Login — history

The dated record of how Login got here, moved out of the spec on 2026-10-21 because a reader does not need it to use the spec today. The spec keeps every section spec-format.md requires and its Deleted: tombstones; everything smaller is in git log -- compositions/login.md.

Decisions

Entries that record a migration, a family placement, a restoration or a reading of a gate’s open lines rather than a turn the pattern took.

• 2026-09-14 — Rewritten in GRACE lang v0.40; nothing but language changed. Chose: Composes, Composition state, Capability requirement, Primitive policy, Audit arm, Action wiring, Wiring decision, Reconciliation as the surfaces, the six invariant numbers unchanged, and an acceptance section distributed from the checks the prose already named. Over: the prose spec. Because: the migration plan; nothing in the corpus cites this composition by label. No preservation claim was collapsed — this is the first composition of the epoch carrying none, because every invariant here already emerges and the constituents’ guarantees were carried as citations rather than as invariants of their own. The three tombstones it does carry are re-homings inside the spec rather than collapses: Invariant 4.1 to Composition state 10, Non-goal 3 to Wiring decision 3, Non-goal 14 to Invariant 2.2.
• 2026-09-14 — Reconciliation reaches recurrence in consecutive migrations, and the decision not to merge it with Eviction holds. Chose: to take Reconciliation for the issuance-reconciliation sweep. Over: minting a third name, or folding it into Composition state. Because: Authenticated Actor minted it one migration earlier for the orphaned-credential leg, and this sweep is the same family rather than the same shape: both run outside any invocation, both report or close rather than serve a caller, both owe an age edge. Idempotent Reservation’s Eviction shares the shape and remains separate for the reason council read 61 stated — it evicts where these report, and the difference decides whether a liveness bound is owed. Two consecutive specs is Principle 2’s recurrence bar met for Reconciliation; Eviction stays at one and stays flagged (council read 62).
• 2026-09-27 — What the rewrite dropped, restored. Chose: the arms and names the prose spec carried and the 2026-09-14 rewrite left out: logout relaying Session’s already-terminal, storage-failure and invalid-request (Action wiring 27 through 29); the two named stages login’s storage-failure lands at before a session exists (Action wiring 30, 31); the cascade’s initiation data, its storage-failure answer, its join key in the revoke reason, its not-found count and its failure and not-found events (Action wiring 32 through 36, the revocation tally, the cascade events); the sweep’s stored-reason choice of revocation-family member, its orphan reason, its abandon-and-re-run and its recovery intent (Reconciliation 15 through 19). One rule is new rather than restored: the sweep writes a map write failure’s pair into both maps (Reconciliation 20), because Check 2.3 waits on that backfill and no rule wrote it. Over: a rewrite that claimed nothing but language changed. Because: a cold regeneration of the demo met each as a point the page left undecided, and each was decided in the prose spec and in this page’s own Decisions of 2026-08-28 and 2026-08-29 (council read 234). Where the rewrite had changed a design on purpose — the credential id read twice rather than the credential verified twice — the rewrite’s design stands.
• 2026-09-28 — The 2026-08 gate’s open lines, read against the rewritten page. Chose: of 34 open lines, 12 were already closed by the rewrite or the 2026-09-27 restoration and are removed; 21 were live and are cured here — Credential’s length bound, the issuer references and the two reserved reasons taken at the boundary (Primitive policy 10 through 14); the entry id as the key between a log entry and its event (Composition state 16, Action wiring 39, Reconciliation 21); the log append’s own failure arm and order (Action wiring 37, 38); the relation’s cardinality (Composition state 13 through 15); the read’s lower edge (Composes 18); the deployment as sole revoker (Capability requirement 17); the failed count carved out of Invariant 2.1; Invariant 5.1 over the rebuilt map; Check 5.2 inside the horizon; and the summary, intent and examples brought to the rules. The formal line stays. Over: carrying lines whose anchors — step 5a, the recovery discipline, Configuration — no longer exist. Because: a Ledger that names sections the page no longer has cannot be read against the page, and most of what it named had moved, not closed.