Recoverable Invocation — history

The dated record of how Recoverable Invocation got here, moved out of the spec on 2026-10-20 because a reader does not need it to use the spec today. The spec keeps every section spec-format.md requires and its Deleted: tombstones; everything smaller is in git log -- compositions/recoverable-invocation.md.

Decisions

Entries that record a round, a binding, a model run or a migration rather than a turn the pattern took, and the twelfth gate’s consolidations, which chose where a rule is stated.

  • 2026-10-19 — Final Critique 17: [Read Invocation] answers not-known for an invocation id no readable intent carries, and [Open] refuses a kind the bindings table does not serve before it reads or takes. Chose: read invocation 3b answering not-known for an invocation id no readable intent of the act key carries, read invocation 3a returning one entry for an invocation id a readable intent carries, and the card Not Known naming the second answer; open step 1.9 landing invalid-request with no read and no take where the bindings table does not serve kind. Over: a given invocation id with no entry to give — the re-entry arm’s own, after an [Open] that refused before its intent — on which one build answered not-known and another an empty report; and a kind with no completion bound, no vocabulary and no service identity, which one build refused as invalid-request and another took as a failed take and answered section-unavailable, a retry that never succeeds. Because: the fourth round on the text as cured found two inputs no rule owned, both in older text; each cure gives the code the page already gives for the same absence (read invocation 12, the Action wiring table’s invalid-request), and the new refusal is decided before the read and the take, so it stands beside no code either decides.
  • 2026-10-18 — Final Critique 16: reconcile step 3.22 names the substrate’s codes, and [Resolve] refuses a malformed disposition before the take. Chose: reconcile step 3.22 opening journal-unavailable for every recording-failure(step-2) and every recording-failure(step-3) reconcile step 3.17 leaves for the next run; resolve 30 landing invalid-request(malformed) with no take and nothing appended for a disposition outside the three forms resolve 1 names. Over: a step-2 arm and step-3 arm one build read as [Reconcile]’s own steps, opening journal-unavailable over a journal that answered every call, so that Check 3.3 exempted intents whose closings landed past the window; and a cause the signature exports that no rule landed, which one build refused and another wrote. Because: the third round on the text as cured found a rule of the last round’s cure that read two ways and an exported code with no source; each cure takes the reading the page’s other rules already gave, and the new refusal is decided before the take, ahead of every code the take or a read or write behind the take decides, so it stands beside none.
  • 2026-10-18 — Final Critique 15: the recovery_intended write takes the outcome position, the sweep raises journal-unavailable wherever the journal fails it, and [Resolve] on a short lease answers section-unavailable. Chose: reconcile step 3.15 giving every recovery_intended write the outcome position’s arms, reconcile step 3.20 escalating one the substrate refuses as outcome-unrecordable, and Term skipped naming the act an unlanded recovery_intended write leaves; reconcile step 2.10 writing nothing, releasing, counting skipped and opening journal-unavailable where step 2’s re-read fails, with Term read path naming that re-read and [Open] step 1’s; reconcile step 3.22 opening journal-unavailable for every step-2 arm and step-3 arm reconcile step 3.17 leaves for the next run, as the finding’s condition already said; resolve 7 a WHEN block that releases and lands section-unavailable, the card Critical Section Unavailable naming the held-but-short arm. Over: a recovery_intended write whose failures no rule landed, and an act it left in no bucket; a re-read whose failure one build read as empty and closed over another writer’s closing; an outage of the journal’s writes the register never recorded, which Check 3.1 then held against a conforming deployment; and an arm on which [Resolve] wrote nothing and answered nothing. Because: the second round on the text as cured found three failure arms with no owner, on one of which a build breaks Invariant 2, and a finding whose condition named a side of the journal no rule surfaced, each in older text; each cure takes the reading the page’s other rules already gave.
  • 2026-10-18 — Final Critique 14: [Refuse] returns the refusal it landed, a sweep run stops at its refused credential, and the register’s runs carry their instants. Chose: refuse step 3.12 returning refusal event id wherever the refusal record stands, with the hard alert Primitive policy 25 and 28 and resolve 24 raise for a step-4 at the other three positions, and Term refusal event id declared; reconcile step 2.1 excepting every intent not yet examined when a write under the service identity answers invalid-credential, reconcile step 2.8 forbidding its take and reconcile step 2.9 counting it in unreached; first seen and last seen carrying the run’s reading of now. Over: a step-4 at [Refuse] that one build answered with the refusal and another with recording-failure(refusal) over a record that had closed the intent; a run obliged to take, probe and write for every kept intent after reconcile step 3.19 forbade its writes, the stop Term unreached names obliged nowhere; and an outage’s start and end, which Invariant 4.5 obliges and Check 3.3 compares with an intent’s window, held in runs that carry no instant. Because: the round on the text as cured found an arm no rule owned, two rules that could not both be obeyed, and a rule resting on fields the page did not declare, each in older text, and each cure takes the reading the page’s other rules already gave.
  • 2026-10-18 — Final Critique 13: [Resolve]’s closing write lands its own arms, the intents key is a service identity’s alone, and an act the sweep cannot write for under its credential is skipped. Chose: resolve 23 pointing at resolve 24 through 29, the resolution position Term position names; Which closing stands 9 and read invocation 8 conditioned on a declared service identity, with Term invocation report saying so; Term skipped naming an act whose write under the service identity answered invalid-credential. Over: the outcome position’s arms at [Resolve], which land a code [Resolve]’s signature does not carry; an unconditional report of two open intents, which reports a report-only deployment’s own instruction as a duplicate; and a tally whose exhaustive list left that act in no bucket. Because: the page’s first round of its own since the twelfth gate found the first two as rules that cannot both be obeyed on one reachable input and the third as an examined act no bucket of the partition owned, and each cure takes the reading the page’s other rules already gave.
  • 2026-10-08 — The pilot’s treatment, here: the store’s word on an abandonment is owed only under a declared fence. Chose: Invariant 5.6 scoped to a declared commit fence, an operator’s abandonment without one resting on Invariant 5.8 and resolve 20a; act section 18a tombstoned to act section 16, which binds Lease Sizing 8 for every unfenced write. Over: an invariant every fenceless abandonment broke. Because: without a fence the store cannot say an act did not happen, and the page had already admitted the operator’s attestation in its place.
  • 2026-10-07 — The adopter’s second frozen round, here: the sweep’s upper edge stands a run bound short of the horizon. Chose: run bound subtracted at Term horizon edge and added to the retention floor at Instance start 5; a release on every refusal of [Open]’s intent write (open step 4.5); and act section 10d tombstoned to the four steps that each return their own arm, the entry below having named one arm for all of them, which [Open] could not obey. Over: a fresh reading of now at every step of a run, which Primitive policy 18 forbids for good reason. Because: the edge is the one guard against closing an act whose closing has been lawfully destroyed, and an applied comparison that is the sole guard of a write has to cover how old its reading can be.
  • 2026-10-07 — The adopter’s frozen round, here: the adopter says whether its commit answered, and an expired invocation returns its position’s own arm. Chose: a reply input on [Yield], answered or lost, since only the adopter’s action knows and the release turns on it (yield 5 through 7); the position’s existing arm for an invocation past its lease, with the rule that discarded a late reply tombstoned to the one that forbids the write (act section 10c, 10d); the auditor’s closure checks kept to intents short of their computed horizon edge, as the sweep is (Check 7.3); not-open out of the two signatures, no action of this page returning it. Over: a yield that released by a Term no caller could evaluate — written the unit before. Because: the builder’s reading walked the adopter’s unknown partition into this page and could not build it.
  • 2026-10-07 — What the first adopter’s passes found here: a duplicate can be ended, an escalation is shown, a refused caller does not queue, and the lease is charged at its worst. Chose: an operator’s disposition naming every unsuperseded closing, the one place supersedes names more than one record (resolve 9a), with quiescence read as no duplicate awaiting it; a sixth finding condition for every act the sweep closes as escalated (reconcile step 3.21); a journal read ahead of the take that only refuses (open step 1.6 through 1.8); nine call pauses in lease spend and seven in closure spend, the last reading counted twice, and [Resolve]’s two reads and one write charged beside the sweep’s closure; a step-3 failure read back and never retried where no fence is declared (Primitive policy 29a, 32a); no adopter write under the service identity (service identity 3). Over: a duplicate reported for good, an obligation no action could meet; and a pre-check under the section alone, which is safe and starves the sweep on the one key it most needs. Because: each was reached by a reader tracing the adopter’s rules into this page, where twelve gates on this page alone had not gone.
  • 2026-10-07 — The first adopter bound, and the binding surface says what the binding found. Chose: probe answers committed only for a store record carrying every field of act key (probe 8); an invocation’s outcome data carries only what probe answers (close 5); the sweep reads an adopter’s store through probe and no other way (Sweep never 3); the walkthrough’s adopter is the pilot’s binding as that page states it, the kind ledger.disclosure and its vocabulary. Over: a binding surface that let a repeatable act be keyed fresh per invocation, where pairing datum 4’s obligation has nothing to serialize and a dead intent pairs to another invocation’s record; an outcome in two shapes, the invocation’s and the sweep’s; and a walkthrough whose record names fit no kind’s vocabulary. Because: Immutable Transaction Ledger (now Immutable Ledger) bound as the pilot adopter and each of these was met in writing its binding; none changes a step of the protocol, and the model reads none of them. The lines against Lease (2026-10-04-a through c) are untouched and are the protocol’s next unit, model first.
  • 2026-09-10 — Rewritten in GRACE lang v0.28; nothing but language changed. Chose: labelled rules, rationale under WHY:, the Ledger and invariant numbers unchanged. Over: the prose draft. Because: the migration plan.
  • 2026-09-10 — Instance start in controlled form. Chose: five terms, five one-line conditions, the round-trips as bindings. Over: inline inequalities marked STRICTLY. Because: arithmetic lives in term declarations, and a named term gives each expression one owner for the prose-versus-model diff.
  • 2026-09-10 — One owner for the conditions of instance start, and there are five. Chose: the section titled Instance start, cited by number. Over: four sites. Because: they drifted three ways at once, and the max floor matters: over 432 tuples the old floor admits 324 and breaches on 15, the new admits 288 and breaches on none.
  • 2026-09-10 — One owner for where the allowance is spent. Chose: the section titled Where the allowance goes — applied or minted, three instants, three payments. Over: three sites, one asserting the opposite of another. Because: the bare instant is the construction the Lease atom declares non-conforming; mint, then size for the minting.
  • 2026-09-08 — [Resolve] is modelled as the third writer. Chose: model v4, the operator taking the same critical section on its own seam reading, SupersedesNamed, OperatorSkew and service identity as modelled dimensions. Over: repairing from the gate’s prescription. Because: the NOT MODELED list had named [Resolve] for three gates and the ninth returned five of seven foundational findings on it.
  • 2026-08-30 — The model’s two corrections. Chose: a host that releases only on return or expiry, and one budgeted dead run. Over: release on death, and one bound. Because: the death twin lands two closings for one act.

Status

The account the Status line carried after its token until 2026-10-20:

first draft 2026-08-30 (corpus date); twelve fresh-reader gates on the prose draft through 2026-09-10, council read 7 on the GRACE lang rewrite, council read 50 on the current state. The Ledger carries every gate’s counts. Immutable Transaction Ledger (now Immutable Ledger) bound to it as the pilot adopter on 2026-10-07, and the three lines Lease’s grounding opened against this page cured the same day against model v6. Three passes read it on 2026-10-07 as the constituent of that adopter and returned four foundational findings against this page and a fifth it shares, cured the same day. Three rounds on the frozen pair returned three more, then two, then one, cured. Final Critique 13, its first round of its own since the twelfth gate, returned three on 2026-10-18, cured; Final Critique 14, the round on the text as cured, returned three more the same day, cured; Final Critique 15, the second round on the text as cured, four more, cured; Final Critique 16, the third, two more, cured; and Final Critique 17, the fourth, two more, cured. The word stays draft until a round of its own on the text as cured returns no foundational finding; the passes on this page alone ran, and this line said otherwise for a month (council read 50).

Ledger

The gate records the Ledger’s last gate: line carried behind its latest until 2026-10-20, newest first:

  • 2026-10-18 — Final Critique 16, the page’s fourth round of its own and the third on the text as cured, three fresh readers on free models (GRID DeepSeek V4.1 Flash, EOS Nemotron 3 Ultra, Linus MiMo V2.6 Flash), each handed only the round’s reading set, three passes on one text (frozen at 1307806); the round rests on two counted passes: the EOS pass counts for nothing, its reader having read lines 1 to 519 of the page’s 1,647 in one capped read and no further — foundational count 2 after triage (7 reports, 4 sent down to refining, 1 rejected), one in fresh text: reconcile step 3.22’s step-2 arm and step-3 arm read as [Reconcile]’s own steps as well as the substrate’s codes, so one build opened journal-unavailable for a failed take or an act short of its abandon edge over a journal that answered every call, and Check 3.3 then exempted intents whose closings landed past the window; and [Resolve] exported invalid-request(malformed) with no rule landing it, so a disposition outside the three forms resolve 1 names was refused by one build and written by another; 14 refining reports, 5 rhetorical reports; not clean; every foundational finding cured in place, none in a rule the model checks
  • 2026-10-18 — Final Critique 15, the page’s third round of its own and the second on the text as cured, three fresh readers on free models (GRID DeepSeek V4.1 Flash, EOS Nemotron 3 Ultra, Linus MiMo V2.6 Flash), each handed only the round’s reading set, three passes on one text (frozen at c83eafb); the round rests on one counted pass: the EOS pass counts for nothing, its reader having read 1,619 of the page’s 1,636 lines, its read tool’s third cap unfollowed, and the Linus pass counts for nothing, its reader having read, after its context was compacted, the round’s workflow bead and a Gas City skill file outside its reading set — foundational count 4 after triage (7 reports, 3 rejected), all in older text: the sweep’s recovery_intended write landed at no position, so no rule owned its failures and an act it left was counted in no bucket of the tally; [Reconcile] step 2’s re-read under the critical section had no failure arm, so one build closed an act on step 1’s view over a closing another writer had landed; [Resolve] where remaining did not exceed write floor wrote nothing and answered nothing, one build giving section-unavailable and another recording-failure(resolution); and a journal that could not be written raised no journal-unavailable, though the finding’s own condition names the write side, so Check 3.1 failed a conforming deployment whose journal took no writes for longer than the window; 12 refining reports, 4 rhetorical reports; not clean; every foundational finding cured in place, none in a rule the model checks
  • 2026-10-18 — Final Critique 14, the page’s second round of its own and the first on the text as cured, three fresh readers on free models (GRID DeepSeek V4.1 Flash, EOS Nemotron 3 Ultra once LongCat 2.5 Preview’s free use ran out, Linus MiMo V2.6 Flash), each handed only the round’s reading set, three passes on one text (frozen at 996df09), no lapse; the EOS pass counts for nothing, its reader having read the first 531 of the page’s 1,631 lines where its read tool stopped, so the round rests on two counted passes — foundational count 3 after triage (13 reports, 4 sent down to refining, 5 rejected), all in older text: [Refuse] obliged to nothing where a step-4’s read-back finds the refusal, so one build returned the refusal and another recording-failure(refusal) over a record that had closed the intent; a sweep run obliged to take, probe and write for every kept intent after a write under the service identity answered invalid-credential, which reconcile step 3.19 forbids, the stop Term unreached names obliged by no rule; and an outage finding obliged to carry the outage’s start and end (Invariant 4.5) in a shape whose first seen and last seen are runs with no instant, which Check 3.3 compares with an intent’s window; 10 refining reports, 5 rhetorical reports; not clean; every foundational finding cured in place, none in a rule the model checks
  • 2026-10-18 — Final Critique 13, the page’s first round of its own since the twelfth gate, three fresh readers on free models (GRID DeepSeek V4.1 Flash, EOS LongCat 2.5 Preview, Linus MiMo V2.6 Flash), each handed only the round’s reading set, three passes on one text (frozen at ac6bde2, Lease and Audit Trail read whole beside it), no lapse — foundational count 3 after triage (10 reports, 6 sent down to refining, 1 rejected), all in older text: [Resolve]’s closing write given the outcome position, whose arms land recording-failure(outcome), a code its signature does not carry, where resolve 3, 26 and 29 land its own; the intents key obliged (Which closing stands 9, read invocation 8) and forbidden (Which closing stands 10, read invocation 9a) on the two open intents a report-only deployment holds by instruction; and an act the sweep took whose write under the service identity answered invalid-credential, which no bucket of the tally owned; 14 refining reports, 5 rhetorical reports; not clean; every foundational finding cured in place, none in a rule the model checks
  • 2026-10-09 — read whole as the constituent of Immutable Transaction Ledger’s (now Immutable Ledger’s) Final Critique 14, the body at sha1 d58060b6, not a gate of its own — 0 foundational against this page: the one reported, an operator’s closing never sized, was rejected by a second triage, [Open] sizing against the kind’s largest record, which Term true maximum makes the operator’s closing too; the measuring Term’s list completed, and the compensation record named the escalation it is
  • 2026-10-09 — read whole as the constituent of Immutable Transaction Ledger’s (now Immutable Ledger’s) confirming round, the body at sha1 11be8053, not a gate of its own — 1 foundational against this page, cured: service identity 3 forbade only the adopter to write under the service identity, so a deployment could share it with the substrate’s reconciliation operator and check 5 would report that operator’s scan as writes outside this composition (service identity 3, a writer other than the sweep). Also cured: the stall walkthrough’s adopter yields at its commit round trip; Term standing closing agrees with Which closing stands 7; open step 4.4 and close step 3.2 cite Primitive policy 19 through 43
  • 2026-10-08 — read whole as the constituent of Immutable Transaction Ledger’s (now Immutable Ledger’s) fourth round on frozen text, the body at sha1 29b0cdb6, not a gate of its own — 1 foundational against this page, cured: open invocations 3 rebuilt the set less every intent a later record named, a recovery_intended included, so an act whose recovered outcome failed to land left the sweep for good (open invocations 3, a later closing record). Also cured: Invariant 3.5a’s escalation writes no outcome rather than closing nothing; Check 6.1 passes an operator’s outcome among the candidates of an undecidable probe; the pairing datum WHY’s failing order corrected to the second invocation dying; the open WHY on step 5.6 says a lost intent reply also fires it
  • 2026-10-08 — read whole as the constituent of Immutable Transaction Ledger’s (now Immutable Ledger’s) third round on frozen text, the body at sha1 f4a91352, not a gate of its own — 1 foundational against this page, cured: Check 6.1 failed a conforming deployment whose adopter’s store removes a record ahead of the journal’s retention of its outcome, the probe answering not-committed for a lawfully removed record (Binding 9). Two lines readers kept finding were stated in the body before the text was frozen — what a hard alert is, and which read-backs land where — and neither came back
  • 2026-10-07 — read whole as the constituent of that page’s second round on frozen text, the body at sha1 00d866ff, not a gate of its own — 2 foundational against this page, cured after the third pass: [Open] named no release where its intent write was refused, so a refused caller could hold a key for a completion bound (open step 4.5); the sweep’s upper edge allowed for the two clocks and not for the age of a run’s one reading, so a closing purged while a run was in flight left its late-retained intent looking open and the run closed it twice (Term horizon edge, Instance start 5)
  • 2026-10-07 — read whole as the constituent of that page’s first round on frozen text, the body at sha1 63ecdaf2, not a gate of its own — 3 foundational against this page, cured after the third pass: [Yield] could not tell an answered commit from a lost one and so could not know whether to release (yield 5 through 7); an expired invocation at [Refuse] was obliged the outcome arm its signature lacks (act section 10d); an intent whose retention was placed late outlived its closing and failed Check 3 on a conforming deployment (Check 7.3)
  • 2026-10-07 — earlier the same day, read as the constituent of that page’s three passes, not a gate of its own — 4 foundational against this page, cured: no action could end a binding duplicate, which journal fence none 4 obliged (resolve 9a); an escalation was shown to nobody unless its cause was undecidable (reconcile step 3.21, the sixth condition); refused callers took the critical section to be refused and could stand ahead of the sweep’s take for longer than the sweep waits (open step 1.6 through 1.8); lease spend and closure spend were each one call pause short of the gate they exist to clear. A fifth is shared with the adopter: a step-3 recording failure was retried as though nothing had been appended (Primitive policy 29a, 32a)
  • 2026-09-10 — twelfth gate, fresh reader, on the draft — 6 foundational, 15 refining and 6 rhetorical, corrected in this round together with the four of gate 11’s nine that gate 12 did not re-find. The round’s measurement: the Lease extraction’s own claim held per class — lease-owned findings went 3 → 1 → 0 — while every surviving foundational was a consolidation that had not carried every obligation into its new owner. Two consolidations this round, both written in controlled normative form: the allowance’s disposition (three passages, one of which asserted of another the opposite of what it said) and the instance-start condition set (four sites, one of which — the walkthrough — breached a condition the page declared eight lines above its own numbers, while the acceptance check that clears instance start named a subset)
  • 2026-09-10 — eleventh gate — 9 foundational, 17 refining and 5 rhetorical; the round that measured defect density flat at 18-20 KB per foundational across four gates and diagnosed propagation failure as 16 of 19 caused findings, which is what put the diff-derived obligation sweep into standing round discipline
  • 2026-09-10 — tenth gate — 8 foundational
  • 2026-09-09 — ninth gate — 8 foundational, and the round that brought [Resolve] into the model as its third writer
  • 2026-09-09 — eighth gate, fresh reader, on the draft — 8 foundational, 15 refining and 7 rhetorical, all corrected in-round. Two of the eight were defects in start checks the previous round had copied out of Configuration into an acceptance check so an auditor would run them, and one of those two — the sweep’s lease — was unsatisfiable wherever closure_latency reached completion_bound
  • 2026-09-08 — seventh gate, fresh reader, on the draft — 7 foundational, 12 refining and 8 rhetorical, all corrected in-round; conceptual independence returned CLEAN for the first time, and foundational timing findings reached zero. Five of the seven landed on [Resolve] or the purge, both on the model’s own NOT MODELED list, and two of those five were then reproduced by bringing [Resolve] into the model
  • 2026-08-30 — sixth gate, fresh reader, on the draft — 6 foundational, 12 refining and 6 rhetorical, all corrected in-round, and the first round to run with the linter’s mechanical checks active against the draft (they caught one defect the round itself introduced)
  • fifth gate — 5 foundational, 11 refining and 5 rhetorical corrected in-round
  • fourth gate — 8 foundational, 19 refining and 5 rhetorical corrected in-round
  • third gate — 4 foundational, 15 refining and 6 rhetorical corrected in-round
  • second gate the same day — 6 foundational, 17 refining and 7 rhetorical corrected in-round
  • first gate — 8 foundational and 16 refining corrected in-round, 1 refining routed, 5 rhetorical corrected

Migration notes

  • 2026-09-11 — The walkthrough’s closure latency, above an earlier draft’s. An earlier draft bound closure_latency = 5 s, which breaches condition 5: the second gate fails for any probe latency, the sweep re-opens a recovery intent every cadence and never lands a closing.
  • 2026-09-14 — refuse step 0.1 restating close 4 (council read 50). Council read 50’s repoint made refuse step 0.1 an EXACT restatement of close 4: both now oblige the adopter’s action, where before they differed by naming [Close] and [Refuse], so W-duplicate-proposition reports it where it did not. That is the watch gaining its sharpest specimen rather than a defect arriving — one proposition, two labels, no form to inherit with — and it is left standing as the evidence the inheritance ruling will need.
↑