Audit Trail — history

The dated record of how Audit Trail got here, moved out of the spec on 2026-10-20 because a reader does not need it to use the spec today. The spec keeps every section spec-format.md requires and its Deleted: tombstones; everything smaller is in git log -- compositions/audit-trail.md.

Decisions

Entries that record a round, a sweep or a migration rather than a turn the pattern took; entries whose Over is the page as it stood — Retention Window’s acceptance, the Lease atom’s sizing rules cited rather than restated, and the gates and the discipline a reader and a model found the page assuming; and three turns of 2026-10-01 that later turns superseded.

• 2026-11-02 — The purge machinery moved to Defensible Retention (the maintainer’s ruling of 2026-11-01 18:15Z, “Lawful destruction lives in one page”, and his “as recommended” of 21:37Z). The cascade, its worklist, its knobs, the hold gate over it and the scan’s first half left this page for Defensible Retention; the destruction record and its write stayed as Record Destruction. The Decisions entries that dated the moved parts (2026-11-01 the cascade’s purge and its destruction record commit together, 2026-10-21 the erasure mechanism shreds, 2026-10-04 the gated hold placement, 2026-10-02 the hold over an open entry) went with them; the labels the move left behind are tombstones naming the new owner, and the families that moved whole are reserved by the Decisions entry of this date. The earlier attempt of 2026-11-01 19:17Z stopped uncommitted on the 1,500-line line and moved nothing; the maintainer’s 21:37Z ruling committed the extraction over it.
• 2026-10-03 — Retention Window accepts a composing pattern that owns the destruction, and this composition is one. Chose: the ownership cited to the atom’s own rule, the cascade read as what the atom asks of an owner, and one retention per event stated as a rule so that joint enforcement has no sibling to weigh (Capability requirement 9, Composes 9a, the Boundary one WHY). Over: a constituent prescription declined by name while the atom still bound every instance to it. Because: Retention Window re-grounded on Final Critique 7 with the acceptance (its Record divergence 4 through 6, Simultaneous retention 6a). Closes Ledger line 2026-10-03-a.
• 2026-10-03 — The capability list swept once against every constituent’s disclaimers and every deployment obligation. Chose: restart persistence declared for the attestation, retention and seal instances as it was for the log, and cleared with the destruction records in one check (Capability requirement 4a, External check 7); the uncovered mark a tenth state element, derived, and the composition’s own and no longer the lock’s (uncovered mark 1, Concurrency 1b, Check 7.1); the alerting surface a declared capability with a check, and a check on the wiring (Capability requirement 12, External check 17, External check 18). Over: restating at this layer what an atom already binds its host to — id allocation, serialized appends, now at the seam, the registry’s material — which the corpus leaves to the atom’s own contract; a start refusal for the purge sweep, declined on 2026-10-03 and not reopened; and Legal Hold as a knob while the gate’s owner is open. Because: pressure-testing.md’s capability provenance allows a declared obligation only with its verification routed to an external check, and three obligations here had none; Event Log is the one constituent that tells a composer to declare durability, so the other three were read as covered when two disclaim it and one is silent. Closes Ledger lines 2026-10-03-m, o and s.
• 2026-10-03 — Round 25: seven findings; the two clusters that keep returning get a structure instead of a clause. Chose: the outage record a ninth state element, extraction-pending against Condition Register as Recoverable Invocation’s register is, written once and kept for the horizon (outage record 1, 2, 3, Composition-level invariant 1d, 1h, 1g, External check 13); an outage moving a window’s end to closure sum after the outage’s end where that is later, and no longer restarting the whole window (Composition-level invariant 1c, 1e, Term audit edge, Term quiescence); a slice cap, the twentieth knob, so one seal is a known amount of work, with the purge’s seal step landing cascade-failure(seal) where the cap left the event uncovered (slice cap 1, 2, seal now 1a, Term tail position, seal completion bound 1, purge event step 0.12, Instance start 30; Non-goal 13 tombstoned); the range pass-through returning Event Log’s answer and refusal unchanged and its payloads byte-exact (Action wiring 5, 6). Recorded, not cured: restart persistence for the other three stores and the owner of a gated hold placement, Ledger lines 2026-10-03-s and p; [Verify Record] over a stored entry altered after sealing, line t. Over: a third clause on the operational record, after a join bound in round 23 and a lifetime in round 24; a window extended by the outage’s length, which can leave less than the scan needs; and a re-declared seal bound as the only answer to an unbounded slice, the cure of round 24 that this round’s reader walked through to two seals over one range. Because: the outage rules drew a foundational finding in each of three rounds and the sealing lock in two, each cure answering the last report and leaving the shape; a record that decides a verdict is state and is now classified as state, and a bound nobody can set is not a bound. Closure sum is what the scan needs from any instant at which a finding can be examined, and the enumerated schedule from a finding’s creation contains the schedule from an outage’s end. A daily five-second failover no longer defers a residual finding to the horizon. One cure of the last unit was reported and is amended: purge eligible 9 now exempts a held event. Closes Ledger line 2026-10-03-n; narrows line l to the rebuild. The sealing lock’s lease and the outage rules are still in no model and no enumerator. Not changed: 59 refining and 19 rhetorical reports.
• 2026-10-03 — Round 24: six findings, two of them already on the Ledger; the sealing lock is where the lease timing went. Chose: a [Seal Now] stopped by its lease surfacing an alert, with the deployment re-declaring the seal bound, and the growth of the unsealed tail and of the seal store named the deployment’s to bound (seal now 25, 26, 27, Non-goal 13, Non-goal 14); the operational record of outages and hold runs retained for the horizon (Composition-level invariant 1g); a divergence standing past the window read as a residual finding against the erasure mechanism, where the rule had bound the composition to end what it is forbidden to end (Boundary one 5, Check 5.15). Recorded, not cured: a declared surface for the horizon’s two retention periods and a declared driver for the purge, Ledger lines 2026-10-03-j and k; a slice cap and a bounded rebuild, line l. Retention Window’s line a was reported again. Over: a slice cap and a twentieth knob in this pass, a mechanism with no instrument behind it; outage and hold-run records written through [Record Action], which the first half is forbidden to do (Compensation 12) and which a store outage cannot do; and an abandoned-destruction record, which line 2026-08-30-d keeps for its own round. Because: two readers found that one seal must take the whole unsealed tail and one rebuild the whole seal store inside a fixed lease, with nothing to say so when it cannot — the scan had the alert, the re-declaration and the non-goal since rounds 21 and 22, and the seal now has the same three; an auditor’s reading of a late closure turned on a record with no lifetime; and three readers in two rounds read the destruction-failed loop as leaving an event in no standing, which is the finding the deployment owes an answer for, not a state the composition can close. Three cures of round 23 were themselves reported: the count of external checks in two sentences, Per-act critical section 13h against start margin, and read record step 4.7 against Invariant 6.1; each is amended in place. The sealing lock’s lease is in no model and no enumerator. Not changed: 48 refining and 22 rhetorical reports; six seen in both rounds or by two readers are Ledger lines 2026-10-03-m through r.
• 2026-10-03 — Round 23, the first gate after the timing rules went to instruments: ten findings, six cured, four recorded with their owners. Chose: a start margin of two record action bounds and two call pauses for a [Record Action] a leg starts, closure floor carrying it (Term start margin, Per-act critical section 13f, Term closure floor, walkthrough recomputed to 298 seconds); a held event and a step-3 failure that no longer claim the content is readable (Term cascade-failure(step-3), Term event standing); no answer for a Retained event whose data is unreadable at the re-read, and an exit by restoring readability (read record step 4.7, Term store outage); every member of purged events naming a Purged retention, with its check (Invariant 4.5, Check 5.14); an outage join that a run with answering calls ends (Composition-level invariant 1f); a slice reference that carries its count of events, and a record set match judged on that count alone (seal coverage 14, Capability requirement 6a, 6b). Recorded, not cured, as Ledger lines 2026-10-03-a through d: Retention Window’s declined rule, the undeclared unreadable answer, the per-seal mechanism carrier — each an obligation whose owner is not this page — and content lost with no record; the destruction-failed terminus stays on line 2026-08-30-d. Over: threading the leg’s lease into [Record Action], which gives the reconciliation path an action of its own; a delegation-issued record before step 3; and curing ownership findings here before their owners accept them. Because: a record action that stalls takes its section up to one bound after its reading and writes for one bound more, so one started on the old margin could append after the leg’s lease had passed to the next run, which had by then written the same compensation — two for one orphan; the enumerator had transcribed Per-act critical section 13h as a premise and now derives it, and its twin on the old margin breaches on every second-half and third-half leg. A sequence-number range says nothing of how many events landed in it (Event Log Sequence gap 1), so two hosts judged one faithful presentation differently. The round’s shape is the measurement: one of ten findings is lease timing, where rounds 19 to 22 returned little else, and the adversarial pass recomputed closure sum, closure spend and the walkthrough and found them sound. audit-trail.tla already checks Invariant 4.5’s order. Not changed: 47 refining and 14 rhetorical reports, five of them seen by two readers and routed as Ledger lines 2026-10-03-e through i, the rest listed in the gate record.
• 2026-10-02 — The generic lease sizing rules are the Lease atom’s; the closure arithmetic stays here. Chose: the call pause bound, the live reading, the no-answer arm, the start margin and the share-of-budget rule cited from the Lease atom’s Sizing 1 through 9 (Per-act critical section 1d), the page keeping its own bounds, closure sum, closure floor, work bound and measured enumeration. Over: moving the closure arithmetic into the atom, and over leaving the generic rules restated here. Because: the generic rules are the same for any pattern whose writes carry no fence, and are now gated once at the atom; the closure arithmetic prices this page’s own work, which Non-goal 10 of the atom forbids it to choose.
• 2026-10-02 — Round 22 on a frozen tree: five findings; the unreadable payload becomes an outage, the hold restart needs an observed hold, and the growth of the enumerated population is a named non-goal. Chose: a standing unreadable payload read as an outage of Event Log, so the liveness arms suspend, the window restarts at its end and the deployment records it, with the deployment owning the clearing (Term store outage, Second half 18); a hold-release restart only for an entry a run landed under-legal-hold and a later run found free, with both instants on the operational record and an entry no run saw held left alone (Composition-level invariant 1e, 1h, 1i, External check 13); a miss at the invocation’s own keys under its live critical section the answer, without a rebuild (Composition state 2); the growth of the enumerated population a named non-goal owned by the deployment, which rotates the audit instance (Non-goal 12); a retention policy change for the two reserved references held until the horizon checks pass against it (retention policy 7); and three repeated refining findings amended in place — the audit edge capped at the horizon, Invariant 6.2 scoped to answering reads, the duplicate erasure mechanism label renamed 6c. Over: a run that halts compensation with nothing to end it, a restart that needs a memory no rule owns, a rebuild on every write of a new event, and a start check that no later change to the policy can fail. Because: two readers reached the halt and two the growth, and the hold restart was found for the fourth round running; each now names its owner or its instants. Not changed: the refining and rhetorical findings not named, held for the round’s close. Not cured: the closure arithmetic as a whole, which belongs to the Lease atom’s sizing rule (its open line 2026-09-10-a).
• 2026-10-02 — Round 21 on a frozen tree: five findings, each cured at the reader and its owner. Chose: a run stopped by a refusal that left any committed state, an orphan or an unretained event, so a retention-store outage mints one unretained event and not one per leg (Invariant 1.12); a second half that writes no compensation in a run whose enumeration returns an unreadable payload no destruction record names, with the erasure mechanism owning that unreadable means destroyed (Second half 18, erasure mechanism 6c); a blocking take reading as no answer only past its arrival term and the call pause bound (Term no answer); a run whose enumerations outgrow the start-time measurement raising the re-declaration alert before a leg skips, and a failing re-run leaving the instance accepting record actions under an alert (Per-act critical section 13e, 13i); an outage restart that stops at the horizon, past which the finding is reported (Composition-level invariant 1c); and three repeated refining findings amended in place, not added to (Compensation 2, purge event 3a, Check 5.1). Over: reading an orphan as any unbound attestation, a blocking take counted against the two-second pause bound, a running instance that refuses record actions when its arithmetic fails, and a window the outage may carry past the horizon. Because: the readers of round 21 agreed on the two findings two of them reached, and the one pass that found none read a page whose capability provenance and past-horizon classification held; the cures name the owner where the page is not the owner. Not changed: the refining and rhetorical findings not named, held for the round’s close.
• 2026-10-02 — Round 20 on a frozen tree: eight cures, each carried to every reader of the fact it changed. Chose: the hold-release restart moved out of the outage rule into its own invariant with a recorded instant, read by the audit edge, quiescence and External check 13 (Composition-level invariant 1c, 1e, Term audit edge, Term quiescence, External check 13); the rule joining intermittent failures into one outage recorded with the outages (Composition-level invariant 1d); a retention policy whose answer for the two reserved references does not vary with the payload, so the horizon has one value (retention policy 6, Instance start 21); the third half’s work bound counting two enumerations and the start check three in all (Term work bound, Instance start 18, walkthrough recomputed to 254 seconds); an alert for a leg stopped by an expired lease (Per-act critical section 13e); a probe that waits only for the first record action to return (Invariant 1.11); a purged event’s attribution read through the pair alone, with the checks scoped to a quiescent cascade (read record step 4.4a, 4.4f, Check 7.5, Check 7.6); the erasure outcome landing under the event id and not on the seal’s shared set, with the destruction record defined (erasure outcomes 4, Term destruction record). Over: a restart clause left under the outage antecedent, a window counted from an instant no record holds, one enumeration for a half that reads two stores under its lease, and an outcome written into the set the lost-membership guard protects. Because: three readers on one tree found the same defects from the round before — the hold-release restart twice, the horizon twice — which says the cure had reached its rule and not its readers; each cure here names the other readers of the changed fact. Not changed: the refining and rhetorical findings of the round, held for the round’s close.
• 2026-10-02 — Round 19 under the finding-kind template: ten cures, one record. Chose: a no-answer arm on [Purge Event]’s step-0 read (seal) and step-0½ read (step-1), so neither lands not-known or retention-unresolved (purge event step 0.11, purge event step 0½.6); an expiry gate on the serialization of Concurrency 3a, since a re-drive runs under a leg’s longer lease and a stalled cascade could write over a membership taken after its serialization had passed (Concurrency 3c); a seal term in the closure floor under per-event cadence, the two nested [Record Action] calls each sealing inside the leg’s lease; the hold-release window counted from the first run that reads no active hold, not from a release instant a caller may have backdated (First half 11); a live member of a partly-purged seal read under Invariant 5.4 as discharged by the destruction record, so Check 3.3 and Check 5.10 no longer ask for a seal no verifier can re-present (Invariant 5.4, Check 3.3); the four constituent instances dedicated to this composition (Composes 4a); an orphan’s beyond-horizon report allowed beside its live intent (Compensation 11); a hold’s release restarting the window in the one rule every reader of the window takes it from (Composition-level invariant 1c); the closure floor pricing three sealing record actions at twice the seal bound; one rule that sweeps the no-answer arm over the rest of [Purge Event]’s reads (purge event 8). Recorded, not cured: [Read Record]’s unsealed tail is the derived index’s reading and may lag a seal whose coverage entry failed to land until the next [Seal Now] rebuild (Composition state 5, seal now 13); [Verify Record] locates the covering seal through the coverage ranges with rebuild-on-miss (Composition state 2), and a presentation short of the seal’s record set surfaces failed-verification(seal-record-set-mismatch) as a finding about what was presented (verify record step 5.2), so a caller who verifies in that window is told the presentation is short, not that the record was altered; owner: the deployment’s alert on a refused coverage write (seal now 24). Over: a seal-store read on every read of an unsealed event, a hold-release instant taken from the Legal Hold store as stated, and a leg-owned serialization separate from the cascade’s. Because: each cure closes a state the page permitted and a model or a rule could reach; the record states a behavior the page already declared for derived indexes, and a cure would add a seal-store read to every read of an unsealed event. Not changed: the refining and rhetorical findings of the round, held for the round’s close.
• 2026-10-01 — The page declares the gates and arms a fresh reader found it assuming. Chose: the legal hold read under the cascade’s own section before step 0 with placement serialized against it (purge event 5c, Capability requirement 7), a held cascade left open and uncounted until release (First half 9, First half 10); a cascade-failure(in-flight) arm for a held section; the third half placing under the policy step 4 would have resolved (Third half 15); [Seal Now] rebuilding the ranges before it reads sealed through, the slice reference encoding both bounds (seal now 13, seal coverage 13); a death-detected host bounding its live holders (Per-act critical section 10c, 10d, External check 10); [Verify Record] re-reading retention before returning a non-verified outcome (verify record 5, 6). Over: leaving each to the implementation and to the models, each of which supplied it. Because: a third fresh reader’s gate found seven places where two implementations of the page diverge and the page was silent; the models carry none of the seven and say so in their NOT MODELED lists. Ledger 2026-08-30-b and 2026-08-30-d stay open.
• 2026-10-01 — A bound covers every holder, a retry has a terminus, and the constituent invariants are read over what is not destroyed. Chose: the death-detected bound on a scan leg as well as an invocation, with a timed-out call landing the step’s storage-failure arm (Per-act critical section 10c, Per-act critical section 10d, Per-act critical section 10e); one attempt per finding per run for a refused compensating record action, retried next run and alerted on at the second (Third half 11, Compensation 15, Compensation 16); Invariant 5.1 and Check 3.3 read over events not yet purged, with the destruction record discharging the proof and record-set invariants for a purged one (Invariant 5.4); a hold being an active one. Over: an in-run retry loop with no end, a bound on invocations alone, and a sentence claiming every atom invariant over destroyed content. Because: a fourth fresh reader’s gate found each of the four, two of them opened by the previous pass’s own cures. Ledger 2026-08-30-b and 2026-08-30-d stay open.
• 2026-10-01 — The second half re-derives its predicate under the section, a hold is a standing, and the sealing lock is shared and reports death. Chose: the second half re-reading the binding set for the orphan’s attestation id under the critical section before it writes (Second half 16); a held event standing beside retained and lawfully destroyed, with the audit checks exempting it (Invariant 8.1a, Invariant 8.2a, Check 5.1, Check 7.5, Check 7.6) and quiescence left as it was; the sealing lock shared by every process and telling its next taker whether the last holder died, the rebuild of the seal coverage ranges keyed on that and on a refused coverage write (Concurrency 1a, Concurrency 1b, seal now 13, External check 11). Over: pre-checking only the compensation marker, a quiescence that no hold-bearing instance could reach, and a rebuild triggered by this process’s own restart alone. Because: a fifth fresh reader’s gate found each, two of them opened by the cures of the pass before; the self-gate before the reader also closed a section-kind start check, a key namespace and a third-half policy refusal. Ledger 2026-08-30-b and 2026-08-30-d stay open.
• 2026-10-01 — The seal coverage rebuild is keyed on a mark every process sees, and a leg’s lease counts its own pause. Chose: [Seal Now] setting an uncovered mark on the shared sealing lock before it seals and clearing it only once the coverage entry has landed or the seal is known to have written nothing, the next taker rebuilding when the mark stands or is unknown (seal now 13, 15, 16, Concurrency 1b); the longest pause between a lease check and its write counted into compensation closure latency, as it is into both completion bounds (compensation closure latency 2). Over: a rebuild keyed on a process’s own restart or flag, and a leg bound sized from observed closure time. Because: a sixth fresh reader’s gate found a second process could seal a slice the first had sealed but not covered, and a stalled leg could write after its lease passed to the next run. Ledger 2026-08-30-b and 2026-08-30-d stay open.
• 2026-09-30 — The page states the discipline its model had to supply. Chose: the pause between a lease check and its write inside both completion bounds; a scan leg’s lease at compensation closure latency, a leg that stops writing at expiry; the cascade taking its section before step 0 and adopting what landed at steps 2 and 3; a record action’s step 3 reading compensated attestations under the section it takes after the attestation; the liveness arithmetic budgeting one dead scan run; the first half writing no intent; the audit log’s durability a declared capability requirement. Over: leaving each to the model alone. Because: a fresh reader’s gate found that the model supplied each and the page said none, and an implementation built from the page alone breaks Invariant 2.4a, Second half 13 or Invariant 1.4; Event Log’s own Durability 4 requires the last. Closes the 2026-08-30-c ledger line.
• 2026-09-11 — Rewritten in GRACE lang v0.31; nothing but language changed. Chose: labelled rules in fenced blocks, rationale under WHY:, terms declared where they are used, the Ledger and the invariant numbers unchanged; the instance-start conditions given one owner (the section titled Instance start), the class boundary and the scan’s halves cited by label from every site that used to restate them. Over: the prose spec. Because: the migration plan — the corpus is being rewritten in the language, and a spec whose obligations have one owner each is what the reverse diff reads.

Migration notes

• 2026-09-15 — The reconciliation scan given its own section. The scan sat inside the wiring decision, under a label family of its own, until the heading standard gave the leg its address (council read 83).