Immutable Ledger with Selective Disclosure — history

The dated record of how Immutable Ledger with Selective Disclosure, named Immutable Transaction Ledger with Selective Disclosure until 2026-10-28, got here, moved out of the spec on 2026-10-21 because a reader does not need it to use the spec today. The spec keeps every section spec-format.md requires and its Deleted: tombstones; everything smaller is in git log --follow -- compositions/immutable-ledger.md.

Decisions

Entries that record a round, the treatment ahead of one, a model run or a migration rather than a turn the pattern took.

• 2026-10-19 — Final Critique 16 clean on the cured text; what the page waits on is 2026-10-19-e, not another round. Chose: the round clean on three counted passes — six foundational reports, none standing, once the count was adjudicated a second time by a reader blind to what it would decide; the four refining findings left routed rather than cured in place, so the cleared text stands; the page kept partially resolved, since a foundational open line blocks grounding whatever a round returns. Over: curing Check 1.2’s list and its WHY in place (2026-10-19-g), whose wording belongs beside 2026-10-19-e’s cure; and another round on this text while 2026-10-19-e is open, which would read the same text and could not ground it. Because: the round was the first to read the formal-model commit’s two load-bearing cures, the dead run Capability requirement 33 now budgets and the aged edge’s second allowance and run bound, and found nothing they broke; what stands between the page and grounding is a false closing no operator corrects, and its cure turns on a question no rule here decides — whether the deployment declares how long its accounting store can still apply a disclosure write, so that an operator’s abandonment waits it out and the correction is charged to the horizon, or the case is named a non-goal (Recoverable Invocation resolve 20a leaves the store’s quiet to the operator’s judgment).
• 2026-10-19 — The formal model re-derived over what is this page’s own; the horizon budgets a dead run, and the page waits on a round for the cures. Chose: three models against Recoverable Invocation’s contracts, which that page’s model proves — the binding, the binding index with the horizon, the reading of two stores — in place of the model of 2026-06-10 and its twin, which modelled a protocol that is now that page’s (2026-08-29-a); Capability requirement 33 charged two cadences and three runs, as Recoverable Invocation Instance start 4 counts a dead sweep run, once the rebuild model lost an outcome’s binding, unalerted, to one run that died before its write at the least horizon the page admitted; the aged edge moved by a second allowance and the run bound, its in-range comparison strict, once the reconcile model accused a falsely closed record of a write outside the composition (2026-10-09-m). Over: the models landed with their findings left as open lines, which would have verified a page that does not exist; and the edge’s one-allowance form, which holds only where an intent’s purge is judged on the clock that placed its deadline, which the substrate does not promise across nodes. Because: a vote-yes page writes its model’s findings back into the English (the conflict protocol in pressure-testing.md), and a load-bearing edit returns a grounded page to partially resolved until a round reads it.
• 2026-10-19 — Grounded (English) again on Final Critique 15, the council’s first round on the page; the model, not another round, is what it owes next. Chose: the round clean on three counted passes — six foundational reports, none standing, once the count was adjudicated a second time by a reader blind to what it would decide; the three refining findings left routed rather than cured in place, so no rule changed and the cleared text is the text that stands. Over: another round before the formal model, which would read the same text again while the model the vote asks for is still owed (2026-08-29-a); and the redeclared Term disclosure instant rewritten in place, a load-bearing touch to a Term the round had just cleared. Because: the round read the page, unchanged since its fourteenth gate, against Recoverable Invocation as that page’s rounds 13 through 17 cured it, and found nothing those cures broke here; a vote-yes page whose own claims are in no model gets the model before any further round.
• 2026-10-09 — Grounded (English) on Final Critique 14, on one sample, the formal layer pending. Chose: the sixth round on frozen text as the clearance gate — zero foundational once its one report was adjudicated a second time, blind to what the count would decide; the formal-layer vote recorded yes, the model owed its re-derivation; refining findings cured in place where the cure adds no rule, the rest routed. Over: a seventh round before grounding. Because: the method grounds a page on a clean round and owes the second as its first scheduled rescan; the older tail ran 4, 3, 4, 3, 2 and then 0. Recoverable Invocation, which this page binds, stays draft with its own round owed, and a change there is a touch here.
• 2026-10-09 — The confirming round: the pre-registered rule counted two, and rounds continue. Chose: the count by the line written before the treatment, every foundational finding adjudicated a second time, blind to the threshold, before it was counted; the accounting store’s read lag, which the treatment had stated as a cost, owned instead by a capability (Capability requirement 35). Over: partially resolved as the resting state, which three older findings would have fixed. Because: two of the round’s three foundational findings sat in older text and one in round four’s own cure, and the older tail fell for the first time in five rounds: 4, 3, 4, 3, 2.
• 2026-10-08 — The treatment before the confirming round: the guard given the invocation’s reading, the outcome position its invocation, and the deciding count fixed in advance. Chose: Selective Disclosure’s seam injected with the invocation’s own reading, so the not-in-future guard meets equal instants (Capability requirement 25); the invocation id carried on recording-failure carrying outcome, so a caller finds its own outcome and not a record of its key (Action wiring 68); the stopping rule in the Ledger ahead of the drain (2026-10-08-j). Over: one clock authority across two seams, which a read on two nodes inside the allowance still refused as the caller’s fault; the accounting query by key, which an earlier disclosure of the same key can answer. Because: four rounds left the older tail flat at four, three, four and three, and a drain is worth running only if the round after it is counted by a rule written before it.
• 2026-10-08 — The fourth round on frozen text: a disclosure reaches its recipient once its outcome event lands. Chose: Capability requirement 34 keyed to the outcome event, which the call’s answer shows or [Verify Ledger] answering bound shows once the sweep has recovered the disclosure; the disclosure instant stated as the admission’s, ahead of the transmission. Over: the call’s answer alone, which strands every recovered disclosure; and Selective Disclosure’s own order, transmission first, which leaves an abandoned invocation’s transmitted data unaccounted with no re-run lawful. Because: a yielded disclosure ends recovered or abandoned, each order lost one of the two, and the outcome event is where both end.
• 2026-10-08 — The third round on frozen text: nine, eight here, and two cures by deletion. Chose: Wiring decision 1 tombstoned to Invariant 1.3, which already said what was true of it; the accounting-horizon cover reduced to the ledger’s own policy, the accounting store never bounded; both horizon conditions written in the strict form and priced with the run bound, the allowance and the settling period; an alert for a false closing and a fixed read order for the reconciliation; transmission only after the recording call answers. Over: qualifying the wiring decision’s claim with every state that broke it. Because: the round found three defects in the two rounds’ own cures, and where a rule was broken by the states the page calls lawful the rule that held them already existed.
• 2026-10-07 — The second round on frozen text: three foundational, one here. Chose: a refusal of its own for an index that gave no answer, since the index alone tells a purged disclosure from a gap (Action wiring 64 through 66; Reconciliation 31); the accountability proof’s contents stated per verdict; a run’s alert for an outcome the accounting store does not carry (Reconciliation 32). Over: widening store-unavailable to mean two stores. Because: the round’s first and third passes each reached the same unowned read from different sides, and it had sat in this Ledger as a hardening line since the round before — a routed line a cold reader cannot see is found again, and promoted.
• 2026-10-07 — The first round on frozen text: nine foundational, cured after the third pass reported. Chose: a binding that only a purge makes immutable, so a rebuild may move a live one to the lower sequence (Composition state 5); a retention record owed at the substrate’s quiescence and not at the append (Invariant 3.4, Check 3.3); a bound on the reconciliation run and a horizon that exceeds a cadence and two runs (Capability requirement 32, 33); one refusal per call in a fixed order, with a read that concluded nothing ahead of the verdict it would have fed (Primitive policy 19 through 21); the escalated verdict behind the purged one (Verdict 4), and Check 1.9 tombstoned to Check 1.2, which already read the same records. Over: a second check for the unsettled escalation, written the unit before and found to overlap the first and to fail a conforming deployment whose records were placed late. Because: three passes that read one text returned 5, 3 and 2, and two of the nine were in rules a day old.
• 2026-10-07 — The bound pair’s first three passes: fourteen foundational findings, each cured where it was found. Chose: an operator’s obligation to settle every escalation before its intent’s horizon edge, with a settling period charged to retention, over a second index of escalated closings (Capability requirement 29 and 31); an orphan defined against the binding as well as the outcome, so no clock decides a finding (Term orphan record); a failure arm for every read this page makes, each naming the store that gave no answer, and for [Record Entry] a code that is never retried where the entry may be in the ledger — the substrate’s step-3 failure included, since that page lands it for an append that may yet land (Primitive policy 16; Audit arm 26 through 30; Action wiring 57 through 60; Reconciliation 28 through 30); a ledger verification that counts from the enumeration on every call, the index supplying only what a destroyed payload once named (Action wiring 29; Action wiring 31 and 32 tombstoned); a reissue that answers a purged disclosure as purged (Action wiring 62); the recovery identity refused as a ledger entry’s actor (Primitive policy 18). Over: reading a failed read as empty, the index as a verdict, and an escalation as an end state. Because: three cold passes over this page with the protocol as its constituent returned 3, 5 and 6 — and the adversarial pass found two defects in rules the first two passes’ cures had written, which is why the cured text is owed a round of its own.
• 2026-09-24 — Rewritten in GRACE lang v0.61; twenty-three of twenty-five open Ledger lines closed by the rules that now own them. Chose: Composes, Composition state, Capability requirement — which takes the prose’s Configuration whole, the per-disclosure section renamed the disclosure exclusion because the grammar owns the noun section — Primitive policy, Audit arm, Action wiring, Wiring decision and Reconciliation as the surfaces, with the binding and authenticity verdicts as their own Verdict family; invariant numbers 1 through 4 and 6 unchanged, Invariant 5 tombstoned to Composes 5; the record checks renumbered as Conformance checks naming the rule each tests; the edge cases split into Non-goals and four Edge cases families. Choices the page left open, each decided by a standing rule: produced by this composition defined as paired by the reconciliation’s predicate, with the ledger namespace and the disclosure write reserved to the composition and an unpaired record a write-ownership finding (2026-08-26-e, 2026-08-30-g); a declared [Reissue Bundle] rather than a dropped claim (2026-08-30-f — as simple as possible without losing fidelity: the prose leaned on a recovery path no surface declared); an entry unsealed or purged at bundle construction marked in the bundle per entry rather than refused (2026-08-26-i, 2026-08-30-d, -e — make all things mean one thing: the purge-between-check-and-bundle race already answered this way); blank refused with Selective Disclosure’s own rule at step one (2026-08-30-c); binding-duplicate named as a fifth verdict (2026-08-30-a); and the constituent bars cited rather than counted (2026-08-26-f). Over: the prose’s step lists, a lettered case list that skipped a letter, and a recovery path the page promised and the surface lacked. Because: the rules state each landing once; the two formal lines stay open because the model, not the page, is what they owe.

Ledger

The gate records the Ledger’s last gate: line carried behind its latest until 2026-10-21, newest first:

• 2026-10-19 — Final Critique 15, the council’s first round on the page, reading it unchanged since its fourteenth gate against Recoverable Invocation as that page’s rounds 13 through 17 cured it, three fresh readers on free models (GRID Nemotron 3 Ultra, EOS LongCat 2.5 Preview, Linus MiMo V2.6 Flash), each handed only the round’s reading set, three passes on one text (frozen at 6ac02aa); the round rests on three counted passes — foundational count 0 after triage (6 reports, 1 sent down to refining, 5 rejected on the text), the count adjudicated a second time by a reader blind to what it would decide, which placed none of the round’s 16 reports foundational; 7 refining reports, 3 rhetorical reports; clean, the second clean round running
• 2026-10-09 — Final Critique 14, fresh reader, three passes on one text — 0 foundational (one reported, rejected by a second triage blind to what it would decide), 31 refining reports, 20 rhetorical reports; one sample