Defensible Retention — history

The dated record of how Defensible Retention got here, moved out of the spec on 2026-10-20 because a reader does not need it to use the spec today. The spec keeps every section spec-format.md requires and its Deleted: tombstones; everything smaller is in git log -- compositions/defensible-retention.md.

Decisions

Entries that record a round or a migration rather than a turn the pattern took.

2026-11-02 — The audit instance’s purge machinery arrived from Audit Trail (the maintainer’s ruling of 2026-11-01 18:15Z, “Lawful destruction lives in one page”, and his “as recommended” of 21:37Z). See the Decisions entry of this date and Audit Trail’s history; this page’s earlier claim that the audit cascade’s gate was a non-goal (Non-goal 20 through 23) and a forthcoming Hold-Aware Audit Retention pattern’s is withdrawn, the gate being this page’s own.
2026-10-06 — The confirming round: what a reader would promote is cured before the reader runs, and a floor says what it does not promise. Chose: one edge, within the audit horizon, for every horizon judgment a check makes, two allowances and the store’s resolution inside the horizon (Term within the audit horizon, Check 6.4, Term aged-out hold, Term surviving destruction); the invariants that are owed at quiescence saying so, and over acts within the horizon (Invariant 3.1, 3.2, 4.1, 4.2, 8.1, 9.3, Term quiescence); an unverifiable answer over partly purged coverage read as unknown (Check 2.7); every overdue marker alerted on ahead of a run’s first take, a run that cannot enumerate alerting on that, and a declared bound on a run’s enumeration (Reconciliation 43, 44, Capability requirement 61, Term enumeration bound); an alert floor that promises the alert and a window to answer it and nothing of the closing after, and a closure floor that is the first leg’s (Term alert floor, Term closure floor); one audit retention policy over every event of the audit instance, and the composition’s action references kept to the composition (Capability requirement 57, 64); the recovery intent given its fields (Reconciliation 45, Term plan); an invocation id never given twice (Capability requirement 63, Check 5.10); a reference’s field cap under the substrate’s (Capability requirement 62); entry read from a hold placement’s intent (Clock semantics 15). Over: check edges at the bare horizon while the sweep’s stood inside it; invariants stated of every instant the rules themselves break for a while; a floor whose sentence promised a closing its arithmetic could not carry for a backlog; and a stand-in any co-tenant’s short-lived event could supply. Because: the round the consecutive-rounds bar owed returned one foundational finding on five of its first seven Linus passes, and four of the five were lines this Ledger already carried as refining — the method cures a defect in the pass that finds it whatever its class, and a defect left on a Ledger is the next reader’s finding. The models stand: no rule either one reads was changed.
2026-09-14 — Rewritten in GRACE lang v0.40; nothing but language changed except two rejection surfaces the prose misnamed. Chose: Composes, Composition state, Capability requirement, Primitive policy, Identity, Audit arm, Action wiring, Wiring decision and Reconciliation as the wiring surfaces, with Concurrency, Clock semantics and Atomic writes as the edge-case families; the ten invariant numbers unchanged; the acceptance section’s own two tiers carried across as Check and External check. Over: the prose spec. Because: the migration plan; cites.py --into defensible-retention finds nothing in the corpus citing this composition by label, so the rewrite carried no frozen-number risk. No family was minted. Every one of the sixteen is standard or already recurring, and two of them move: Audit arm, which Login minted one migration earlier, reaches two specs and so meets Principle 2’s recurrence half; Reconciliation reaches three and so stands as a promotion candidate under GRACE-lang.md Standard label 4. Identity is the grammar’s own standard family taken for the first time by a composition — thirty specs carry it, all of them atoms that mint ids, and this composition mints none: what it owns is an equality the gate evaluates, which is the same question one layer out.

Migration notes

2026-09-15 — Clock semantics 4, 5 and 16, kept under Clock semantics. Clock semantics 4, Clock semantics 5 and Clock semantics 16 stay under Clock semantics rather than under Clock dependence: the first two are this layer’s uses of the reading and the third says the gate makes none — instances of that family’s question, not statements of it (council read 75).