Medication Order — history

The dated record of how Medication Order got here, moved out of the spec on 2026-10-20 because a reader does not need it to use the spec today. The spec keeps every section spec-format.md requires and its Deleted: tombstones; everything smaller is in git log -- atoms/medication-order.md.

Decisions

Entries that record a taxonomy test rather than a turn the pattern took, and the turn that gave the amend’s two writes one transaction and an order its own critical section, which the Store contract took over on 2026-10-20.

• 2026-09-13 — The EOS strip test: the tag is earned, and it is earned by the graph rather than by the guards. Chose: keep domain: healthcare, and correct the reason atoms/TAXONOMY.md records for it. Over: the standing justification, which names the guards as irreducibly clinical — verification gating dispensing, the verified-dispensed-administered pipeline, controlled-substance attestation. Because: each of those guards is individually derivable from a neutral primitive the corpus already holds. One actor authorizing and a different actor releasing is Approval Step’s shape. A three-stage custody pipeline is Chain of Custody’s. Attributed actions are Actor Identity’s. Twelve of the fourteen invariants here strip clean, and the two that do not — Invariant 3.1 and Invariant 6.1 with Invariant 6.2 — both pivot on one thing: an irreversible release, after which the record describes something in another party’s custody. That pivot is not clinical either; a warehouse has it.

  What does not strip is the graph. Nine states in this topology, with the amendment boundary and the cancel/discontinue split landing on exactly the dispensing edge, is not derivable from neutral primitives — a generic state machine plus a supplied graph is just this atom with the domain moved into a parameter, and the parameter would carry every clinical judgment the graph encodes. The domain hides in the shape, not in the words and not in the rules. The formal layer corroborates: this is the only atom in the migrated set carrying both an Alloy model and a TLA model, and the Alloy model exists because the structure needed checking rather than the timing.

  Three specimens now, three hiding places: Observation hid nothing and was renamed; Party Identity hid it in the field schema and kept both name and no tag; this one hides it in the graph and keeps the tag. The test’s site-census grows by one per specimen, which is the argument for running it on every atom rather than on the ones that look domain-shaped.

• 2026-08-30 — One writer per transition, and no repair leg. Chose: transactional atomicity of the atom’s own store as the only conforming implementation of [Amend]’s two writes, the crash-recovery scan withdrawn; the per-id serialization stated as a critical section — taken before the state check, released on return or death — with a stalled or re-issued invocation re-reading under the critical section and landing an existing rejection; a re-entry arm for a caller whose [Amend] lost its response, retrying only where the original is still amendable; and a deployment-declared clock offset allowance under which the future-dated check on a supplied [Order Instant] runs. Over: a scan “that detects and repairs dangling amendment links on restart” offered as an equal alternative to a transaction; a caller left to retry [Amend] blind, which on an original still [Ordered] creates a second successor; a future-dated refusal decided by comparing the caller’s stamp to the node’s clock with no margin. Because: the scan presumed a visible partial record that Invariant 14.2 says never exists, could relink one dangling shape but not the other — the successor’s dosing parameters, [Amending Actor] and its amendment reason are nowhere in the store, and un-marking the original rewrites a write-once field — and made a second writer for an amendment the caller’s retry could already have landed, branching a chain Invariant 4.1 keeps linear; and a caller’s stamp and the node’s reading are two clocks, so a refusal resting on their comparison needs the margin on the page.