RetentionWindow.purge_eligible, data.entry_id, place_hold(…); the label position, which Rule shape 7 ties to a heading and every citation freezes; and the parenthetical on a Term bounds: line, audit horizon (audit_trail_retention_policy), where the name and its projection sit side by side (council read 144). Each was found by running into it, and the cure twice was to widen the shape of the test rather than add an entry to the list — a sweep keeps a fenced block unless it is certainly rule text, a gate fires only where the block is certainly wire. Nine instances across four sweeps is recurrence under Principle 2; what is missing is the other half, a finding against the set itself rather than against each member as it is met. The claim the grammar would make is one sentence — these are the surfaces on which a name keeps its projection — and until it makes it, every sweep rediscovers the list and the corpus learns it by damage (council read 143). The refusal order and the failed read left this list on 2026-10-21, each stated once in the Execution Contract by the maintainer’s rulings. An action whose refusal rules can fire together on one call had been ordered one specification at a time, by a declared term listing the rules earliest first beside a rule that the action evaluates no rule of the order before every earlier one has answered no refusal, since the parser infers nothing from rule order (Hard invariant 15), or by a rule answering one refusal only where another does not apply; Final Critiques had made the first cure in twelve specifications, twenty-seven such rules in all. The read sweep moved the failed read, first in every order, into Execution Contract Read 1 through 3; the refusal-order sweep moved the rest into Execution Contract Refusal 1, under which a refuses line lists an action’s refusals in the order they answer (Closed vocabulary 23 and 28), and deleted the sixty-seven rules in twenty-one specifications that only stated an order the line now carries. What stays is each specification’s own: Legal Hold’s Operation 42 and Verified Repair’s Action wiring 74 through 76 order actions that answer one code in more than one place, Approval Step’s Operation 20, Medication Order’s Operation 12 and Party Identity’s Operation 12 hold a refusal’s second place beside the line, Capability’s Operation 65 orders the redemption failures inside an answer rather than any refusal, and State Machine’s table holds a second place no rule states (its open line 2026-10-21-a). Also watched, and counted at twelve: the wiring declaration — the check that has an auditor identify which composing patterns a deployment wired in (each atom’s Composition note 1), which no record carries, so Final Critiques moved it from the conformance checks to the external checks, one atom at a time: Actor Identity, Assignment, Capacity Constraint Enforcement, Legal Hold, Message Preference, Notification, Permissions, Retention Window, Subscription and Tamper Evidence; Provenance, which carried no such check, took the external check beside its Composition note 1, and State Machine beside its three external checks (2026-10-22). Also watched, and counted at nine: the composed erasure — a rule that no record leaves the database, or that no field of one changes, written with no actor, beside a non-goal that sends retention’s purge or privacy law’s scrub to a composing pattern, which Execution Contract Database 4 admits as an action a specification declares. Final Critiques deleted the rule to the atom’s own no-removal or no-change rule and moved the check that cannot tell the lawful act from a violation from the records alone to the external checks: Selective Disclosure (State 8, State 9, Check 3.2), Party Identity (Invariant 1.3, Invariant 7.1, Check 6.1 through 6.3), Provisional Commitment (Invariant 10.2, Check 6.1, Check 6.2), Observation (State 12, Check 4.1), Capacity Constraint Enforcement (Check 3.2, Check 5.1 through 5.4), whose own no-removal and no-change rules already named the atom, so only its checks moved, Message Preference (Invariant 9.2, and Check 1.1’s citation of it), State Machine (State 12 and State 13, deleted to Invariant 10.1 and Invariant 10.2, with no check to move), Medication Order (State 15, deleted to Invariant 14.1, and Check 7.1 and Check 7.2, moved to External check 9) and Actor Identity (Invariant 9.2, deleted to Invariant 9.1, with no check to move). Consent still carries a count that may never fall beside a non-goal sending the bound to Retention Window (2026-10-22). Also watched, and counted at five: the admitted effect — a rule obliging what an action does, written with a subject that takes in a refused call, beside the rules that a refused call writes nothing. Final Critiques held each to the call the action admits: Event Log (State 6, conditioned on the append answering an event id), Duplicate Prevention (Operation 1 through 3 and Invariant 2.3, with a landed record as their subject) Provisional Commitment (Invariant 5.2, deleted to Operation 8, an admitted place hold’s rule), Provenance (Operation 39, held to an admitted entry action so [Originate] answers its chain id alone, and the five admitted terms its effect rules read, each now a call that passes every precondition and whose database writes commit; its Operation 36, Operation 37, Operation 40 and Concurrency 2 still take in a refused call) and State Machine (its admitted instantiate and admitted fire, the calls Operation 4 through 8, Operation 21 through 30 and Invariant 5.2 read, now in the same form; its Operation 38, Operation 47 and Invariant 1.2 still take in a refused call); check.py’s W-unconditional-effect advises on the form whose subject is an action (Hard invariant 16) and does not reach one whose subject is a term, as Invariant 5.2’s was; Execution Contract Read 2 states the like once for a call whose read failed (2026-10-21). Also watched, and counted at three: the state a refusal leaves — a rule that a refused action leaves its record in the live state, written for a refused write and read alone binding the refusals that answer on a record in another state or on none. Final Critiques held it to the refused write (Consent’s Operation 32) or deleted it to the page’s own rule that a refused action leaves the record as the call found it (Provisional Commitment’s Operation 32, to Operation 30, and Invitation’s Operation 39, to Operation 37) (2026-10-22). Also watched, and counted at five: the refusal ban — a rule that an action must not refuse, written with no ground, which read alone keeps the action from every refusal its refuses line declares; under Execution Contract Refusal 1 a refusal does not apply where a rule keeps the action from answering it. Final Critiques narrowed each to the ground the rule meant, MUST NOT refuse a call on the ground that …: Retention Window (Operation 18), Permissions (Operation 6), Duplicate Prevention (Operation 4) and Observation (Operation 38). Medication Order’s Invariant 3.1, Invariant 6.1 and Invariant 6.2 ([Amend] MUST answer a rejection ONLY IF the order’s state IS NOT IN the pre-dispensing states, and the like for [Cancel] and [Discontinue]) kept each action from every refusal on an order in the named states, where they meant the converse guard, and were restated as what the action may change (MUST change an order ONLY IF the order’s state IS IN …). Legal Hold (Non-goal 4), Credential (Non-goal 37) and Approval Step (Non-goal 13) still carry the unqualified form beside actions that declare refusals (2026-10-22). Also watched, and counted at five: the category reach — a rule whose subject is a category of actions (an action, an order action, a declared set of them) obliging an outcome that one member’s signature does not carry, so that read alone it lands an outcome outside that member’s signature block (Closed vocabulary 22). Final Critiques narrowed the category to the members whose signatures carry the outcome: Session (String 7, String 9 and String 10, the length cap naming each write), Capability (the same three), Party Identity (String 7 and String 8, [Read] meeting no length refusal), Provenance (Operation 39, held to an admitted entry action, which leaves out [Originate], whose signature answers a chain id) and Medication Order (String 7 and String 8; Operation 13, Operation 14 and Invariant 9.1, through a held-refusing action and an inactive-refusing action that leave out the actions whose refuses lines carry no such refusal, with Operation 83 for [Amend]) (2026-10-22). Three pressures collapsed into declared domain terms, as this list expected, and were admitted on 2026-10-21 by the maintainer’s ruling, not as grammar (Section 19): shred, grant and provable, each drawn from an explanation the WHYs left by the rewrite onto the Database contract kept repeating — a destruction that leaves every stored version as written, a live authorization a revocation ends beside a record nothing ends, and a fact shown by the records alone rather than by a system’s word. Each is defined once, in glossary.md; the sweep that followed wrote provable where from the records alone and its variants stood and shred where shredding stood, checked every grant against its definition, and deleted the WHYs the terms made unneeded. The rule: flag first, count recurrence, admit nothing until the corpus forces it (Principle 1 through 3).