Capability-Backed Sharing — history

The dated record of how Capability-Backed Sharing got here, moved out of the spec on 2026-10-20 because a reader does not need it to use the spec today. The spec keeps every section spec-format.md requires and its Deleted: tombstones; everything smaller is in git log -- compositions/capability-backed-sharing.md.

Decisions

Entries that record a migration rather than a turn the pattern took.

• 2026-09-23 — Rewritten in GRACE lang v0.61; twenty-four of twenty-five open Ledger lines closed by the rules that now own them. Chose: Composes, Composition state, Capability requirement — which takes the prose’s Configuration and Logic confinement both — Primitive policy, Audit arm, Action wiring, Wiring decision and Reconciliation as the surfaces; invariant numbers 1 through 4 and 6 unchanged, Invariant 5 tombstoned to Composes 5; the checks renumbered Check 1.1 through Check 6.7, which ends the prose’s missing check 6 (2026-08-29-a); Non-goals and Edge cases split, with Atomic writes, Clock semantics and Concurrency under the second; the Recipient term entry renamed Intended Recipient, since Selective Disclosure declares recipient and this page’s concept is the one the allocator declared. The lines’ fixes, as prescribed: the substrate’s step carried on every transcription (2026-08-27-g); a diverged index entry rebuilt before proceeding and an irreconcilable one refused (2026-08-27-i, 2026-08-29-h); the disclosure reading named as what stamps the marker and the event (2026-08-27-j); verification presented with the original payload, modulo the unsealed tail (2026-08-27-k, 2026-08-29-e); the substrate’s own partials named as the substrate’s (2026-08-27-l); the grammar stated once, read both ways (2026-08-27-m); the authorization event carrying the effective ttl, not an expiry instant no step read (2026-08-29-b); the outcome-position refusal naming the orphan (2026-08-29-d); compensation lateness measured between two substrate recording instants (2026-08-29-f); the past-horizon rebuild claim withdrawn (2026-08-29-g); [Sharing Disclosures]’ invalid-query arm (2026-08-29-i); the descriptor capped at this layer, caller fault split from deployment fault (2026-08-29-j); concurrency weakened to at most one (2026-08-29-l); revocation’s inputs listed and revocation deliberately ungated by provenance, since revocation is the unattested orphan’s recovery (2026-08-29-m); the Summary’s permanently narrowed, acronyms glossed at first use, Invariant 1 cited to Capability’s contract rather than its model, and the history narration moved out of the rules (2026-08-27-n through q, 2026-08-29-k, p, q). Over: the prose spec. Because: the migration plan, and the standing rule that a migration closes a line only where a rule now owns what the line asked for. The model line stays open (2026-08-29-r). The rewrite also removed a contradiction the prose carried against itself — its wiring-decision section still put the redemption inside the transaction that its own step 4 and edge cases said it could not be in; Wiring decision 4 and Atomic writes 2 now say it once.