Resolve a Person’s Data Rights — history

The dated record of how Resolve a Person’s Data Rights got here, moved out of the spec on 2026-10-21 because a reader does not need it to use the spec today. The spec keeps every section spec-format.md requires and its Deleted: tombstones; everything smaller is in git log -- compositions/resolve-a-persons-data-rights.md.

Decisions

Entries that record a round or a migration rather than a turn the pattern took.

• 2026-10-06 — A round that did not close: what was planned outlives the horizon, both edges read the log’s stamp, and an alerted gap is an open obligation. Chose: a stall mark on the request entry for an overdue intent that planned a destruction, written by the run ahead of any take and kept for the life of the instance, so the request reads Committing where the intent has aged out unclosed (Composition state 26, 27; Reconciliation 38, 39); Defensible Retention’s stand-in, so a destroyed event later in the log than an intent is read as its possible closing record and no clock decides the horizon edge alone (Term stand-in, Term open intent, Check 8.11, 8.12); young and overdue read on the log’s recording instant of the intent, the one instant written under the grant, and never on the now the invocation stamped ahead of its take; a bound for each thing a run does ahead of its legs — alerts, index entries, marks — with a run that fails a write, cannot read the trail or dies mid-enumeration alerted on and read by an auditor as an open obligation (Term alert bound, Term entry bound, Reconciliation 35, 36, 40; Check 1.5, 1.6, 8.7 through 8.10, 8.13); the auditor’s horizon edge one allowance wider than the run’s (Term horizon event); the cadence start to start (Reconciliation 37); the closure floor counting the leg’s take; no retention bound on the two accounting stores (Capability requirement 60, 61); a refusal for each of a missing entry, a failed state read and a read state, with no two obliged at once (Action wiring 4, 34, 35, 38); the hold guarantee claimed only for a fulfillment whose retention read follows the placement (Host-managed records 3); and a named receiver for a record sealed unsettled (Disposition 48). Over: an erasure that aged out unclosed and was fulfilled a second time without the records the first destroyed; edges read off a now a stalled host had stamped; checks that convicted a conforming deployment inside a cadence, across an alerted outage or at an aged event not yet destroyed; and a promise that the disclosure never ages, which no rule obliged of the deployment. Because: thirteen fresh-reader passes found sixteen foundational findings and each was cured in the pass that found it. Eleven sat in the recovery protocol this page restates beside Defensible Retention (line 2026-10-05-p), and at least five were lines the Ledger already carried as refining, which a reader forbidden the Ledger finds again. No three passes read one text, so the page is partially resolved and the text as it stands is owed a round. The eighteen models are unchanged and pass: they read the request section and none of the reconciliation’s edges, bounds, marks or the horizon.
• 2026-10-05 — The closing round: one instance for each store it writes, the alert ahead of the take, and a floor that leaves the alert its window. Chose: no two instances of the composition over one Defensible Retention instance or one Selective Disclosure instance (Capability requirement 52, 53); the audit retention policy unchanged for the life of the instance (Capability requirement 54); the overdue alert raised from the run’s enumeration ahead of any take, and a run that cannot enumerate alerting on that (Reconciliation 33, 34); an alert floor of two windows, two cadences and five allowances, so the alert has a window to be answered in and a run follows the answer (Term alert floor); a purge attributed to a plan only inside the plan’s span (Check 6.3, 6.4, Term plan span); a re-enumerated record of a source registered later read as outside the universe (Check 2.7); verification left to Audit Trail’s own acceptance (Check 1.1). Over: two reconciliations each reading the other’s intents on one trail, an alert a held section could postpone until the intent aged, a floor that alerted and aged within the same minute, an attribution with no upper edge, and a check that convicted an access for a source that did not yet exist. Because: Defensible Retention’s re-grounding the same day found the instance sharing, the alert under the section and the horizon read from a changed policy on its own page, and each stood here too (the batch rule — reference first, then swept, one closing round); the rest is what that round’s nine reader runs found on the way to one clean text. Not swept: Defensible Retention’s stand-in, which closes a race a leg’s own duration opens at the horizon — here the worst it leaves is a second abandonment of an intent truly abandoned, a safe state, routed as line 2026-10-05-u.
• 2026-09-24 — Rewritten in GRACE lang v0.61; thirty-three of thirty-four open Ledger lines closed by the rules that now own them. Chose: Composes, Composition state, Capability requirement — which takes the prose’s Configuration and Logic confinement whole — Primitive policy, Audit arm, Action wiring, Wiring decision and Reconciliation as the surfaces, with the verdict ladder as its own Disposition family; invariant numbers 1 through 8 unchanged, Invariant 9 tombstoned to Composes 6; the record checks renumbered as Conformance checks naming the rule each tests; the edge cases split into Non-goals and six Edge cases families. Choices the page left open, each decided by a standing rule: the anomaly admitted as a fifth verdict with a finding, terminal for the fulfillment (2026-08-26-g — as simple as possible without losing fidelity: a request held open over a record the substrate or the host must settle first answers nothing sooner); access failing closed to an anomaly on a determination error (2026-08-26-h — the same rule the erasure ladder already kept); the recipients and consent limbs sealed as the ids read rather than a digest that diverges by construction (2026-08-26-m); invalid-credential answered as itself at intake (2026-08-26-f, 2026-08-29-b — make all things mean one thing); the regulatory reference taken per request (2026-08-29-g — fidelity, since one deployment answers GDPR and CCPA requests alike); the gate’s answers mapped by Defensible Retention’s own positioned taxonomy, with one destruction-safe re-invocation for the three answers that say nothing about the record (2026-08-26-i, 2026-08-26-j); and an unconfirmable pairing recorded as such in the reason rather than reached through the Retention Window (2026-08-26-r, 2026-08-29-e — generalize nothing). One defect found in the pass and fixed in it: the retention-step arm at a pre-effect record was unlanded, so an appended intent answered as retryable left the caller’s retry refused compensation-pending. Over: the prose’s step lists, a closed vocabulary with a fifth member used outside it, and a seal no one could recompute. Because: the rules state each landing once and the fork between the siblings once; the formal line stays open because the model, not the page, is what it owes.

Ledger

The gate records the Ledger’s last gate: line carried behind its latest until 2026-10-21, newest first:

• 2026-10-06: thirteen passes, 16 foundational, each cured in its pass