Roadmap

Table of contents

Roadmap

What the library is building toward, in dependency order. Atoms before the compositions that name them. Each entry names what it unlocks.

The library’s vision and framing are in why.md. This file records what comes next and why, at the granularity of individual patterns. Priority reflects dependency readiness first, regulatory coverage second — a composition that needs three new atoms is lower priority than one that needs one, regardless of business value, because the blocking atoms must land first.

The topological ordering principle is codified in pressure-testing.md: atoms before compositions, constituents before the applications that name them. This roadmap is organized accordingly.

How to read this file (orientation added 2026-07-06 — navigation only, never state): this is a dated ledger, not a report. §Current state carries the running record, one dated bullet per landing, newest additions at the top of the list; the grounded catalog below it is the registry whose status cells mirror each pattern’s own Status line (the pattern file is the source of truth — a mismatch is a finding). Methodology debts are numbered and permanent; progress and resolution notes ride each debt as dated additions, so a debt’s history reads top to bottom inside its own entry. Candidate backlogs (healthcare, concept-recovery, exhibit-sourced) sit at the bottom and change no counts. This file deliberately carries no summary block — a hand-written “current totals” section is exactly the drift class the no-snapshot rule kills; the counts live inside dated entries where they can never silently lie, and the computed overviews live at graph.md (structure) and status.md (gates).

Current state

Taxonomy flattened; status reconciled — 2026-06-08. The atoms/<category>/ subfolders were dissolved; atoms are stored flat (atoms/<name>.md) with classification derived (overlays from the composition graph; domain the one intrinsic, EOS-gated axis), and the per-category READMEs replaced by a generated browse-by-overlay catalog (atoms/index.md, via tools/taxonomy/generate_views.py). Corpus unchanged at 45 grounded patterns (27 atoms, 18 compositions); the move was path-safe — all 74 formal models still found and green. This ROADMAP’s atom/composition status was then reconciled to reality: the planned-sequence atoms (#7–#14) are all grounded, and the genuine remaining composition backlog is C6, C7, C11, C15, C17, C18 (all unblocked, none blocked on a missing atom). See atoms/TAXONOMY.md.

Coverage GAPs closed — 2026-06-04. The 6 genuine coverage GAPs the inaugural cross-check surfaced (Medication Order Inv 3/4, Credential Inv 7, Legal Hold Inv 6, Provisional Commitment Inv 8, Capacity Constraint Inv 5; plus the Inv 14 reconsideration) are all closed — produced by parallel Sonnet subagents, Opus-gated (diff review + independent harness re-run). Medication Order gained an Alloy structural model (medication-order.als, mirroring clinical-observation.als) covering the pre-dispensing-only + linear-amendment invariants; Credential, Legal Hold, Provisional Commitment, and Capacity Constraint gained TLA+ model extensions (rotation-chain link; two-clock temporal ordering; release/expire transition timestamps; a release action making non-negativity non-vacuous). Capacity Constraint Inv 14 (within-action atomicity) was reconsidered to out-of-scope (a host obligation, not an action-vs-action interleaving — parallels Party Identity Inv 11). Every vote-named load-bearing invariant across the five patterns now carries a named check and its own dedicated, checker-rejected buggy twin — Legal Hold, Provisional Commitment, Capacity Constraint, and (on a 2026-06-04 follow-up audit) Credential each carry a second isolated twin so no previously-covered invariant lost its counterexample when the new check landed. (Credential initially shipped a single combined twin in which the shorter Inv 7 counterexample masked the Inv 2 counterexample; the follow-up split it into credential-buggy.tla (Inv 7) and credential-buggy-toctou.tla (Inv 2).) The five patterns drop their formal coverage: Inv N pending caveat and return to unqualified grounded. See tools/harness/coverage/README.md §Resolution. Harness re-run green: 5 correct models hold, 9 twins rejected.

Provenance (atom #7) grounded — 2026-06-04. The first net-new pattern of the sprint: a regulated compliance atom — an append-only single-artifact custody chain whose load-bearing guarantee is custody continuity (transfers are hand-to-hand, exactly one current custodian at all times, no gap; the outgoing custodian is read from chain state so a false predecessor cannot be forged). The EOS Pass-2 boundary against Event Log holds (custody continuity is not expressible on a content-agnostic event stream), and the disclose overlap with the existing Selective Disclosure atom was extracted as a composing boundary. Sonnet-drafted against an Opus plan, Opus-gated (Pass 1 / 2 / 3 + Final Critique; two foundational + four refining findings closed in-pattern), formal-layer vote YES with an Alloy model (provenance.als) + buggy twin verified in tools/harness/. This brings the library to 39 grounded patterns and unblocks Chain of Custody (C12) — the cross-domain pharma↔legal-evidence reference composition — whose remaining constituents (Actor Identity, Tamper Evidence, Retention Window, Audit Trail) are all already grounded.

Chain of Custody (C12) grounded — 2026-06-04. Immediately after Provenance, C12 was authored end-to-end (Opus plan → Sonnet draft → Opus gate: Pass 1 / 2 / 3 + Final Critique, two foundational + three refining findings closed → TLA+ binding-bijection model + buggy twin verified in tools/harness/). C12 composes Provenance + Audit Trail (substrate) — the substrate supplies Actor Identity attribution, Tamper Evidence sealing, and Retention Window governance transitively, so naming Audit Trail satisfies the “+ Actor Identity + Tamper Evidence + Retention Window” requirement per the compositions-of-compositions convention. Its emergent guarantee is records-alone custody proof (verify_custody): unbroken + attributed + tamper-evident + retention-governed custody from origin to disposition, which neither constituent provides alone. C12 is the library’s cross-domain flagship — pharmaceutical (FDA 21 CFR Part 211 / DEA 1304) and legal-evidence (FRE 901(b)(9)) chain of custody are the same structure, one composition serving both — and the first composition to compose the Provenance atom. This brings the library to 40 grounded patterns (14 grounded compositions) and retires the Chain-of-Custody forthcoming-link in Provenance.

State Machine (atom #9) grounded — 2026-06-04. The general-purpose state-machine primitive: a named instance moving through a deployment-declared finite set of states via declared transitions, enforcing only-declared-transitions, exactly-one-current-state, terminal absorption, and a replay-deterministic append-only transition history; it gates (but deliberately does not evaluate) caller-asserted transition guards. EOS boundaries held against Approval Step (the fixed-state sibling — states fixed by the atom vs. declared by the deployment) and Event Log (declared-transition enforcement is not expressible on a content-agnostic stream); guard evaluation and a shared-declaration Definition Registry were extracted as composing concepts. Sonnet-drafted against an Opus plan, Opus-gated (one foundational finding — a fired_at cross-entry monotonicity rule that contradicted the best-effort-clock claim, relaxed to match Event Log — plus one refining, both closed), formal-layer vote YES with an Alloy model (state-machine.als) + buggy twin verified in tools/harness/. This resolves the workflow one-atom open question (the category now stands on two atoms), unblocks Execute Gated Workflow (C10) — the last composition that was blocked on a remaining atom, so every C-numbered composition is now grounded or unblocked — and brings the library to 41 grounded patterns.

Execute Gated Workflow (C10) grounded — 2026-06-04. Immediately after State Machine, C10 was authored end-to-end (Opus plan → Sonnet draft → Opus gate: Pass 1 / 2 / 3 + Final Critique, one foundational + one refining finding closed → TLA+ approval-gated-transition model + buggy twin verified in tools/harness/). C10 composes State Machine + Approval Step + Permissions + Assignment + Audit Trail (substrate) and is the first composition to compose the State Machine atom. Its load-bearing emergent property is the precise closure of an atom-level extraction: State Machine deliberately gates on a caller-asserted guard_satisfied without evaluating; C10 evaluates approval-type guards by binding each guarded transition to an Approval Step and asserting guard_satisfied = true only when that step is genuinely Approved — guard evaluation re-converges here. The foundational gate finding (the gate’s Approval Step submitter must be the workflow initiator, else the moot-gate cascade is unauthorized under Approval Step Invariant 5) was closed. This brings the library to 42 grounded patterns (15 grounded compositions) and retires the C10 forthcoming-links in State Machine and Approval Step. With it, every one of the seventeen C-numbered compositions is now grounded or unblocked, and no composition is blocked on a remaining atom.

Forensic Recovery (C3) grounded — 2026-06-04. The deliberately-easy follow-on: Soft Delete + Audit Trail (substrate) — the same atom-plus-substrate template as C12, gated quickly. Every delete/restore/purge is attributed, tamper-evidently sealed, and recover_history reconstructs the full ordered lifecycle that Soft Delete’s current-state-only summary discards; the headline invariant is no record is purged without an auditable, sealed record of who/when/why. EOS boundary held: the purge-eligibility gate (Legal Hold / Retention Window) stays with Defensible Retention (C1); C3 records faithfully. The one gate finding — the binding bijection needed its sole-write-path precondition and a verifiability correction (Soft Delete keeps no transition history, so record_to_events + the Audit Trail Event Log is authoritative) — was closed. TLA+ binding-bijection model + buggy twin verified. This brings the library to 43 grounded patterns (16 grounded compositions) and retires the Forensic Recovery forthcoming-links in Soft Delete.

Propagate Consent Revocation Downstream (C2) grounded — 2026-06-04. The GDPR consent-lifecycle composition: Consent + Permissions + Audit Trail (substrate) + a distinct consent-record Retention Window placement. Authored end-to-end (Opus-gated: Pass 1 / 2 / 3 + Final Critique, foundational + refining findings closed → TLA+ binding-bijection model + buggy twin verified in tools/harness/). Two halves to its emergent guarantee: consent-gates-processing (processing_permitted is the single gate every processing system consumes, permitted iff Consent.check → granted) and revocation propagation (the load-bearing one) — withdraw_consent commits the Consent revoke and a consent.revoked event enumerating the complete downstream processing-scope set the consent governed, together or not at all (the revoke ⇔ complete-propagation-record binding bijection, modeled on audit-trail.tla / forensic-recovery.tla). EOS Pass 2: Permissions confirmed a constituent (the inward-authorization surface gating administration) rather than a peer, with the inward/outward separation locked as Invariant 7; downstream cessation and delivery-shaping preference management (C11) extracted as composing concepts. This brings the library to 44 grounded patterns (17 grounded compositions) and retires the C2 forthcoming-links in Consent and Customer Onboarding (C8).

Reserve from Pool (C9) grounded — 2026-06-04. The pool-aware reservation composition: Capacity Constraint Enforcement + Provisional Commitment + Duplicate Prevention + Event Log + Actor Identity — the pool-arithmetic superset of Idempotent Reservation (which wires Provisional Commitment + Duplicate Prevention but not pool arithmetic). Authored against Idempotent Reservation as the structural template (Opus gate: Pass 1 / 2 / 3 + Final Critique → TLA+ allocation-coherence model + buggy twin verified in tools/harness/). The load-bearing emergent guarantee is allocation coherence — the pool’s allocated total stays in exact lockstep with the live-reservation set (Held or Confirmed), within [0, capacity] — which the composition owns via the reservation_to_pool binding (with a slot_released flag): reserve allocates-and-holds atomically (compensating release if the hold fails), confirm_reservation keeps the slot, cancel_reservation/expire_reservation return it exactly once. The three reservation-bug failure modes — oversell, slot-leak, double-release — are each foreclosed by a named mechanism. EOS Pass 2: the binding is the emergent responsibility neither Capacity Constraint (fungible arithmetic, no per-allocation identity) nor Provisional Commitment (per-reservation identity, no pool) owns; Event Log + Actor Identity composed directly (the lighter pairing, Audit Trail named as a peer for litigation-exposed deployments); overbooking (a capacity choice) and un-booking (Reversal) extracted. This brings the library to 45 grounded patterns (18 grounded compositions) and retires the C9 forthcoming-links in Capacity Constraint Enforcement and Provisional Commitment.

Immutable Transaction Ledger with Selective Disclosure (C6) grounded — 2026-06-08. The disclosable-ledger composition: Audit Trail (substrate, → Event Log + Actor Identity + Tamper Evidence + Retention Window) + Selective Disclosure, with Idempotent Reservation / Duplicate Prevention as optional at-most-once-append enrichment (named, not core) — the same atom-plus-substrate template as C12 (Chain of Custody) and C3 (Forensic Recovery). Authored end-to-end (Opus gate: Pass 1 / 2 / 3 + Final Critique; one foundational finding — the disclosed-subset membership predicate, pinned to ledger.entry transaction events validated against the substrate Event Log — and two refining findings closed → TLA+ binding-bijection model + buggy twin verified in tools/harness/). Two load-bearing emergent guarantees: disclosure-accountability binding bijection — every disclose_subset writes, atomically, one Selective Disclosure record and one ledger.disclosed Audit Trail event, so the act of disclosing is itself an immutable, attributed ledger entry (the TLA+ model subject, mirroring chain-of-custody.tla / forensic-recovery.tla); and verifiable partial disclosure — any disclosed subset is independently provable authentic against the ledger seal while the undisclosed remainder stays undisclosed and uncompromised, stated as a behavioral capability obligation on the substrate’s tamper-evidence (Merkle proofs / accumulators / signed packages are typical realizations in rationale only, not a mechanism mandate — pinning one would contradict Tamper Evidence’s own mechanism-neutrality). EOS Pass 2: the authorization gate (Consent / Permissions), at-most-once append (Idempotent Reservation), hold-blocks-purge (Legal Hold / Defensible Retention), and artifact custody (Provenance) are all externalized as peers or optional enrichments, not absorbed. C6 is the first composition to compose the Selective Disclosure atom and the cross-domain reference case for the disclosable immutable ledger — broker-dealer trade confirmations (SEC Rule 17a-4), healthcare accounting-of-disclosures (HIPAA §164.528), and clinical-trial submissions (21 CFR Part 11) are the same structure. This brings the library to 46 grounded patterns (19 grounded compositions) and retires the C6 forthcoming-links in Selective Disclosure and Provenance. C6’s fresh-reader Opus council (Final Critique 5) surfaced a new roadmap item: a forthcoming Subset Proof (selective tamper-evidence) atom — the verification dual of Tamper Evidence’s whole-set seal, “prove a named subset of a sealed set is included without revealing the complement” — which would let C6 delegate its verification_bundle to a named constituent surface rather than construct it at the composition layer. Named here as a backlog atom, not yet authored; until it lands, C6’s subset-proof surface is composition-introduced and rests on the configured Tamper Evidence mechanism’s inclusion-proof capability.

Resolve a Person’s Data Rights (C7) grounded — 2026-06-09 (Final Critique 5). The data-subject-rights composition: Selective Disclosure + Defensible Retention (C1, substrate → Legal Hold + Retention Window + Audit Trail) + Consent (read-only authority oracle). The load-bearing reframe: C7 is not a “rights system” but a conflict-resolution system over a record universe — when a subject exercises access (GDPR Article 15) or erasure (Article 17), four claims collide per record (access, erasure, legal hold/retention, consent), and C7 resolves each into exactly one recorded, attributed disposition (access: included / withheld(...); erasure: erased / retained(legal-hold | retention-obligation | other-lawful-basis)). Two load-bearing emergent guarantees: no-silent-omission (every in-scope record carries exactly one disposition; none silently dropped) and the request ⇔ accountable-complete-fulfillment binding bijection (the complete disposition set, the response-disclosure, and the sealed dsar.*_fulfilled event commit together or not at all). The erasure path wraps C1’s purge_record gate — ok→erased, under-legal-hold→retained(legal-hold) (Art 17(3)(e)), not-eligible→retained(retention-obligation) (Art 17(3)(b)) — adding only the Art 17(1)(b) Consent-oracle branch; Consent is consulted read-only, never mutated. Authored end-to-end: author gating review (two foundational + five refining closed), formal-layer vote YES with a TLA+ model checking the binding bijection and a no-silent-omission coverage totality (the property C6’s binding-only model did not need) + two buggy twins (one per load-bearing invariant) verified in tools/harness/, and a fresh-reader Opus council (Pass 1 GRID / Pass 2 EOS / Pass 3 Linus-X2) that surfaced three foundational findings — the Consent oracle’s expired/not-known outcomes undefined in the erasure branch, the C1-internal-vs-C7 orphan conflation, and an Invariant 1 atomicity overclaim — all folded, foundational now at zero. C7 is the first composition authored under the capability-provenance rule, the first to compose Consent as a read-only oracle and Defensible Retention (C1) as a substrate. It seeds a forthcoming Completeness Model atom (accountable enumeration of a record universe with per-record disposition — a shared C7/C8 primitive C7 exposes, not a C7-owned abstraction) and retires the C7 forthcoming-links in Consent, Legal Hold, Selective Disclosure, and Provenance. The Phase 4 Opus Happy-Torvalds-X2 clearance gate cleared in a fresh session on 2026-06-09 (claude-opus-4-8): foundational findings at zero, six refining/rhetorical findings folded, and the correct TLA+ model + both buggy twins re-verified (CORRECT holds at 2 states; -buggy rejected on Inv1_BindingBijection; -buggy-coverage rejected on Inv2_NoSilentOmission). C7 grounds on Final Critique 5, bringing the library to 47 grounded patterns (20 grounded compositions).

Authenticated Actor (C17) grounded — 2026-06-10 (Final Critique 4). The authenticated-principal composition: Credential (the authentication / gating surface) + Actor Identity (the attestation surface) — answering the three demos/attributed-permissions-admin/CORNERS.md §Cross-atom identity surface aliasing questions as three emergent invariants. The load-bearing emergent guarantee is the revocation cascade as forward closure: attest_as_actor is gated on the bound credential’s live Active status, read atomically with the attestation write (serialized on the gating (principal_ref, credential_type) credential record — the row Credential.revoke also locks), so a revoked login produces no new attestations — while attestations made before revocation stay valid, because the cascade is forward-closure only, never a set-revocation (attestations are immutable point-in-time records, so there is no active-attestation set to walk). The other two emergent invariants — secret-surface separation (cross-routing foreclosed structurally; distinct-provisioning an externally-clearable deployment obligation) and the principal_ref ⇔ actor_ref namespace bijection (register-time conflict guard + atomic strict-inverse maps + immutability) — are the structural conditions that make the cascade and its audit trail meaningful. Authored end-to-end: three-round baseline + author Final Critique (three foundational + four refining closed), formal-layer vote YES with a TLA+ revocation-cascade model + TOCTOU buggy twin verified in tools/harness/ (CORRECT holds at 16 states; -buggy rejected on Inv1_NoSignAfterRevoke), and the Phase 4 Opus Happy-Torvalds-X2 fresh-reader clearance gate cleared 2026-06-10 (claude-opus-4-8): foundational findings at zero, five refining folded, model + twin re-verified, and capability provenance re-derived head-on against the constituent specs (the cascade gate confirmed housed at the composition layer, not mis-attributed to Actor Identity, which cannot see a credential revocation). C17 is Login’s outbound-attestation counterpart (Login forward-closes the session set; C17 forward-closes the attest surface), the first composition to pair Credential with Actor Identity, and retires the two Authenticated Actor pending markers in Credential and Actor Identity. This brings the library to 48 grounded patterns (21 grounded compositions).

Actor Suspension (C18) grounded — 2026-06-10 (Final Critique 4). The outbound multi-surface de-authorization composition: Actor Identity (the suspended actor’s composition-introduced Active/Suspended lifecycle) + Permissions (grant-revocation target) + Session (session-revocation target) + Audit Trail (substrate → Event Log + Actor Identity + Tamper Evidence + Retention Window) + optional Credential. Login’s outbound-side counterpart — where Login (C13) wires Credential.verify → Session.issue on the way in, C18 wires suspend → revoke every grant + every session (and optionally the credential) on the way out. Three emergent invariants: atomicity of multi-surface revocation (after suspend_actor succeeds, zero active grants and zero active sessions committed as one transaction, no partial state — the load-bearing claim, with all-or-nothing the default precisely because a half-suspended actor is a worse security state than a clean failure, a deliberate inversion of Login’s best-effort cascade), audit completeness (the sealed actor.suspended event enumerates every revoked grant_id and session_token), and suspension cascade ordering (the Active→Suspended gate fires the cascade exactly once; a second suspend_actor is a no-op; a benign already-terminal target is counted, not aborted — mirroring Login’s Final Critique 4 finding Final Critique 1). Authored end-to-end: three-round baseline + author Final Critique, formal-layer vote YES with a TLA+ atomic-cascade model + non-atomic buggy twin verified in tools/harness/ (CORRECT holds at 2 states, saturated; the twin rejected on Invariant 1), and the Phase 4 Opus Happy-Torvalds-X2 fresh-reader clearance gate cleared 2026-06-10 (claude-opus-4-8): foundational findings at zero, five refining folded, model + twin re-verified, and capability provenance re-derived head-on against the constituent specs (the Active/Suspended lifecycle confirmed composition-introduced — Actor Identity carries no lifecycle state — and unified_actor_namespace an honest deployment-config capability with its coincidence routed to an externally-clearable check). C18 realizes the deprovisioning-cascade obligation Permissions’ Mass revocation edge case and Actor Identity’s actor-lifecycle deferral both anticipate, and composes with C17 (closing the attest surface) plus Credential revocation to close the full outbound surface. This brings the library to 49 grounded patterns (22 grounded compositions).

Capability-Backed Sharing (C15) grounded — 2026-06-10 (Final Critique 4). The accountable-bearer-sharing composition: Capability (the bearer token whose scope is an authorized disclosure) + Selective Disclosure (the disclosure-accounting record) + Audit Trail (substrate → Event Log + Actor Identity + Tamper Evidence + Retention Window) — mirroring C6’s substrate-plus-Selective-Disclosure shape. It reconciles two designs that look incompatible: bearer-token sharing (possession authorizes; the redeemer is never identified) and regulated disclosure audit (every disclosure accountable to a named, non-repudiable authorizing party). The load-bearing emergent property is the audit-subject asymmetry — every capability-backed disclosure names the allocator (attested under their own credential at allocation, carried immutably in the capability) and, by construction, no redeemer, resting on Capability’s declared Invariants 3 (bearer redemption) and 5 (audit asymmetry) surfaced through redeem’s allocator_ref return, never an ambient “the system records no redeemer.” Its second load-bearing claim is the disclosure-accountability binding bijection (mirroring C6): each redemption-that-discloses commits the Selective Disclosure record, the sealed sharing.disclosed event, and the redemption-decrement together or not at all — a recoverable store write under the host transaction, so closer to C6 than to C7’s irreversible purge. Formal-layer vote YES with a TLA+ binding-bijection model + non-atomic buggy twin verified in tools/harness/ (CORRECT holds at 4 states, saturated; -buggy rejected on Inv2_BindingBijection), and the Phase 4 Opus Happy-Torvalds-X2 fresh-reader clearance gate cleared 2026-06-10 (claude-opus-4-8): foundational findings at zero, four refining/rhetorical folded, model + twin re-verified mechanically, and capability provenance plus every constituent invariant count (Capability 1–12, Selective Disclosure 1–6, Audit Trail 1–8) re-derived head-on against the constituent specs. C15 is the library’s worked example of the object-capability (OCAP) model composed with regulated audit, the first composition to compose Capability with Selective Disclosure, and retires the C15 forthcoming-reference in Capability. This brings the library to 50 grounded patterns (23 grounded compositions).

Composition-state adjudication (Refactor 1) and the Idempotency Result Memo proposal — 2026-06-10. The Execution Contract now owns composition-state semantics with a two-arm rule (execution-contract.md §Composition state): every Application-state element is either a derived index — fully rebuildable from constituent stores, with a named rebuild procedure, excluded from the atomicity surface, claiming no cross-constituent consistency — or evidence of a not-yet-extracted atom, declared extraction-pending with the proposed atom named. This closes the spec-format/Contract composition-state divergence inside the newly assigned ownership seam (spec-format owns containers; the Contract owns section-content semantics; the Contract’s mapping tables plus section-name classification are the SSOT bridge, with the section-name lint check specified — see spec-format.md §Ownership seam). The non-derivable pole forces a new backlog atom proposal: Idempotency Result Memo — token → result, single write, window-governed eviction; the result-replay half of idempotent-replay semantics that Duplicate Prevention’s own spec explicitly disclaims (DP answers have I seen this identity? — membership, no payload; the Memo answers what did I return for it?). Named here as a backlog atom, not yet authored; its formal obligations lift substantially from the existing idempotent-reservation.tla (exactly-once-in-window, unsafe-eviction-ordering). Until it lands, Idempotent Reservation’s token_results (and Reserve from Pool’s inherited copy) is the worked extraction-pending case, and C6’s disclosure_to_event is the worked derived-index pole. The corpus-wide Application-state classification audit is recorded as methodology debt #9 below.

As of the 2026-06-03 formal-layer vote sweep (aggressive bar), all 38 then-grounded patterns were fully grounded — the backlog models having landed and the bar reconsidered. (This is the 2026-06-03 cohort, not the current total; the running per-grounding bullets above carry the library to 47 grounded patterns.) Coverage cross-check — inaugural sweep (2026-06-04): all 22 vote-yes models were run through the formal-layer coverage cross-check (tools/harness/coverage/, see its README). 14 fully clean; 4 by-construction flags resolved (2 promoted to explicit checks — Event Log Inv 1, Provisional Commitment Inv 3; 2 recorded as deliberate frame properties — Approval Step Inv 9, Medication Order Inv 9); and 6 genuine coverage GAPs across 5 patterns (Medication Order Inv 3/4, Credential Inv 7, Legal Hold Inv 6, Provisional Commitment Inv 8, Capacity Constraint Inv 5/14) — each a second vote-named invariant with partial/no formal coverage, now honestly labeled formal coverage: Inv N pending on those patterns’ Status lines and queued early-sprint. Not English regressions; the primary load-bearing invariant of each is verified with a rejected twin. The entire formal-model backlog is complete: 18 TLA+ models (Opus-authored) and 4 Alloy structural models (Sonnet-drafted, Opus-gated) landed; 3 clock/precedence patterns were reconsidered to English-only (formal-not-warranted). Zero pending. Every model ships a buggy twin the checker rejects as the vacuity guard. Eight backlog models landed (the four high-stakes TLA+ models plus the Med–High tier: Assignment, Medication Order, Preference / Personalization, Approval Step). Bar reconsideration (2026-06-03): the aggressive-bar YES on three of the five flagged clock/precedence patterns was downgraded to NO (formal-not-warranted) on a second pass — Retention Window, Session, Consent are records-alone/precondition claims a model would only re-confirm, so they return to fully grounded English-only; Provisional Commitment and Duplicate Prevention keep their YES (genuine action-vs-action races — confirm-vs-auto-expiry, concurrent first-record) and remain in the TLA+ queue. See each pattern’s Lineage §Formal-layer vote for the per-pattern rationale. Customer Onboarding (C8) grounded on Final Critique 4 (2026-06-03). Formal-model backlog progress (2026-06-03): the four high-stakes TLA+ models are landed — Party Identity (party-identity.tla, 532 states clean), Event Log (event-log.tla, 119 states), Audit Trail (audit-trail.tla, buggy twin shows the non-atomic cascade is unsafe, 9 states), and Capacity Constraint Enforcement (capacity-constraint-enforcement.tla, buggy twin shows the TOCTOU race overshoots capacity, 7 states) — each with a buggy twin the checker rejects, all verified via tools/harness/; see each pattern’s Lineage §Formal model. Remaining lane: the 4 Alloy/structural drafts (Sonnet) and the ~17 lower-stakes TLA+ models (minus any removed by the bar reconsideration). The reproducible dual harness (tools/harness/: TLA+ via tla-checker WASM, Alloy via the alloy.dist jar under an npm-provisioned JRE 17) was stood up and all pre-existing models audited through it — surfacing a never-typechecked assertion in capability.als (fixed) and two further findings (see §”Harness audit findings” below). The next move on the atom side is one of the two remaining unstarted planned atoms (#7 Provenance, #9 State Machine); on the composition side, one of the nine unblocked-and-unstarted compositions (C2, C3, C6, C7, C9, C11, C15, C17, C18 — see compositions section).

Formal-layer vote sweep — 2026-06-03. A formal-layer vote was cast for all 38 then-grounded patterns per pressure-testing.md §Formal models. The 13 that remain fully grounded: model present (7) — Capability, Attributed Permissions Admin, External Onboarding, Login, Privileged Access Provisioning, Session-Gated Authorization, Multi-Party Approval; voted formal-not-warranted (6) — Actor Identity, Selective Disclosure, Tamper Evidence, Personal Todo, Soft Delete, Notification Fanout. The other 25 voted YES but have no formal model authored yet; they are downgraded to grounded (English) — formal layer pending and constitute the model backlog. Update 2026-06-03: The entire formal-model backlog has landed — all 38 patterns are fully grounded. The 18 TLA+ models (the four high-stakes; the Med–High tier Assignment, Medication Order, Preference, Approval Step; the two kept clock candidates Provisional Commitment, Duplicate Prevention; the five remaining High-stakes Credential, Invitation, Idempotent Reservation, Defensible Retention, Customer Onboarding; and the three Med Legal Hold, Shared Todo, Undo History) plus the 4 Alloy structural models (Permissions, Notification, Subscription, Clinical Observation — Sonnet-drafted, Opus-gated via review + independent buggy-twin run). A bar reconsideration restored three (Retention Window, Session, Consent) to fully grounded as English-only. Zero pending.

Formal-model backlog (triage — 2026-06-03). The 25 pending patterns, classified by property class → tool, with a suggested author by subtlety/stakes. Each model also ships a buggy twin (a deliberately-wrong variant the checker must reject) as the vacuity guard, and findings fold back into the canonical English per the conflict protocol. This table is the single home for the tool/author assignment (per DRY, it is deliberately not duplicated into each spec’s vote entry — the vote entries carry the why, the load-bearing invariants).

Alloy / structural — Sonnet may draft, Opus reviews:

Pattern	Tool	Author	Load-bearing property
Permissions ✅ landed 2026-06-03	Alloy	Sonnet draft → Opus gate	Active→Revoked monotonicity; terminal absorption — `permissions.als` + buggy twin (revoke drops Active precondition; 2 checks find counterexamples)
Notification ✅ landed 2026-06-03	Alloy	Sonnet draft → Opus gate	status monotonicity; terminal exclusivity — `notification.als` + buggy twin (timestamp `iff`→`implies`; 5 checks find counterexamples)
Subscription ✅ landed 2026-06-03	Alloy	Sonnet draft → Opus gate	at-most-one-active per key; no-id-reuse — `subscription.als` + buggy twin (drops at-most-one-active fact; check finds counterexample)
Clinical Observation ✅ landed 2026-06-03	Alloy	Sonnet draft → Opus gate	linear amendment chains (no branching) — `clinical-observation.als` + buggy twin (`lone`→`set` successor; 2 checks find counterexamples)

TLA+ / behavioral — Opus authors (interleaving, ordering, time, cascade):

Pattern	Tool	Stakes	Load-bearing property
Party Identity ✅ landed 2026-06-03	TLA+	High	Verified requires passed-after-most-recent-suspend (insertion order) — `party-identity.tla` + buggy twin (re-introduces the F3 defect; rejected at 22 states); 532 states clean
Event Log ✅ landed 2026-06-03	TLA+	High (foundational)	append-only + sequence monotonicity — `event-log.tla` + buggy twin (volatile-restart resets seq to 1; rejected at 14 states); 119 states clean
Audit Trail ✅ landed 2026-06-03	TLA+	High (substrate)	cascade-on-purge atomicity across 4 stores; honest-destruction — `audit-trail.tla` + buggy twin (non-atomic cascade → dangling partial; rejected at 4 states); 9 states clean
Capacity Constraint Enforcement ✅ landed 2026-06-03	TLA+	High	allocated ≤ capacity under serializable concurrency — `capacity-constraint-enforcement.tla` + buggy twin (TOCTOU check-then-commit overshoots to 3>2; rejected at 27 states); 7 states clean
Credential ✅ landed 2026-06-03	TLA+	High	active uniqueness under concurrent register — `credential.tla` + buggy twin (TOCTOU register → two Active; rejected at 33 states); 105 states clean
Invitation ✅ landed 2026-06-03	TLA+	High	single-resolution atomicity under concurrent accept/decline/revoke — `invitation.tla` + buggy twin (re-resolution override; rejected at 6 states); 5 states clean
Idempotent Reservation ✅ landed 2026-06-03	TLA+	High	exactly-once-in-window; unsafe eviction ordering — `idempotent-reservation.tla` + buggy twin (early eviction → double-effect; rejected at 14 states); 17 states clean
Defensible Retention ✅ landed 2026-06-03	TLA+	High	hold-blocks-purge (named race); multi-hold independence — `defensible-retention.tla` + buggy twin (purge ignores active hold; rejected at 8 states); 7 states clean
Customer Onboarding (C8) ✅ landed 2026-06-03	TLA+	High	adverse-trigger-precedes-suspend; open-trigger ⇔ Suspended — `customer-onboarding.tla` + buggy twin (suspend without trigger; rejected at 3 states); 3 states clean
Assignment ✅ landed 2026-06-03	TLA+	Med–High	reassign atomicity (no observable both/neither Active) — `assignment.tla` + buggy twin (non-atomic reassign → two-Active window; rejected at 6 states); 47 states clean
Medication Order ✅ landed 2026-06-03	TLA+	Med–High	hold carries prior_state; reinstate restores exactly it — `medication-order.tla` + buggy twin (reinstate-to-default; rejected at 11 states); 31 states clean
Preference / Personalization ✅ landed 2026-06-03	TLA+	Med–High	supersession atomicity (no observer sees two in-effect) — `message-preference.tla` + buggy twin (non-atomic supersession → two-in-effect; rejected at 5 states); 32 states clean
Approval Step ✅ landed 2026-06-03	TLA+	Med–High	approver/submitter exclusivity; concurrent step independence — `approval-step.tla` + buggy twin (unguarded approve; rejected at 4 states); 16 states clean
~~Consent~~ 🟢 reconsidered → NO (English-only), 2026-06-03	—	Med	earlier-terminal-event-wins (revoke vs expiry) — precedence by insertion order; records-alone, no model
Legal Hold ✅ landed 2026-06-03	TLA+	Med	concurrent-hold independence/isolation — `legal-hold.tla` + buggy twin (cascading release; rejected at 12 states); 27 states clean
~~Session~~ 🟢 reconsidered → NO (English-only), 2026-06-03	—	Med	conjunctive validity; revoked-precedes-expired — conjunction of record fields; interleaving lives in Session-Gated Authorization
~~Retention Window~~ 🟢 reconsidered → NO (English-only), 2026-06-03	—	Med (clock)	no-early-purge — single-action time-gated precondition; hold-blocks-purge race lives in Defensible Retention
Provisional Commitment ✅ landed 2026-06-03	TLA+	Med (clock)	confirm-within-window (expiry race) — kept YES, then modeled: `provisional-commitment.tla` + buggy twin (confirm-after-window; rejected at 10 states); 17 states clean
Duplicate Prevention ✅ landed 2026-06-03	TLA+	Med (clock)	single-recording; window monotonicity — kept YES, then modeled: `duplicate-prevention.tla` + buggy twin (re-record extends window; rejected at 11 states); 14 states clean. Surfaced + fixed a conflict-protocol case-2 model mis-encoding (lagging flag → derived membership)
Shared Todo ✅ landed 2026-06-03	TLA+	Med	cascade-on-delete (recall before delete); at-most-one-responsible — `shared-todo.tla` + buggy twin (delete without recall → dangling assignment; rejected at 4 states); 3 states clean
Undo History ✅ landed 2026-06-03; extended Tier A+B 2026-06-14	TLA+	Med	Inv 1/2/3/4 machine-checked over a real event-sourcing replay (`derived` = `StatusOf` replay, not an integer abstraction): log faithfulness, state equivalence, undo targeting, replay validity — `undo-history.tla` + 3 buggy twins (oldest-targeting → Inv 3/4; stale-undo → Inv 2; phantom-append → Inv 1), one vacuity guard per checked invariant; 563 states clean at MaxEvents=4/Ids={1,2}

Tally (original aggressive bar): ~4 Alloy/Sonnet, ~21 TLA+/Opus. Final 2026-06-03 state: all 18 TLA+ models landed (corroborating their English specs; one surfaced a conflict-protocol case-2 model mis-encoding, fixed in the derivation), 3 downgraded to English-only on the bar reconsideration (Retention Window, Session, Consent), leaving only the 4 Alloy/Sonnet structural drafts pending. The bar reconsideration was the right lever, exactly as anticipated here: the clock-based and precedence entries were the defensible “English + records-alone is sufficient” reconsiderations, and three of the five cleared it. Harness is settled (tools/harness/), so each model’s pass/fail is mechanical.

Harness chosen — tools/harness/ (2026-06-03). One reproducible dual harness, provisioned npm-only (no firewalled downloads): TLA+ via the tla-checker WASM checker (extends the original grants/tla-poc/run.mjs approach), Alloy via the org.alloytools.alloy.dist jar running headless under an npm-provisioned JRE 17 (javajre-linux-64; the JRE lives on the native /tmp FS because unpacking it into the mounted repo drops libjli.so). node check.mjs <model> [--buggy] enforces correct-holds / buggy-rejected; node audit.mjs runs every model. Each backlog model ships with a buggy twin as the vacuity guard. See tools/harness/README.md.

Harness audit findings (2026-06-03). All nine pre-existing formal models were run through the new harness. Six were clean (session-gated-authorization.als, attributed-permissions-admin.als, login.tla, attributed-permissions-admin.tla, MultiPartyApproval.tla + buggy twin). Three findings, all in patterns marked grounded, all outside the formal-model backlog — logged here for routing:

capability.als — never-typechecked assertion (fixed). Line 193 read r.status = Revoked implies no (r.status = Expired) — no applied to a boolean. The file never typechecked under the CLI, so assertion A_TerminalModesDistinguishable was never actually checked despite Capability shipping grounded on Final Critique 4. Corrected to r.status != Expired (case-2 model mis-encoding; English untouched). With it fixed, all 22 check assertions now run and hold — but the run surfaced a second finding: 4 vacuous run commands (ShowExhaustionTransition, ShowMultiUsePartialRedeem, ShowRevokeTransition, ShowExpireTransition) — transition examples with no instance in scope. Needs case-1-vs-2 diagnosis; not hand-patched.
privileged-access-provisioning.tla — not verifiable under the chosen checker. Its .cfg uses ACTION_CONSTRAINT, which the WASM checker does not support; the model returns NoInitialStates and is effectively unverified by this harness. Resolution is either the official tla2tools.jar (a firewalled download, unavailable in-sandbox) or a model rewrite expressing the constraint as an invariant.
external-onboarding.tla — low state count. Passes but explores only 44 states; worth confirming the bounds actually exercise the interleavings the English defends.

Atoms grounded (at grounded or grounded (English) — formal layer pending; see sweep note above):

compliance (13): Actor Identity, Capability, Consent, Credential, Invitation, Legal Hold, Party Identity, Permissions, Provenance, Retention Window, Selective Disclosure, Session, Tamper Evidence
healthcare (1): Medication Order — Clinical Observation was reframed to the neutral Observation on 2026-09-13 and carries no domain tag (see atoms/TAXONOMY.md)
messaging (3): Notification, Preference / Personalization, Subscription
productivity (2): Assignment, Personal Todo
resource-lifecycle (3): Capacity Constraint Enforcement, Provisional Commitment, Soft Delete
temporal (2): Duplicate Prevention, Event Log
workflow (2): Approval Step, State Machine

Atoms partially resolved: none — all 27 atoms are grounded. The three atoms downgraded 2026-08-24 by the Logic Confinement clock-injection touch each closed their downgrade round 2026-08-25, drew one round of routed foundational residue, and closed it under the re-grounding campaign (2026-08-26): Provenance re-grounds at grounded on Final Critique 7 — 2026-08-26, Capacity Constraint Enforcement at grounded on Final Critique 8 — 2026-08-26, and Preference / Personalization (Message Preference) at grounded on Final Critique 8 — 2026-08-26 — each closure gated by a fresh zero-foundational fresh-reader round, with only refining/rhetorical residue routed open (see each atom’s Lineage).

Compositions grounded (at grounded or grounded (English) — formal layer pending; see sweep note above): Session-Gated Authorization (re-grounded Final Critique 8 — 2026-08-26), Shared Todo (re-grounded Final Critique 6 — 2026-08-26), Undo History (re-grounded Final Critique 6 — 2026-08-26, the re-grounding campaign’s first composition to clear). (Actor Suspension, Defensible Retention, Forensic Recovery, Immutable Transaction Ledger and Resolve a Person’s Data Rights, listed here until 2026-08-30, are back at partially resolved under the frozen-rule sweeps and third gates — see the next line and each table row.)

Compositions partially resolved: Audit Trail (returned 2026-08-30 by the sweep under the frozen rules — the reconciliation’s protocol changed; see the table row), Authenticated Actor (returned 2026-08-30 by the same sweep — the attest gate restated under a declared per-principal section with the external-revoke residue named, the orphaned credential re-entering at step 3, positioned rejection codes; see the table row), Attributed Permissions Admin (returned 2026-08-30 by the same sweep — the Failed-Grant Reconciliation leg restated as report-only and bounded at both edges, the pairing-write atomicity promoted to a declared instance capability; see the table row), Preference-Aware Notification Fanout (returned 2026-08-30 by the same sweep — the deliver pair restated as ordered writes with an adoptable orphan, one writer per disposition under a declared section; see the table row), Compensable Workflow (returned 2026-08-30 by the same sweep — attempt markers before every effect, a declared per-run section, the effect-side key discipline and store durability declared as instance capabilities; see the table row), Idempotent Reservation (returned 2026-08-30 by the same sweep — the pending intent and re-entry arm in place of a claimed cross-store atomicity, one writer per token under a declared section, Duplicate Prevention’s host obligations declared; see the table row), Capability-Backed Sharing, Chain of Custody, Customer Onboarding, Defensible Retention, Execute Gated Workflow, Forensic Recovery, Immutable Transaction Ledger with Selective Disclosure, Multi-Party Approval, Privileged Access Provisioning, Propagate Consent Revocation Downstream, Reserve from Pool, Resolve a Person’s Data Rights — seven of the eight downgraded 2026-08-24 by the Logic Confinement clock-injection touch (the eighth, Defensible Retention, re-grounded 2026-08-26 on Final Critique 7 under the re-grounding campaign). Every one of those downgrade rounds’ findings (50 foundational + their refining across the eight) was closed 2026-08-25 in one folded round per pattern, but each closure’s own fresh-reader gate returned new foundational residue, routed open per the campaign stop rule — Multi-Party Approval 4 (FC9 — Final Critique 8’s four closed 2026-08-26 in the joint recovery-machinery sweep run with Execute Gated Workflow; the full-residue gate, Final Critique 9, routed four new — the submit-before-append orphan, the cascade-crash stranded assignment, the retention-horizon rebuild source, and the lawfully-terminated quarantined chain), Privileged Access Provisioning 1 (FC7 — F1–F3 closed 2026-08-26 in the crash-seam round; the terminal-reason miscite remains), Defensible Retention 2 (FC6 — since closed; re-grounded Final Critique 7, 2026-08-26), Propagate Consent Revocation Downstream 2 (FC7 — the FC6 four closed 2026-08-26), Customer Onboarding 4 (FC7’s one, plus the authentication-precedence round’s three gate findings — the enumeration-surface class, the phantom open trigger, and the prematurely-stamped review deadline; that round closed by construction what this pattern had closed by declaration), Execute Gated Workflow 2 (FC9 — Final Critique 8’s three closed 2026-08-26 in the same joint sweep; the full-residue gate, Final Critique 9, routed two new — the undeclared caller-authentication assumption under the new invalid-credential landing, a cross-cutting corpus shape, and the pending-record consumption arm’s missing durability), Chain of Custody 4 (FC7’s three, plus the authentication-precedence round’s gate finding — the seal-range presentation contract, routed 2026-08-26; that round closed by construction what Final Critique 5’s F-6 had closed only by declaration, and extended the formal model with an intentState variable, a new Inv7_AuthPrecedence, and a second dedicated buggy twin), Reserve from Pool 3 (the authentication-precedence round closed Final Critique 8’s F1 in the same edit — its attestation had been prose at every site, so unlike the other patterns in the pass it verified the credential nowhere rather than late; its gate routed three new, all pre-existing) — see each pattern’s Lineage, where every routed finding carries its prescribed fix. The clock fix itself cleared every 2026-08-24 round. The per-pattern tally that used to sit here — “23 routed foundational currently open across the seven still partially resolved” — went stale and was replaced 2026-08-27 by the census below. (Audit Trail, the ninth 2026-08-24 downgrade, regrounded 2026-08-25 on Final Critique 11: its two routed Final Critique 10 residues closed and the eighth fresh-reader gate returned zero foundational — see the table row and its Lineage; returned to partially resolved 2026-08-30 by the sweep under the frozen rules.)

Batched pre-convention tail — 2026-08-26 (methodology debt #9): the eight compositions grounded before the June conventions received their composition-state classification folds (Idempotent Reservation’s had already landed in its 2026-06-18 round) and one fresh-reader gate each. One gate returned clean — Attributed Permissions Admin re-grounded on Final Critique 7 with sixteen refining/rhetorical folded. Six returned foundational residue over the folds, routed open per the campaign stop rule and downgraded: Login 1 (FC7 — F1/F3/F4/F5 closed 2026-08-26 across three triage rounds; check 3 vs conformant skips remains), External Onboarding 2 (FC7 — F1/F2/F4/F6 closed 2026-08-26; check 2 vs rotation and the unwired authorization remain), Shared Todo 3 (FC5 — since closed; re-grounded Final Critique 6, 2026-08-26), Undo History 2 (FC5 — since closed; re-grounded Final Critique 6, 2026-08-26), Session-Gated Authorization 2 (FC7 — since closed; re-grounded Final Critique 8, 2026-08-26), Notification Fanout 1 (FC5 — since closed composition-owned, though its closure gate Final Critique 6 routed one new foundational, the fired_at query-moment pin) — 4 routed foundational currently open from the tail (Login 1, External Onboarding 2, Notification Fanout 1), every one carrying its prescribed fix in the pattern’s Lineage.

The healthcare atoms (Clinical Observation, Medication Order) are outside the core dependency-ordered sequence — they were authored as worked examples of the methodology applied to a domain where the regulatory surface is HIPAA (Health Insurance Portability and Accountability Act) and 21 CFR Part 11 rather than the BSA (Bank Secrecy Act) / AML (Anti-Money Laundering) / GDPR (General Data Protection Regulation) / SOX (Sarbanes-Oxley Act) cluster the compliance atoms anchor. They are grounded and composable; their downstream compositions (e.g., a Clinical Trial Data Capture composition, a Medication Administration Record composition) are not on this roadmap yet because the worked-example value is in the atoms themselves rather than in any specific composition the library is committed to delivering next.

Planned-sequence atoms — all grounded (roadmap history)

All of atoms #7–#14 are now grounded; none remains on the planned sequence. The detailed entries below are retained as roadmap history (originally sequenced by how many downstream compositions each unblocked).

7. Provenance

Category: compliance — resolved to compliance (compliance-infrastructure primitive, regulated overlay).

Status: grounded on Final Critique 7 — 2026-08-26 (re-grounded: the Final Critique 6 routed findings — one foundational + sixteen refining/rhetorical — closed 2026-08-26; the closure gate, Final Critique 7, returned zero foundational, with ten refining + six rhetorical routed open, non-blocking — see Lineage. History: downgraded 2026-08-24, Final Critique 5’s five foundational closed 2026-08-25, gated by Final Critique 6. Prior: grounded 2026-06-04 — Alloy model provenance.als + buggy twin verified in tools/harness/). Sonnet-drafted against an Opus plan; Opus-gated through Pass 1 / 2 / 3 + Final Critique (two foundational + four refining findings closed in-pattern). Unblocks Chain of Custody (C12). The descriptive entry below is retained as roadmap history.

What it is. A compliance and temporal primitive: an append-only chain recording the origin, custody history, and transformation history of a record or artifact. Provenance answers where did this come from, who has handled it, and what has been done to it. It is distinct from Event Log (which records what happened in a system) and from Actor Identity (which verifies who performed an action) — Provenance specifically models the chain of custody of a thing, not a stream of system events. Each custody event is immutable once recorded; the chain is append-only.

Why it’s next. Of the remaining atoms, Provenance is the highest-leverage in terms of composing surface: it strictly blocks Chain of Custody (C12) — the library’s cross-domain reference case spanning pharmaceutical and legal-evidence custody — and additionally enriches Immutable Transaction Ledger (C6), Resolve a Person’s Data Rights (C7), and Customer Onboarding (C8) as an optional composing atom for chain-of-custody guarantees. The scoping requires careful EOS Pass 2 work to establish what “this thing’s custody history” means without absorbing the event-log or actor-identity responsibilities — the boundary against Event Log is the key conceptual-independence test.

Key invariants (anticipated). Each provenance entry is immutable once recorded. The chain is append-only — no entry is removed or reordered. Every entry names a custodian (an actor reference), a timestamp, and an event type (originated, received, transformed, transferred, disclosed, archived). The chain is complete — no custody gap is permitted between recorded entries; a gap is a finding, not a valid state.

Standards anchored. ISO 23081 (records management metadata — provenance as a required metadata element); W3C PROV (data provenance ontology); FDA 21 CFR Part 211 (pharmaceutical chain of custody); SEC (Securities and Exchange Commission) Rule 17a-4 (records must be maintained as originally created — provenance of the original form).

Unlocks. Strictly blocks Chain of Custody (C12) — Provenance is C12’s core atom, not an enrichment. Additionally enriches Immutable Transaction Ledger (C6), DSAR (C7), and Customer Onboarding (C8) as an optional composing atom for chain-of-custody guarantees; those three are unblocked without Provenance but gain emergent invariants when composed with it.

9. State Machine

Category: workflow

Status: grounded 2026-06-04 (Alloy model state-machine.als + buggy twin verified in tools/harness/). Sonnet-drafted against an Opus plan; Opus-gated through Pass 1 / 2 / 3 + Final Critique (one foundational + one refining finding closed). Unblocks Execute Gated Workflow (C10) and resolves the workflow-category one-atom open question (it is the second workflow atom). The descriptive entry below is retained as roadmap history.

What it is. A workflow primitive: a named entity moving through a defined, finite set of states via explicitly declared transitions. The atom does not know what the entity is — it knows the entity’s current state, the transitions that are valid from that state, and the history of how it got there. States and transitions are declared at instantiation; the atom enforces that only declared transitions are applied and that the full transition history is auditable. A Workflow instance has exactly one current state at all times; concurrent active states and fork-join constructs are composing concepts, not part of the atom.

Why it’s after Capacity Constraint. Approval Step (atom #4, grounded) opened the workflow/ category but left it a single-entry category. State Machine is the general primitive that justifies the category: Approval Step is a specific kind of state machine (one designed for human approval decisions); State Machine is the general case. The two atoms compose into Execute Gated Workflow (C10), which produces multi-actor gated workflows with tamper-evident transition histories — a pattern that recurs in regulated manufacturing, financial operations, and HR processes. Once this atom lands, the workflow category stands on its own and the broader axial-split taxonomy question can be revisited with two workflow atoms as evidence.

Key invariants (anticipated). Only declared transitions are valid — an undeclared transition is rejected with invalid-transition. The current state is always exactly one of the declared states. The full transition history — prior state, target state, triggering action, timestamp, actor — is auditable and append-only. A state declared as terminal at instantiation is absorbing — no further transitions are accepted. Transition guards are declared at instantiation; the atom enforces that a guard must be satisfied before a transition fires, but does not evaluate the guard — that is the caller’s obligation.

Standards anchored. FDA 21 CFR Part 11 (electronic records in regulated workflows — each state transition is a regulated event); ISO 9001 §8.5.1 (production workflow controls); BPMN 2.0 (the canonical notation for stateful workflow — this atom is the primitive behind a BPMN state diagram); HL7 (Health Level Seven) FHIR (Fast Healthcare Interoperability Resources) Task resource (clinical workflow state machine — Task states map directly to this atom’s state machine).

Unlocks. Execute Gated Workflow (C10). Resolves the workflow-category one-atom question (resolved 2026-06-04 — the category now stands on two grounded atoms).

10. Preference / Personalization

Category: messaging

Status: grounded on Final Critique 8 — 2026-08-26 (re-grounded: the Final Critique 7 routed set — two foundational + nine refining/rhetorical — closed 2026-08-26; the closure gate, Final Critique 8, returned zero foundational, with nine refining + four rhetorical routed open, non-blocking — see Lineage. History: downgraded 2026-08-24; Final Critique 6’s three foundational closed 2026-08-25 incl. the channel-set seam-injection redesign. Prior: grounded on Final Critique 5 — 2026-05-29). Author-conducted foundation passes (Pass 1 GRID, Pass 2 EOS, Pass 3 Linus) and one refinement round; fresh-reader AI Phase 3 round (2026-05-25); first Opus Phase 4 gate (2026-05-25 — Final Critique 4) surfaced 3 foundational findings, all closed; the 2026-05-29 fresh-reader Phase 3 + Opus Happy Torvalds X2 rerun (Final Critique 5) returned zero foundational findings (17 refining, 1 rhetorical, all closed in-pattern) and grounds the atom. It lives at atoms/message-preference.md. The five anticipated invariants below are realized as ten hard invariants (record immutability, status monotonicity, at-most-one-currently-in-effect, supersession atomicity, channel-set membership at creation, value-preserving suspension, query determinism, no id reuse, store durability, configuration-record integrity) plus Temporal property 11 (timestamp ordering, best-effort under non-monotonic clocks).

What it is. A messaging primitive: a durable binding of a principal’s delivery preferences — channel priority, frequency limits, quiet hours, format preferences, per-topic opt-downs — that governs how a notification reaches a recipient, independently of whether they are subscribed (Subscription) or whether processing is legally permitted (Consent). The three atoms are distinct: Subscription governs which topics a principal follows; Consent governs whether the system may process or communicate with the principal at all; Preference governs the delivery envelope when Subscription and Consent have both permitted the notification. States: Active, Suspended (preferences retained but delivery suppressed for the principal), Deleted.

Why it’s last. Subscription, Notification, and Notification Fanout are all grounded; Consent is grounded. The next natural question in the messaging surface is: how does a subscriber control the shape of delivery? Preference / Personalization is the atom that answers it. It sits last in the planned sequence because the composing surface (Preference-Aware Notification Fanout, C11) is narrower than the other remaining atoms’, not because the atom is less important — it just unblocks one composition rather than several.

Key invariants (anticipated). A principal has at most one active Preference record — preferences are not additive; a new preference set replaces the prior one (with the prior set retained in history). Preference updates are not retroactive — a notification already queued before an update is delivered under the prior preferences; the update governs future deliveries only. A Suspended Preference record suppresses delivery without removing subscriptions — the subscriber retains their topic bindings while suppressing notifications. Preference / Personalization does not define what channels exist or what format options are valid — those are deployment-specific enumerations declared at instantiation.

Standards anchored. CAN-SPAM Act (opt-out and frequency controls for commercial email); TCPA (frequency and consent controls for SMS and phone marketing); GDPR Article 7(3) (preference changes must be as easy as the original grant — the Preference atom’s update action is the mechanism).

Unlocks. Preference-Aware Notification Fanout (C11).

11. Credential

Classification: stored flat as atoms/credential.md — no category folder. Its regulated and security classifications are overlays derived from its composers, not a folder it is filed under; this resolves the former provisional compliance/ placement and the question of a dedicated security/identity folder. See the usage-derived taxonomy.

Status: grounded 2026-05-19 (Final Critique 4); formal layer landed 2026-06-03 (credential.tla + buggy twins). Retained below as roadmap history.

What it is. An authentication primitive: a durable binding between a principal and a secret or token that the principal presents to prove they are who they claim to be. Credential models the registration of that binding, the verification of presented material against it, the rotation of the binding to a new secret while retiring the prior one, and the revocation of the binding entirely. Each credential record is tied to exactly one principal at registration and that binding is immutable; rotation produces a new credential record bound to the same principal, never a mutation of the prior one. The prior record transitions to the terminal state Rotated, preserving the full rotation history in the record store. Actions: register, verify, rotate, revoke.

Why it’s next. Credential retires the Authentication *(forthcoming)* debt in atoms/actor-identity.md — Actor Identity verifies who an actor is; Credential is the mechanism by which that verification is operationalized as a bound secret the actor can present. The two atoms are distinct: Actor Identity is a persistent identity record; Credential is the authentication surface the identity record can bind. Of the four new atoms, Credential and Session are the highest-leverage pair: Credential strictly blocks C13 (Login), which wires Credential verification to Session issuance. It additionally enriches C16 (External Onboarding), where a credential is registered at the moment an invited party’s identity is accepted.

Key invariants (anticipated). verify returns verified only for the principal bound at registration — sole-holder verification is absolute. Once a credential transitions to Revoked, no future verify call returns verified — revocation is absorbing. Rotation never mutates the prior credential record; it produces a new record and transitions the prior record to Rotated. State machine: Active → Rotated Revoked Expired (three terminal states). The full rotation and revocation history is auditable from the record store alone.

Standards anchored. NIST SP 800-63B (authenticator assurance levels — IAL/AAL tiers); OpenID Connect Core 1.0 (credential material exchange); RFC 7519 (JWT — credential token encoding); FIDO2/WebAuthn (phishing-resistant authenticator binding); PCI DSS (Payment Card Industry Data Security Standard) Requirement 8 (credential management controls); ISO/IEC 27001 §A.9.4 (system and application access controls). Explicitly not citing NIST 800-63A — identity proofing belongs upstream to Party Identity.

Unlocks. Strictly blocks C13 (Login — Credential + Session + Actor Identity). Additionally enriches C16 (External Onboarding — the credential registration step in the onboarding arc).

12. Session

Classification: stored flat as atoms/session.md — no category folder. Its regulated and security classifications are overlays derived from its composers, not a folder it is filed under; this resolves the former provisional compliance/ placement and the question of a dedicated security/identity folder. See the usage-derived taxonomy.

Status: grounded 2026-05-19 (Final Critique 4); formal-layer vote reconsidered to NO (formal-not-warranted; records-alone, interleaving lives in Session-Gated Authorization). Retained below as roadmap history.

What it is. A time-limited authenticated channel primitive: a record attesting that a given principal was authenticated at a specific moment and that the authentication remains valid until the session expires or is explicitly revoked. Session does not perform authentication — that is Credential’s surface. Session records the result of a successful authentication and makes it queryable by composing systems for the duration of its validity. Each session carries an expires_at timestamp set at issuance and never mutated; extension of a session produces a new session record, not a modification of the prior one. Actions: issue, validate, expire, revoke. State machine: Active → Expired Revoked (two terminal states).

Why it’s next. Session is the time-bounding surface that Credential verification produces: a successful verify produces a short-lived authenticated channel; that channel is a Session. Without Session, Credential verification has no durable expression that composing systems can query — Login (C13) needs both. Session additionally unblocks Session-Gated Authorization (C14), which gates every permission check on session validity before the permission check runs.

Key invariants (anticipated). A session is valid if and only if it has been issued, now < expires_at, and it has not been revoked — the validity bound is conjunctive. validate(token) returns valid | invalid(expired | revoked | not-known) — three first-class invalid outcomes, mirroring Actor Identity’s verify discipline, never collapsed to a single invalid. Revocation is absorbing: a revoked session cannot be re-validated. expires_at is set at issue time and never mutated; a session that needs a longer lifetime is re-issued, not extended in place.

Standards anchored. NIST SP 800-63B §7 (session management and reauthentication requirements); OWASP ASVS V3 (session management verification standard); RFC 6265 (HTTP state management — cookie-based session binding); SAML 2.0 §4.1.4 (session establishment and termination); RFC 6819 (OAuth 2.0 threat model, session-related threat mitigations); OIDC Session Management 1.0 (session lifecycle and logout across identity providers).

Unlocks. Strictly blocks C13 (Login — Credential + Session + Actor Identity) and C14 (Session-Gated Authorization — Session + Permissions).

13. Capability

Classification: stored flat as atoms/capability.md — no category folder. The object-capability literature anchors it as a security primitive; under the usage-derived taxonomy that shows up as a derived security overlay (alongside regulated), not a folder placement. This resolves the former provisional compliance/ placement. See the usage-derived taxonomy.

Status: grounded 2026-05-19 (Final Critique 4; Alloy model capability.als + buggy twin). Retained below as roadmap history.

What it is. A bearer-token authorization primitive: an unforgeable token that carries its own authorization to access a specific resource or perform a specific action. The defining property of a Capability is that possession of the token is sufficient authorization — the redeemer’s identity is intentionally irrelevant at redemption time. Capability generalizes single-use links (a password-reset link), multi-use API tokens (a service credential scoped to a single resource), and pre-authorized action tokens under one structural pattern. Each capability carries a remaining_redemptions counter set at allocation (default 1) and decremented monotonically on each redemption; a capability with remaining_redemptions = 0 is exhausted and terminal. Actions: allocate, redeem. State machine: Allocated → Redeemed Expired Revoked (three terminal states, with exhaustion via counter being the structural route to Redeemed).

Why it’s next. Capability is the library’s forcing function for making the OCAP-vs-Permissions distinction explicit. Permissions is identity-keyed: a permission check gates on who is asking. Capability is bearer-keyed: the token gates on what is being presented, with no identity check at redemption time. The two atoms compose into structurally distinct patterns with different audit signatures. Without a Capability atom, a composing system is forced to model bearer-token semantics inside Permissions or an ad-hoc construct, hiding the architectural distinction the library exists to make visible. Capability strictly blocks C15 (Capability-Backed Sharing), the library’s worked example of bearer-token semantics composing with regulated audit.

Key invariants (anticipated). Redemption requires only possession of the token — no identity check at redemption time; the redeemer’s identity is structurally irrelevant and intentionally so. The allocator’s identity is recorded at allocation time and attestable via Actor Identity, producing an asymmetric audit record: allocator is known, redeemer is not. remaining_redemptions is set at allocation and decremented monotonically; it never increases. Exhaustion (counter at 0), expiry, and revocation are three structurally distinct terminal modes and are never conflated in the record or in validation logic.

Standards anchored. Daniel Jackson, Software Abstractions — Capability [Resource] concept (the atom’s structural core); Mark Miller and the object-capability (OCAP) literature (bearer-key authorization semantics); Levy (1984), Capability-Based Computer Systems (canonical reference for bearer-token capability semantics); Birgisson et al. (2014), Macaroons (context-limited bearer credentials — a constrained Capability variant); RFC 6749 §1.4 (OAuth 2.0 access tokens — cited with explicit caveats about OAuth’s identity-bound conflations diverging from pure OCAP; this atom defines the pure OCAP surface, not the OAuth surface).

Unlocks. Strictly blocks C15 (Capability-Backed Sharing — Capability + Selective Disclosure + Audit Trail substrate). The atom’s primary value on EOS Pass 2 is forcing the OCAP-vs-Permissions distinction to be made explicit in the library.

14. Invitation

Classification: stored flat as atoms/invitation.md — no category folder. Its core responsibility is onboarding an external entity into a system identity context; under the usage-derived taxonomy that is captured by its derived security and regulated overlays rather than a dedicated identity folder. This resolves the former provisional compliance/ placement. See the usage-derived taxonomy.

Status: grounded 2026-05-19 (Final Critique 4); formal layer landed 2026-06-03 (invitation.tla + buggy twin). Retained below as roadmap history.

What it is. A lifecycle primitive for inviting an external entity to join a context: a durable record of the invitation event itself, from the moment the invitation is issued through its resolution — accepted, declined, expired, or revoked before resolution. The defining property of Invitation is that the invitee’s identity may not be known or validatable at initiation time; the moment of acceptance is when an identity is bound. Actions: initiate, accept, decline, revoke, expire. State machine: Pending → Accepted Declined Expired Revoked (four terminal states). accept carries an accepting_identity_ref argument — the identity is bound at the moment of acceptance and is immutable thereafter.

Why it’s next. Invitation is the library’s mechanism for onboarding an unknown external entity into a system identity context. Party Identity (atom #6, grounded) models a persistent verifiable identity; Invitation is the gate through which an external party first enters the identity surface. Without Invitation, the library has no structured account of how an external party comes to exist in the system at all — C16 (External Onboarding) cannot be specified without it. Invitation also completes the Capability-vs-Invitation design question (see Open taxonomy question): both atoms use bearer-token transport; the distinction is that Invitation carries Declined as a first-class semantic outcome (a human decision, not a system event) and binds an identity at resolution — two properties Capability does not have.

Key invariants (anticipated). Exactly one transition out of Pending — once an invitation has been accepted, declined, expired, or revoked, any subsequent action attempt returns already-resolved(state). The invitee_ref at initiation may not resolve to a known system identity; it is not validated at initiate time and is not required to match the accepting_identity_ref at accept time — opaque invitee at initiation is structurally intentional. The identity bound at acceptance (accepting_identity_ref) is immutable once set; it cannot be rebound or updated after the accept transition.

Standards anchored. GDPR Article 32 (security of processing — invitation tokens are credentials in transit and must be treated accordingly); HIPAA §164.312 (access control requirements — invitation-based provisioning is a covered access-granting mechanism); SCIM 2.0 (System for Cross-domain Identity Management — invitation-style user provisioning is adjacent to SCIM’s POST /Users with an invite flow). Standards anchoring is lighter for Invitation than for Credential, Session, or Capability; the atom earns its keep on EOS Pass 2 conceptual independence rather than regulatory depth.

Unlocks. Strictly blocks C16 (External Onboarding — Invitation + Party Identity + Credential + Audit Trail substrate).

Grounded atoms — short status (formerly atoms #1–#6, #8)

The seven atoms below were on the planned sequence and have shipped. Detailed authoring notes are in the atom files themselves; the entries below are retained as roadmap-history.

Legal Hold — grounded on Final Critique 4 — 2026-05-20. Compliance primitive; actor-issued hold preventing record purge regardless of retention eligibility. Unblocked C1 (Defensible Retention, now grounded) and C7 (DSAR).
Consent — grounded on Final Critique 5 — 2026-06-23. Compliance primitive; data subject’s agreement to a specified processing purpose with grant/revoke/expire lifecycle. Unblocked C2 (Propagate Consent Revocation Downstream), C7 (DSAR), C8 (Customer Onboarding).
Soft Delete — grounded on Final Critique 4 — 2026-05-20. Resource-lifecycle primitive; recoverable deletion with explicit purge. Unblocked C3 (Forensic Recovery).
Approval Step — grounded on Final Critique 5 — 2026-07-12. Workflow primitive; single approval gate with Pending/Approved/Rejected/Withdrawn lifecycle. Unblocked C4 (Multi-Party Approval, now grounded). First entry in workflow. FC5 (2026-07-12 scheduled rescan) promoted Invariant 9 to an explicit checked predicate in the TLA+ model and surfaced the guard-clock placement revision fixed in execution-contract.md.
Selective Disclosure — grounded on Final Critique 5 — 2026-06-23. Compliance primitive; durable record of what subset of a record was disclosed, to whom, when, and under what authority. Unblocked C6 (Immutable Transaction Ledger) and C7 (DSAR).
Party Identity — grounded on Final Critique 5 — 2026-07-12. Compliance primitive; persistent verifiable identity record for an external party with Unverified/Verified/Suspended/Closed lifecycle. Unblocked C8 (Customer Onboarding). Survived foundation round plus Opus Phase 4 clearance gate; six clearance-gate findings closed in-pattern. FC5 (2026-07-12 scheduled rescan) repaired the Invariant-7 erasure carve-out’s capability provenance (scrub re-declared to a forthcoming Erasure Coordination pattern) and specified the read query surface.
Capacity Constraint Enforcement — grounded on Final Critique 8 — 2026-08-26 (re-grounded: the Final Critique 7 routed set closed 2026-08-26 and the closure gate, Final Critique 8, returned zero foundational — see Lineage. History: downgraded 2026-08-24; Final Critique 6’s two foundational closed 2026-08-25. Prior: grounded on Final Critique 5 — 2026-05-20). Resource-lifecycle primitive; named, bounded pool of a finite resource with arithmetic enforcing total allocated never exceeds declared capacity under four named host obligations. Unblocked C9 (Reserve from Pool). Foundation round plus two Phase 4 Opus clearance-gate rounds (round 1: 11 foundational findings closed; round 2: 3 foundational + 5 refining + 1 rhetorical closed). First atom grounded under the 92%-good threshold codified in this revision of pressure-testing.md.

Compositions — current state

Compositions are sequenced by readiness. Historical milestone (2026-06-16): all eighteen original C-numbered compositions grounded (C1–C18), joined by Compensable Workflow (C19) — the first grounded composition from the dream-compositions pipeline beyond that backlog — for nineteen C-numbered grounded compositions at that date (twenty-five in all, counting the six that predate C-numbering). The count has since moved: after the 2026-08-24/25 closure campaign, the 2026-08-26 pre-convention tail, and the first closures of the 2026-08-26 re-grounding campaign, ten compositions hold at partially resolved with routed findings, leaving fifteen grounded — the aggregate lists under Current state above and the catalog rows below carry the per-pattern truth. The milestone record: C15 (Capability-Backed Sharing) grounded 2026-06-10 on Final Critique 4 — the 23rd grounded composition — Capability + Selective Disclosure + Audit Trail (substrate), reconciling bearer-token sharing with regulated disclosure audit through the audit-subject asymmetry (allocator named and attested; redeemer structurally unnamed, by construction on Capability Invariants 3/5) and the disclosure-accountability binding bijection, on clearance of the Phase 4 Opus Happy-Torvalds-X2 fresh-reader gate (foundational findings at zero, four refining/rhetorical folded, TLA+ binding-bijection model + non-atomic buggy twin re-verified, capability provenance and every constituent invariant count re-derived head-on against the constituent specs); C17 (Authenticated Actor) grounded 2026-06-10 on Final Critique 4 — the 21st grounded composition — Credential + Actor Identity, the revocation-cascade-as-forward-closure emergent guarantee, on clearance of the Phase 4 Opus Happy-Torvalds-X2 fresh-reader gate (foundational findings at zero, five refining folded, TLA+ revocation-cascade model + TOCTOU buggy twin re-verified, cascade gate confirmed housed at the composition layer); C18 (Actor Suspension) grounded 2026-06-10 on Final Critique 4 — the 22nd grounded composition — Actor Identity + Permissions + Session + Audit Trail (substrate) + optional Credential, the outbound multi-surface atomic de-authorization counterpart to Login, on clearance of the Phase 4 Opus Happy-Torvalds-X2 fresh-reader gate (foundational findings at zero, five refining folded, TLA+ atomic-cascade model + non-atomic buggy twin re-verified, capability provenance re-derived head-on so the Active/Suspended lifecycle is confirmed composition-introduced rather than mis-attributed to Actor Identity); C7 (Resolve a Person’s Data Rights) grounded 2026-06-09 on Final Critique 5 — the 20th grounded composition — on clearance of the Phase 4 Opus Happy-Torvalds-X2 gate (foundational findings at zero, six refining/rhetorical folded, formal model + twins re-verified); C11 (Preference-Aware Notification Fanout) grounded 2026-06-12 on Final Critique 9 — the 24th grounded composition, closing the C-numbered backlog at eighteen of eighteen (see §C11 grounded below); none is blocked on a remaining atom. C6 (Immutable Transaction Ledger with Selective Disclosure) grounded 2026-06-08 — Audit Trail (substrate) + Selective Disclosure, the first composition to compose the Selective Disclosure atom; ships a TLA+ disclosure-accountability binding-bijection model + buggy twin. C2 (Propagate Consent Revocation Downstream) and C9 (Reserve from Pool) grounded 2026-06-04 — C2 wires Consent + Permissions + Audit Trail (substrate) for the consent-gates-processing gate plus the revocation-propagation binding bijection; C9 wires Capacity Constraint + Provisional Commitment + Duplicate Prevention + Event Log + Actor Identity for the allocation-coherence guarantee (the pool-arithmetic superset of Idempotent Reservation). Both ship TLA+ models + buggy twins verified in tools/harness/. C3 (Forensic Recovery), C10 (Execute Gated Workflow), and C12 (Chain of Custody) all grounded 2026-06-04 — C10 immediately after its spine atom State Machine, C12 immediately after its core atom Provenance, C3 as an easy template-driven Soft Delete + Audit Trail substrate composition. C11 became unblocked when Preference / Personalization grounded on 2026-05-29. Provenance also enriches three other compositions (C6, C7, C8) as an optional composing atom for chain-of-custody guarantees — those compositions remain unblocked without it, but gain emergent invariants when composed with it once it lands.

Grounded

The nineteen C-numbered compositions are catalogued below (C1–C18, plus Compensable Workflow as C19), each row carrying its current status. (Six further compositions predate the C-numbering — Attributed Permissions Admin, Audit Trail, Idempotent Reservation, Privileged Access Provisioning, Shared Todo, Undo History — for twenty-five compositions in all; the grounded / partially-resolved split lives in the summary lists under Current state above.) Each has its full spec, Lineage notes, and — where the formal-layer vote was YES — a verified model + buggy twin in its own file.

C1. Defensible Retention — partially resolved (downgraded 2026-08-26 by the authentication-precedence touch — the first application of the new methodology rule: every state-changing action now opens with an intent record that both verifies the caller’s credential before any constituent commit and serves as the marker-before-act recovery record; its gate returned two foundational, routed open. Immediately prior: grounded on Final Critique 7 — 2026-08-26, re-grounded: Final Critique 6’s two foundational + 17 refining/rhetorical closed 2026-08-26 — the pinned step-5 return, the [Purge Eligible] sibling-liveness honesty rewrite; the closure gate, Final Critique 7, returned zero foundational — 13 refining/rhetorical routed open, non-blocking — see Lineage. Prior: grounded on Final Critique 4 — 2026-05-20). Legal Hold + Retention Window + Audit Trail (substrate). Hold-blocks-purge gate; lawful destruction provable from records alone. Anchors SOX §802, HIPAA §164.530(j), SEC Rule 17a-4, GDPR Article 17, FRCP Rule 37(e).
C2. Propagate Consent Revocation Downstream — partially resolved (Final Critique 6’s findings closed 2026-08-26 — the (step)-aware pre-checked recovery, authoritative audit rebuilds, hard per-consent serialization; the closure gate, Final Critique 7, returned two new foundational (check 2 unsound across the recovery window; the purge lifecycle resting on a qualifier Consent Invariant 8 does not carry — a candidate constituent touch) + 10 refining/rhetorical, routed open — see Lineage. Prior: grounded on Final Critique 4 — 2026-06-04). Consent + Permissions + Audit Trail (substrate). processing_permitted gate + revocation-propagation binding bijection. TLA+ model + buggy twin. Anchors GDPR Articles 6–7, 7(3), CCPA/CPRA, HIPAA §164.508.
C3. Forensic Recovery — partially resolved (downgraded 2026-08-26 by the authentication-precedence touch — round 2 of the destruction-path cluster; its prose had claimed in three places that it records an actor with a valid credential while the purge destroyed the record a step before the credential was verified. Its gate returned four foundational, all pre-existing, routed open. Immediately prior: grounded on Final Critique 4 — 2026-06-11, English 2026-06-04; coverage GAP closed 2026-06-11 — model covers both Invariant 4 arms). Soft Delete + Audit Trail (substrate). Every delete/restore/purge attributed, tamper-evident, recover_history-recoverable; no purge without an audit record. TLA+ binding-bijection model + buggy twin. Anchors GDPR Article 17, HIPAA §164.312(b), FRCP Rule 37(e), SOX §802.
C4. Multi-Party Approval — partially resolved (Final Critique 6’s eighteen findings closed 2026-08-26 — the terminal-path-split Invariant 2, the four-marker recovery discipline with its transition sweep, the all-case initiation recovery contract, budget-derived reference caps; Final Critique 7’s three foundational fully closed 2026-08-26 across the crash-seam and validation rounds (the sweep’s re-run closure duty with its detector legs; the evaluate-first gate; the non-whitespace reason check with the retry-transience partition); the full-residue gate, Final Critique 8, returned four new foundational — all in the new recovery machinery (the sibling-chain id-recovery hazard; the retried cascade’s deterministic not-pending; the initiator-less failure payload; the evaluate-first cascade’s attribution) — plus nine refining and three rhetorical, routed open — see Lineage §Final Critique 8. Prior: grounded on Final Critique 4 — 2026-05-20). Approval Step + Permissions + Assignment + Audit Trail (substrate). N approval steps under a quorum rule; first composition to compose another composition. Anchors SOX §404, FDA 21 CFR Part 11, ICH E6 GCP, ISO 9001 §8.5.1.
C5. Notification Fanout — partially resolved (Final Critique 5’s findings closed 2026-08-26 — the storage-failure mis-attribution resolved composition-owned at the write boundary; the closure gate, Final Critique 6, returned one new foundational (the closure’s query-moment fired_at pin unimplementable from the declared contract) + 12 refining/rhetorical, routed open — see Lineage. Prior: grounded on Final Critique 4 — 2026-05-20). Subscription + Notification. First composition to produce a variable number of effects from a single trigger. Completes the messaging atom pair.
C6. Immutable Transaction Ledger — partially resolved (downgraded 2026-08-26 by the authentication-precedence round — its disclosure action committed a permanent, non-removable disclosure-accounting record before verifying the caller’s credential; its gate routed three foundational, all pre-existing. Immediately prior: grounded on Final Critique 6 — 2026-06-10). Audit Trail (substrate) + Selective Disclosure. Disclosure-accountability binding bijection + verifiable partial disclosure; first to compose Selective Disclosure. TLA+ model + buggy twin. Anchors SEC Rule 17a-4, HIPAA §164.528, 21 CFR Part 11, GDPR Article 15.
C7. Resolve a Person’s Data Rights — partially resolved (downgraded 2026-08-26 by the authentication-precedence touch — round 3 of the destruction-path cluster and the nesting probe, since this composition purges through the Defensible Retention substrate touched in round 1 and the two share one Audit Trail instance. Its gate returned six foundational, all pre-existing, routed open. Immediately prior: grounded on Final Critique 5 — 2026-06-09). Selective Disclosure + Defensible Retention (C1, substrate) + Consent (read-only oracle). Per-record disposition with no-silent-omission + request⇔fulfillment binding bijection; erasure wraps C1’s purge gate. First composition authored under the capability-provenance rule. TLA+ binding + coverage model + two buggy twins. Anchors GDPR Articles 15–17, CCPA/CPRA, HIPAA §164.524 / §164.526 / §164.528.
C8. Customer Onboarding — partially resolved (Final Critique 6’s findings closed 2026-08-26 — the adverse pre-check, conditioned rebuild, party-closed guard, declined EDD delegation; the closure gate, Final Critique 7, returned one new foundational (the active-relationship retention can lawfully elapse mid-relationship — a missing renewal/guard obligation) + 16 refining/rhetorical, routed open — see Lineage. Prior: grounded on Final Critique 4 — 2026-06-03). Party Identity + Retention Window + Audit Trail (substrate). Verification-gates-activity via the composition’s own case index; adverse-trigger monitoring + post-closure retention floor. Anchors FATF Recommendations 10–12, BSA/AML 31 CFR §1020.220, FinCEN 31 CFR §1010.230, EU AMLD5, GDPR Article 6(1)(c).
C9. Reserve from Pool — partially resolved (Final Critique 7’s findings closed 2026-08-26 — the window-branched orphan recovery and Duplicate Prevention’s inherited host obligations; the closure gate, Final Critique 8, returned two new foundational (the unspecified Actor Identity attestation wiring; confirm’s unprotected irreversible-commit→journal seam) + 10 refining/rhetorical, routed open — see Lineage. Prior: grounded on Final Critique 5 — 2026-06-18). Capacity Constraint + Provisional Commitment + Duplicate Prevention + Event Log + Actor Identity. Allocation coherence (no oversell, leak, or double-release); the pool-arithmetic superset of Idempotent Reservation. TLA+ allocation-coherence model + buggy twin. Anchors ISO 9001 §8.5, PCI DSS Req. 10, IATA Resolution 830a.
C10. Execute Gated Workflow — partially resolved (Final Critique 6’s eighteen findings closed 2026-08-26 — the (instance_id, from_state, action) binding key, records-alone approval consumption, terminal-first ordering, payload-provenance timestamps; Final Critique 7’s four foundational fully closed 2026-08-26 across the capability and crash-seam rounds (the declared enumerate-and-filter read; record-before-maps ordering; the structural gate quarantine; the action-class recourse split); the full-residue gate, Final Critique 8, returned three new foundational (non-transient audit rejections without terminating recovery; [Decide Gate]’s unmapped recall arms; the consumption rule inside the retry window) + fifteen refining/rhetorical, routed open — see Lineage §Final Critique 8. Prior: grounded on Final Critique 4 — 2026-06-04). State Machine + Approval Step + Permissions + Assignment + Audit Trail (substrate). Approval-gated transitions — guard evaluation re-converges; first to compose State Machine. TLA+ model + buggy twin. Anchors SOX §404, FDA 21 CFR Part 11, ISO 9001 §8.5.1, BPMN 2.0.
C11. Preference-Aware Notification Fanout — partially resolved. Subscription + Notification + Message Preference + Event Log, composed directly (Notification Fanout is the unshaped sibling, not a constituent). Disposition trichotomy + quiet-window (stored + statutory) + per-commit cap safety + composition-introduced reconciliation surface. Returned 2026-08-30 by the sweep under the frozen rules — the deliver pair restated as ordered writes with an adoptable orphan, one writer per disposition under a declared per-disposition section, the gap leg bounded at both edges; prior grounded on Final Critique 12 — 2026-06-12 — see the table row and the pattern’s Ledger.
C12. Chain of Custody — partially resolved (Final Critique 6’s findings closed 2026-08-26 — the (step)-aware recovery, payload-safety caps, unverifiable arm, entry-payload field match, truth-bearing purged subset; the closure gate, Final Critique 7, returned three new foundational (two closure-introduced: the cascade misdescription and the cascade_recovery semantics; one pre-existing: the seal-range payload contract mismatch) + 11 refining/rhetorical, routed open — see Lineage. Prior: grounded on Final Critique 4 — 2026-06-11, English 2026-06-04; coverage GAP closed 2026-06-11 — model covers both Invariant 4 arms). Provenance + Audit Trail (substrate). Records-alone custody proof (verify_custody); pharma ≡ legal-evidence chain of custody in one composition; first to compose Provenance. TLA+ binding-bijection model + buggy twin. Anchors FDA 21 CFR Part 211, DEA 21 CFR Part 1304, FRE 901(b)(9), ISO 17025.
C13. Login — partially resolved (Final Critique 6’s fourteen findings closed 2026-08-26 — the audit surface rewritten to the substrate’s contract under one composition-actor attribution rule, the verify–read–verify sandwich, the union-defined cascade set, the named in-flight window; the closure gate, Final Critique 7, returned five new foundational + fifteen refining/rhetorical, routed open; F1/F3/F4/F5 closed 2026-08-26 across the capability, crash-seam, and validation rounds (the declared enumerate-and-filter read; the issuance-reconciliation sweep; logout’s earned unreachability claim; the sandwich retry’s credential-id-confirm landing), leaving one open (check 3 vs conformant skips) — see Lineage §Final Critique 7. Prior: grounded on Final Critique 5 — 2026-05-23). Credential + Session + Audit Trail. Verify→issue wiring; the cascade — revoking a Credential invalidates every Session derived from it. Anchors NIST SP 800-63B, OIDC Core 1.0, SAML 2.0.
C14. Session-Gated Authorization — grounded on Final Critique 8 — 2026-08-26 (re-grounded: Final Critique 7’s two foundational + eight refining/rhetorical closed 2026-08-26 — the invalid-request predicate pinned as Primitive policies, cross-call validation caches ruled non-conforming; the closure gate, Final Critique 8, returned zero foundational — seven refining/rhetorical routed open, non-blocking — see Lineage. Prior: grounded on Final Critique 6 — 2026-05-23). Session + Permissions. Every permission query gated on session validity; principal binding — the queried principal is always the session-extracted one. Anchors NIST SP 800-53 AC-3 + AC-12, OWASP ASVS V3.3, PCI DSS Req. 7 + 8.
C15. Capability-Backed Sharing — partially resolved (downgraded 2026-08-27 by the authentication-precedence round; ten routed foundational open, one closed in-round; prior grounding grounded on Final Critique 4 — 2026-06-10). Capability + Selective Disclosure + Audit Trail (substrate). Audit-subject asymmetry (the allocator is named and attested; the redeemer is structurally unnamed, by construction on Capability Invariants 3/5) + disclosure-accountability binding bijection (the Selective Disclosure record, the sealed sharing.disclosed event, and the redemption-decrement commit together or not at all — closer to C6 than C7). The library’s worked example of the object-capability model composed with regulated audit; first to compose Capability with Selective Disclosure. TLA+ binding-bijection model + non-atomic buggy twin. Anchors GDPR Article 32, HIPAA §164.514(d), OCAP.
C16. External Onboarding — partially resolved (Final Critique 6’s seventeen findings closed 2026-08-26 — the attempt-record credential gate on all four actions, the derived-expiry model restated, the token-carrying invitation.initiated record, the failure-signature checks; the closure gate, Final Critique 7, returned six new foundational + thirteen refining/rhetorical, routed open; F1/F2/F4/F6 closed 2026-08-26 across the crash-seam and validation rounds (the retention-horizon and store-scope standing rules; the dedicated-instance routing obligation; the gate discipline’s validation rule with reference_length_cap and minted-id width bounds, and the single deployment-fault landing), leaving two open (check 2 vs lawful rotation; authorization claimed but unwired) — see Lineage §Final Critique 7. Prior: grounded on Final Critique 5 — 2026-05-23). Invitation + Credential + Party Identity + Audit Trail. Invitation-gates-enrollment — no Party Identity without a preceding accepted Invitation in the same call. Anchors GDPR Articles 6–7, SOC 2 CC6.2, NIST SP 800-63A, SCIM 2.0.
C17. Authenticated Actor — partially resolved. Returned 2026-08-30 by the sweep under the frozen rules — the gate now runs under a declared per-principal section with the external-revoke residue named and findable by credential_id, the orphaned credential re-enters through step 3, every exported code carries its position; formal pending (prior grounded on Final Critique 4 — 2026-06-10). Credential + Actor Identity. Revocation cascade as forward closure — attest_as_actor gated on the bound credential’s live effective-Active status, read under the section immediately before the attestation write, so a revoked login produces no new attestations while prior ones stay valid; plus secret-surface separation and the principal_ref ⇔ actor_ref namespace bijection. Login’s outbound-attestation counterpart; first to pair Credential with Actor Identity. TLA+ revocation-cascade model + TOCTOU buggy twin. Anchors NIST SP 800-63B §5.2, NIST SP 800-57, PCI DSS Req. 8.6, FIPS 140-3.
C18. Actor Suspension — partially resolved. Actor Identity + Permissions + Session + Audit Trail (substrate) + optional Credential. Atomic multi-surface revocation (after suspend_actor, zero active grants + zero active sessions in one all-or-nothing transaction — a half-suspended actor is worse than a clean failure, inverting Login’s best-effort posture) + audit completeness (the sealed actor.suspended event enumerates every revoked grant_id/session_token) + suspension cascade ordering (Active→Suspended gate fires once; second suspend a no-op; benign already-terminal counted). Login’s outbound-side counterpart. TLA+ atomic-cascade model + non-atomic buggy twin. Anchors NIST SP 800-53 AC-2(3) + AC-6(5), SOX §404, HIPAA §164.308(a)(3)(ii)(C), PCI DSS Req. 8.1.3, ISO/IEC 27001 §A.9.2.6.
C19. Compensable Workflow — partially resolved (returned 2026-08-30 by the sweep under the frozen rules — attempt markers before every effect, per_run_serialization and effect_key_honoured / constituent_store_durability declared as instance capability requirements, the three-verdict effect with storage-failure(effect-landed | none), the log authoritative over the State Machine spine; formal pending. Prior: grounded on Final Critique 4 — 2026-06-16). State Machine + Event Log (compensating action sub-atomic). The external-side-effect complement of Undo History — completed steps reversed by a recorded compensating action, not replay-skip; durable-execution engine + orchestration-vs-choreography below the contract. TLA+ all-or-compensated + idempotency-under-retry model + two buggy twins (skip-comp → Inv 4, double-apply → Inv 7). First grounded from the dream-compositions pipeline; sibling of C10 over the State Machine spine.

Status cells in this document mirror each pattern file’s own Status line — the pattern file is the source of truth and carries the marker of its latest complete round. A mismatch between a row here and the pattern’s Status line is a finding (the status-mirror check; see open-questions.md §Status-line grammar). Rows corrected against the pattern files 2026-06-11; rows not individually verified that day retain their original grounding dates pending the mechanical check.

C11 grounded — the C-numbered backlog closes

C11. Preference-Aware Notification Fanout — `partially resolved` (returned 2026-08-30 by the sweep under the frozen rules; prior `grounded on Final Critique 12 — 2026-06-12`)

Constituents (corrected at landing): Subscription + Notification + Preference + Event Log, composed directly — Notification Fanout is the unshaped sibling and structural template, not a constituent (the C9 superset precedent: re-wire the atoms plus more rather than wrap a grounded composition whose action surface exposes no insertion point for the shaping gate). The earlier sketch on this row listed Notification Fanout as a constituent; the spec’s Composes section is the source of truth. Audit Trail and Consent are named peers. Unblocked 2026-05-29 when Preference grounded; the final unstarted C-numbered row, now authored.

What it adds. The fanout loop with a shaping gate between the subscriber query and each create: every queried subscriber receives exactly one journaled disposition — created (shaped to channel and format), failed-with-cause, or suppressed-with-reason (suspended, no-record, quiet-window, frequency-cap, channel-opt-out). The TCPA quiet-window angle is first-class: a stored-preference arm plus a statutory-window arm, both stated as conditional invariants with declared antecedents. Frequency-cap safety is per-commit, conditional on the declared serialization capability, with the cap TOCTOU race as the formal model’s subject — TLA+ model + overshoot buggy twin verified in tools/harness/ 2026-06-12, mirroring capacity-constraint-enforcement’s twin. redispose is the journaled, gate-re-evaluated retry surface that re-verifies the audience and the shape across its unbounded horizon. Authored through Round 1 plus nine fresh-reader Final Critique rounds — Final Critique 4–8 closed 16 foundational; Final Critique 9 returned zero foundational (the first grounding gate, Pass 2 clean from Final Critique 8 on). A post-grounding fresh-reader rescan then reopened the gate — Final Critique 10 surfaced a gate fail-closed/precedence ordering defect, and Final Critique 11 a reconciliation-surface provenance cluster (resolved by adding the composition-introduced reconcile_gaps / reconcile_overshoots surface, taking the action surface to three) — and the pattern re-grounded on Final Critique 12 (zero foundational), all findings closed in-pattern every round. This brings the library to 51 grounded patterns (24 grounded compositions), closes the original C-numbered composition backlog at eighteen of eighteen, and retires the C11 forthcoming-links in Preference and C2.

Standards anchored. TCPA (47 U.S.C. §227; 47 CFR §64.1200(c)(1)), CAN-SPAM §7704, GDPR Articles 7(3) and 21(2), CASL, ePrivacy.

Compensable Workflow (C19) grounded — first of the dream-compositions pipeline

Compensable Workflow grounded — 2026-06-16 (Final Critique 1). The external-side-effect complement of Undo History: a forward sequence of local steps each paired with a recorded compensating action, made eventually all-or-nothing across failure without a distributed transaction. Composes State Machine + Event Log (the compensating action is a sub-atomic recorded closure, not an atom); the durable-execution engine and orchestration-vs-choreography stay below the contract. Decomposition source-grounded against the Temporal server + Java/TS SDKs (dream-compositions §7). Formal-layer vote YES, discharged: compensable-workflow.tla machine-checks all-or-compensated (Inv 4) and idempotency-under-retry (Inv 7) on the WASM tla-checker, green at N=2 (22 states), monotone-growth saturation N=2..6; two buggy twins rejected with per-invariant teeth (compensable-workflow-skip-comp-buggy → Inv 4, compensable-workflow-double-apply-buggy → Inv 7). Ground by a fresh-reader Opus Happy-Torvalds-X2 clearance gate (Phase 3 + Phase 4 merged) with zero foundational findings (four refining/rhetorical folded in-pattern). The first composition grounded from the dream-compositions pipeline beyond the original C-numbered backlog; sibling of C10 over the State Machine spine. This brings the library to 52 grounded patterns (25 grounded compositions).

Summary table

#	Pattern	Type	Status	Unblocks / Notes
—	Personal Todo, Assignment	Atoms	Personal Todo: `grounded` 2026-05-13; Assignment: `grounded` 2026-05-13	`productivity`
—	Duplicate Prevention, Event Log	Atoms	`grounded` 2026-05-13	`temporal`
—	Provisional Commitment	Atom	`grounded on Final Critique 4 — 2026-06-18`	`resource-lifecycle`
—	Actor Identity, Retention Window, Tamper Evidence, Permissions	Atoms	Actor Identity, Tamper Evidence, Permissions: `grounded` 2026-05-13; Retention Window: `grounded on Final Critique 5 — 2026-06-23`	`compliance`
—	Subscription, Notification	Atoms	`grounded` 2026-05-13	`messaging`
—	Clinical Observation, Medication Order	Atoms	`grounded` 2026-05-13	`healthcare` (outside core sequence)
1	Legal Hold	Atom	`grounded — 2026-05-20`	C1, C7
2	Consent	Atom	`grounded on Final Critique 5 — 2026-06-23`	C2, C7, C8
3	Soft Delete	Atom	`grounded — 2026-05-20`	C3
4	Approval Step	Atom	`grounded — 2026-05-20`	C4
5	Selective Disclosure	Atom	`grounded on Final Critique 5 — 2026-06-23`	C6, C7
6	Party Identity	Atom	`grounded — 2026-05-20`	C8
7	Provenance	Atom	`grounded on Final Critique 7 — 2026-08-26` (re-grounded: Final Critique 6’s one foundational + 16 refining/rhetorical closed 2026-08-26; the closure gate, Final Critique 7, returned zero foundational — ten refining + six rhetorical routed open, non-blocking — see Lineage. Prior: `grounded` 2026-06-04)	Unblocks C12 (Chain of Custody); enriches C6, C7, C8; Alloy model + buggy twin
8	Capacity Constraint Enforcement	Atom	`grounded on Final Critique 8 — 2026-08-26` (re-grounded: Final Critique 7’s one foundational + 6 refining/rhetorical closed 2026-08-26; the closure gate, Final Critique 8, returned zero foundational — eight refining + five rhetorical routed open, non-blocking — see Lineage. Prior: `grounded — 2026-05-20`)	C9
9	State Machine	Atom	`grounded` 2026-06-04	Unblocks C10; resolves workflow-category one-atom question; Alloy model + buggy twin
10	Preference / Personalization	Atom	`grounded on Final Critique 8 — 2026-08-26` (re-grounded: Final Critique 7’s two foundational + 9 refining/rhetorical closed 2026-08-26; the closure gate, Final Critique 8, returned zero foundational — nine refining + four rhetorical routed open, non-blocking — see Lineage. Prior: `grounded` 2026-05-29)	C11; ten hard invariants + Temporal property 11
11	Credential	Atom	`grounded on Final Critique 5 — 2026-06-23`	C13 (Login); enriches C16; retires Authentication forthcoming-link in actor-identity.md
12	Session	Atom	`grounded on Final Critique 5 — 2026-06-23`	C13 (Login), C14 (Session-Gated Authorization)
13	Capability	Atom	`grounded on Final Critique 5 — 2026-06-23`	C15 (Capability-Backed Sharing)
14	Invitation	Atom	`grounded on Final Critique 5 — 2026-06-23`	C16 (External Onboarding)
—	Undo History	Composition	`grounded on Final Critique 6 — 2026-08-26` (re-grounded: Final Critique 5’s 2 foundational + 9 refining/rhetorical closed 2026-08-26; the closure gate, Final Critique 6, returned zero foundational — 9 refining/rhetorical routed open, non-blocking — see Lineage. Prior: `grounded on Final Critique 4 — 2026-06-18`)	Personal Todo + Event Log
—	Idempotent Reservation	Composition	`partially resolved` (grounded on Final Critique 4, 2026-06-18; returned to partially resolved 2026-08-30 by the sweep under the frozen rules — the `pending` intent and re-entry arm in place of a claimed cross-store atomicity, one writer per token under a declared `per_token_serialization`, positioned rejection codes, Duplicate Prevention’s host obligations declared; formal pending)	Provisional Commitment + Duplicate Prevention
—	Audit Trail	Composition	`partially resolved` (grounded on Final Critique 11, 2026-08-25; returned to partially resolved 2026-08-30 by the sweep under the frozen rules — the reconciliation’s protocol changed: one writer per act under a declared per-act section, completion bounds below which no scan half examines anything, the three-term liveness inequality; four contract-shaped sites routed open; formal pending. Prior: `grounded on Final Critique 4 — 2026-06-18`)	Event Log + Actor Identity + Retention Window + Tamper Evidence
—	Shared Todo	Composition	`grounded on Final Critique 6 — 2026-08-26` (re-grounded: Final Critique 5’s 3 foundational + 10 refining/rhetorical closed 2026-08-26 — assign-side existence check, grant-admin non-goal, authentication seam; the closure gate, Final Critique 6, returned zero foundational — 11 refining/rhetorical routed open, non-blocking — see Lineage. Prior: `grounded on Final Critique 4 — 2026-06-18`)	Personal Todo + Permissions + Assignment
C5	Notification Fanout	Composition	`partially resolved` (Final Critique 5’s 1 foundational closed 2026-08-26 composition-owned; the closure gate, Final Critique 6, returned 1 new foundational — the `fired_at` query-moment pin — + 12 refining/rhetorical, routed open — see Lineage. Prior: `grounded on Final Critique 4 — 2026-05-20`)	Subscription + Notification
—	Attributed Permissions Admin	Composition	`partially resolved` (grounded on Final Critique 7, 2026-08-26; returned to partially resolved 2026-08-30 by the sweep under the frozen rules — the Failed-Grant Reconciliation leg restated as report-only and bounded at both edges, one writer per act, `pairing_write_atomicity` and `constituent_store_durability` declared as instance capability requirements, `clock_offset_allowance` declared; formal pending. Prior: `grounded on Final Critique 6 — 2026-05-23`)	Permissions + Actor Identity; first two-compliance-atom composition; ships with dynamic Alloy trace model
—	Privileged Access Provisioning	Composition	`partially resolved` (Final Critique 6’s 14 findings closed 2026-08-26 — the `requests:withdraw` scope dropped as structurally empty, the two-leg completion sweep, the payload-carrying recovery marker; Final Critique 7 returned 4 new foundational + 14 refining/rhetorical, routed open; F1–F3 closed 2026-08-26 in the crash-seam round — the multi-entry payload-carrying marker, marker-before-act intent entries, the four-leg sweep, the durable pre-write — 1 foundational open — see Lineage §Final Critique 7. Prior: `grounded on Final Critique 4`; Round 5 re-pass clean 2026-06-03)	Multi-Party Approval + Credential + Session + Capability + Audit Trail; approval-gates-provisioning invariant; session-gated exercise; TLA+ behavioral model ships alongside
C1	Defensible Retention	Composition	`grounded on Final Critique 7 — 2026-08-26` (re-grounded: Final Critique 6’s two foundational + 17 refining/rhetorical closed 2026-08-26; the closure gate, Final Critique 7, returned zero foundational — 13 refining/rhetorical routed open, non-blocking — see Lineage. Prior: `grounded on Final Critique 4 — 2026-05-20`)	Legal Hold + Audit Trail + Retention Window
C2	Propagate Consent Revocation Downstream	Composition	`partially resolved` (Final Critique 6’s four foundational + 10 refining/rhetorical closed 2026-08-26; the closure gate, Final Critique 7, returned two new foundational — check 2’s recovery-window unsoundness; the Consent Invariant 8 purge miscite (candidate constituent touch) — + 10 refining/rhetorical, routed open — see Lineage. Prior: `grounded on Final Critique 4 — 2026-06-04`)	Consent + Permissions + Audit Trail (substrate); consent-gates-processing + revocation-propagation binding bijection; TLA+ model
C3	Forensic Recovery	Composition	`grounded on Final Critique 4 — 2026-06-11` (English 2026-06-04; GAP closed 2026-06-11)	Soft Delete + Audit Trail (substrate); attributed + tamper-evident + full-history-recoverable destruction lifecycle; purge-eligibility gate delegated to C1; TLA+ binding-bijection model
C4	Multi-Party Approval	Composition	`partially resolved` (Final Critique 7’s 3 foundational fully closed 2026-08-26; the full-residue gate, Final Critique 8, returned 4 new foundational + 12 refining/rhetorical, routed open — see Lineage §Final Critique 8. Prior: `grounded on Final Critique 4 — 2026-05-20`)	Approval Step + Permissions + Assignment + Audit Trail
C6	Immutable Transaction Ledger	Composition	`grounded on Final Critique 6 — 2026-06-10`	Selective Disclosure + Audit Trail (substrate, → Event Log + Actor Identity + Tamper Evidence + Retention Window); disclosure-accountability binding bijection + verifiable partial disclosure; TLA+ binding-bijection model; first composition to compose Selective Disclosure
C7	Resolve a Person’s Data Rights	Composition	`grounded on Final Critique 5 — 2026-06-09`	Selective Disclosure + Defensible Retention (C1, substrate) + Consent (read-only oracle); no-silent-omission + binding-bijection; TLA+ binding + coverage model with two buggy twins; first composition authored under the capability-provenance rule
C8	Customer Onboarding	Composition	`partially resolved` (Final Critique 6’s five foundational + 8 refining/rhetorical closed 2026-08-26; the closure gate, Final Critique 7, returned 1 new foundational — the mid-relationship retention elapse — + 16 refining/rhetorical, routed open — see Lineage. Prior: `grounded on Final Critique 4 — 2026-06-03`)	Party Identity + Retention Window + Audit Trail (substrate); verification-gates-activity; adverse-trigger monitoring + post-closure retention floor
C9	Reserve from Pool	Composition	`partially resolved` (Final Critique 7’s two foundational + 12 refining/rhetorical closed 2026-08-26; the closure gate, Final Critique 8, returned two new foundational — the unspecified attestation wiring; confirm’s commit→journal seam — + 10 refining/rhetorical, routed open — see Lineage. Prior: `grounded on Final Critique 5 — 2026-06-18`)	Capacity Constraint + Provisional Commitment + Duplicate Prevention + Event Log + Actor Identity; allocation-coherence binding; TLA+ model
C10	Execute Gated Workflow	Composition	`partially resolved` (Final Critique 7’s 4 foundational fully closed 2026-08-26; the full-residue gate, Final Critique 8, returned 3 new foundational + 15 refining/rhetorical, routed open — see Lineage §Final Critique 8. Prior: `grounded on Final Critique 4 — 2026-06-04`)	State Machine + Approval Step + Permissions + Assignment + Audit Trail (substrate); approval-gated transitions (guard evaluation re-converges); TLA+ model; first composition to compose State Machine
C12	Chain of Custody	Composition	`partially resolved` (Final Critique 6’s five foundational + 15 refining/rhetorical closed 2026-08-26; the closure gate, Final Critique 7, returned 3 new foundational — the cascade misdescription, the seal-range payload mismatch, the cascade_recovery semantics — + 11 refining/rhetorical, routed open — see Lineage. Prior: `grounded on Final Critique 4 — 2026-06-11`, English 2026-06-04)	Provenance + Audit Trail (substrate). Records-alone custody proof (`verify_custody`); pharma ≡ legal-evidence chain of custody in one composition; first to compose Provenance. TLA+ binding-bijection model + buggy twin. Anchors FDA 21 CFR Part 211, DEA 21 CFR Part 1304, FRE 901(b)(9), ISO 17025.
C11	Preference-Aware Notification Fanout	Composition	`partially resolved` (grounded on Final Critique 12, 2026-06-12; returned to partially resolved 2026-08-30 by the sweep under the frozen rules — the deliver pair restated as ordered writes with an adoptable orphan, one writer per disposition under a declared section, the gap leg bounded at both edges; formal pending)	Subscription + Notification + Preference + Event Log, composed directly (Notification Fanout is the unshaped sibling, not a constituent — row corrected at landing); disposition trichotomy + quiet-window (stored + statutory) + per-commit cap safety + composition-introduced reconciliation surface; TLA+ cap-TOCTOU model + buggy twin verified; the 24th grounded composition — C-numbered backlog complete
C13	Login	Composition	`partially resolved` (Final Critique 6’s 14 findings closed 2026-08-26; Final Critique 7 returned 5 new foundational, of which F1/F3/F4/F5 closed 2026-08-26 — 1 foundational open — see Lineage §Final Critique 7. Prior: `grounded on Final Critique 5 — 2026-05-23`)	Credential + Session + Audit Trail; cascade invariant: Credential revocation invalidates all derived Sessions via `credential_to_sessions` map
C14	Session-Gated Authorization	Composition	`grounded on Final Critique 8 — 2026-08-26` (re-grounded: Final Critique 7’s 2 foundational + 8 refining/rhetorical closed 2026-08-26; the closure gate, Final Critique 8, returned zero foundational — 7 refining/rhetorical routed open, non-blocking — see Lineage. Prior: `grounded on Final Critique 6 — 2026-05-23`)	Session + Permissions; principal binding as emergent invariant — session-extracted principal gates every permission query
C15	Capability-Backed Sharing	Composition	`grounded on Final Critique 4` 2026-06-10	Capability + Selective Disclosure + Audit Trail (substrate); audit-subject asymmetry (allocator named and attested, redeemer structurally unnamed by construction on Capability Invariants 3/5) + disclosure-accountability binding bijection; first to compose Capability with Selective Disclosure. TLA+ binding-bijection model + non-atomic buggy twin.
C16	External Onboarding	Composition	`partially resolved` (Final Critique 6’s 17 findings closed 2026-08-26; Final Critique 7 returned 6 new foundational, of which F1/F2/F4/F6 closed 2026-08-26 — 2 foundational open — see Lineage §Final Critique 7. Prior: `grounded on Final Critique 5 — 2026-05-23`)	Invitation + Credential + Party Identity + Audit Trail; invitation-gates-enrollment as load-bearing invariant; attempt-record credential gate before Invitation.accept
C17	Authenticated Actor	Composition	`partially resolved` (grounded on Final Critique 4, 2026-06-10; returned to partially resolved 2026-08-30 by the sweep under the frozen rules — the check-and-attest gate restated under a declared `principal_section` with the external-revoke residue named, the orphan re-entry arm, positioned rejection codes, and `clock_offset_allowance` on the checks; formal pending)	Credential + Actor Identity; owns revocation cascade (forward closure), secret surface separation, and principal_ref / actor_ref namespace binding. TLA+ revocation-cascade model + TOCTOU buggy twin. Implementation-discovered gap via APA demo.
C18	Actor Suspension	Composition	`partially resolved` (grounded on Final Critique 4, 2026-06-10; returned to partially resolved 2026-08-29 by the sweep under the frozen rules — manifestation B of §Durability boundaries and the authentication seam; the third gate of 2026-08-30 closed five more foundational; formal pending)	Actor Identity + Permissions + Session + Audit Trail (substrate) + optional Credential; emergent invariants: atomicity of multi-surface revocation under one all-or-nothing transaction, audit completeness over revocation scope, and suspension cascade ordering. Outbound-side counterpart to C13 Login’s inbound credential cascade. TLA+ atomic-cascade model + non-atomic buggy twin.
C19	Compensable Workflow	Composition	`partially resolved` (grounded on Final Critique 4, 2026-06-16; returned to partially resolved 2026-08-30 by the sweep under the frozen rules — attempt markers before every effect, a declared per-run section, the effect-side key discipline and store durability declared as instance capabilities, the positioned `storage-failure`; formal pending)	State Machine + Event Log (compensating action sub-atomic); external-side-effect complement of Undo History (reverses by compensating action, not replay-skip); all-or-compensated + idempotency-under-retry; TLA+ model + two buggy twins (skip-comp → Inv 4, double-apply → Inv 7); durable-execution engine below the contract; the 25th grounded composition, first of the dream-compositions pipeline

Formal model coverage

Per pressure-testing.md §Formal models, whether a formal model is a prerequisite for grounded is decided per pattern by the formal-layer vote: a vote-yes pattern (one carrying load-bearing temporal, ordering, concurrency, or safety claims) requires a verifying model before unqualified grounded; a vote-no pattern grounds English-only under the minimum-formalism principle.

The inventory is mechanical, not mirrored. Since the 2026-06-03 backlog landing (18 TLA+ and 4 Alloy models, every one shipping a checker-rejected buggy twin — see §Current state above), the shipped set is enumerated by the artifacts themselves: a pattern’s formal models are its sibling .tla / .als files, verified on command by tools/harness/ (node audit.mjs runs every model in the corpus; correct models must hold, buggy twins must be rejected). The per-pattern record lives in each spec’s Lineage notes — the formal-layer vote entry and, where a model shipped, the Formal model entry.

Dated removal note (2026-07-06). A hand-maintained Shipped / Deferred registry previously lived in this section and drifted: it still listed only the six pre-backlog models — and filed Preference / Personalization as Deferred after message-preference.tla and its buggy twin landed (2026-06-03) — weeks after the backlog closed, while the section’s own file recorded the landing under §Current state. Removed under the derive-don’t-mirror discipline (the same rot class as the Summary status mirrors in the 2026-06-12 discoveries entry): the harness and the Lineage entries are the source of truth; this section states the rule, never the roster.

Convention

A vote-yes pattern’s formal layer is discharged when (a) the sibling artifact(s) exist alongside the spec, (b) they clear the model-present bar mechanically via tools/harness/ — correct model green, buggy twin rejected, checks non-vacuous (see pressure-testing.md §The formal-layer vote), and (c) a Formal model entry is recorded in the pattern’s Lineage notes per pressure-testing.md (what the artifact checks, bounds/scope, deliberate exclusions, result). Deferred formal-model candidates land as a Deferred work — formal models item in the pattern’s Lineage notes; they graduate by shipping the artifact, never by editing a registry row here. Findings from formal-model runs route through the standard review channel — a contradiction inside the spec becomes a Pass-3-shaped finding in Lineage notes, not an in-flight spec rewrite.

Health census — 2026-08-27

Why this exists. The tally in Compositions partially resolved above said 23 open across seven patterns. There are fifteen patterns at partially resolved, and the real count is roughly double. The number went stale because closures are recorded per pattern and the aggregate was maintained by hand — the exact drift the no-snapshot rule exists to prevent, occurring in the file the rule points at. It was found by asking for a delivery estimate, which is a good reason to distrust an aggregate nobody has had to spend.

It can now be counted mechanically — python3 tools/linter/lint.py --census — and this table is the last hand tally. The Ledger migration (2026-08-27) put every pattern’s open findings in a fenced block the linter parses, so the count below is superseded by the command’s output the moment either changes; the table stays as the record of what the migration started from. References in this file to “Lineage §Final Critique N” and similar resolve in git history — the Lineages were deleted in the migration’s closing commit, and git log -- <pattern file> is the index.

Pattern	Open foundational	Notes
Multi-Party Approval	8	four Final Critique 9 findings plus four from the 2026-08-27 gate
Capability-Backed Sharing	6	was 8; F2 and F3 closed 2026-08-27 by the durability-boundary repair, which had rewired the defect without marking them
Resolve a Person’s Data Rights	6	the 2026-08-26 gate’s six, unnumbered in the file
Customer Onboarding	4	Status headlines three; Final Critique 7’s F1 is a fourth
Chain of Custody	4	3 distinct — AP-F1 restates the still-open FC7-F2
Execute Gated Workflow	3
Reserve from Pool	3	AP-F2 re-routes FC8-F2; counted once
Forensic Recovery	3	AP-F1 closed 2026-08-27; two stale “stays open” sentences corrected with this census
Immutable Transaction Ledger	3
External Onboarding	2
Login	7	Final Critique 7’s F2 closed 2026-08-27; gated the same day, 7 foundational — F1 and F2 are defects in that fix (uninitialized `failures`; check-3 join key absent from the per-session events)
Privileged Access Provisioning	4	Final Critique 7’s F4 closed 2026-08-27; gated the same day, 4 foundational
Notification Fanout	6	Final Critique 6’s F1 closed 2026-08-27; gated the same day, 6 foundational — F2 is a defect in that fix (`fired_at` in the contract and check, in no wiring step)
Propagate Consent Revocation Downstream	0	F4 closed 2026-08-27 composition-side; refining bundle still open, so the pattern holds at `partially resolved`
Defensible Retention	6	AP-F1 closed 2026-08-27; gated the same day, 6 foundational — F5 is the surviving-field error, corrected the same day
Total	65	~62 distinct. Was 43 before the four gates; +23 from them, −1 (Propagate Consent Revocation Downstream F4). This table is hand-tallied and is superseded by `python3 tools/linter/lint.py --census` as the Ledger migration lands

What the census found that matters more than the number: five patterns’ Status lines disagreed with their own Lineage, and two of those disagreements were introduced the same day by the rounds that closed the findings. Forensic Recovery’s AP-F1 was marked closed inline while two earlier sentences still said “AP-F1 stays open”; Defensible Retention’s lead said “Closed two ways” while its trailer still said the composition holds “until the routed finding closes”. Capability-Backed Sharing’s F2 and F3 had been rewired by that morning’s protocol repair and never marked closed at all. All corrected with this census.

A round that closes a finding must close it in every place the pattern claims it is open. The Status line, the routed-finding bullet, and any later entry that leans on it are three separate claims, and a round that updates one of them leaves the pattern asserting two contradictory things about its own health. This is the same defect class the campaign has been finding in the specs — a claim strengthened in one place while a dependent claim elsewhere goes stale — occurring in the Lineage rather than the body.

On estimating completion. The bar for grounded is not zero open findings; it is a fresh-reader gate returning zero foundational, which is a separate and harder event — Defensible Retention is at zero open and still partially resolved for exactly that reason. Two facts govern any estimate. (1) Gates find as they close. Every authentication-precedence gate in the 2026-08-26/27 pass returned pre-existing foundational findings the pattern had carried for months, so the observed net rate is far below the gross closure rate, and a burn-down of 46 is the wrong model. (2) The remaining findings are not class-clustered. Methodology debt #19’s three classes closed sixteen-plus sites in a day because they shared a treatment; what is left is per-pattern gate residue — a substrate query surface here, a taxonomy arm there — with no shared fix to propagate. Those need per-pattern rounds at roughly one pattern per round, plus a gate each.

Measurement in progress — 2026-08-27. The four patterns at one open finding each were taken first, precisely to turn the gross-versus-net rate into a measured quantity. Three are now at zero open — Login (FC7-F2), Privileged Access Provisioning (FC7-F4), Notification Fanout (FC6-F1) — joining Defensible Retention, which reached zero earlier the same day. The fourth, Propagate Consent Revocation Downstream’s F4, is not a closure but a decision: it needs a choice between an archival-not-destruction posture and a constituent touch scoping Consent’s Invariant 8 to the atom’s own surface, and a constituent touch ripples to every pattern composing Consent. It is held for that decision rather than closed by preference.

RETRACTED 2026-08-27, then the retraction itself corrected the same day — read both, because the second error is the instructive one. This entry first reported four fresh-reader gates and a 23-finding total. It was then rewritten to say three of the four never ran and their numbers were fabricated. That second claim is false. All four gates ran, as subagent runs of six to nine minutes each, each ending in a full verdict; the transcripts were located and their verdicts saved verbatim (work/gates/*.md in the session, quoted into each pattern’s Ledger by the migration pass). The wall-clock timestamps on those runs are 2026-09-04 16:11–16:21 — the session’s corpus date lags the wall clock, which this note records rather than hides.

Pattern	Open before gate	Gate returned (foundational / refining / rhetorical)
Login	0	7 / 10 / 5
Notification Fanout	0	6 / 9 / 4
Defensible Retention	0	6 / 14 / 5
Privileged Access Provisioning	0	4 / 12 / 4

What the two errors have in common, stated once. The first version asserted results before they were traced to the runs that produced them. The second version, asked “why do gates keep finding six?”, could not find three of the results in working context and confessed to a fabrication instead of checking the evidence on disk. Both are the same defect the corpus keeps finding in its own specs — a claim asserted with an authority it does not have — and the second is the worse one, because it destroyed a real measurement to satisfy a story about honesty. The rule that would have prevented both is mechanical, not moral: a claim about work done traces to the artifact that did it, and a claim that work was not done traces to the same place. The Ledger migration exists partly so that this class of claim becomes a file the linter counts rather than a sentence anyone remembers.

What the measurement says, now that it is on the page. Four patterns at zero open findings returned 23 foundational between them. Login’s F1 and F2 are the failures counter and the missing initiation_event_id join key; Notification Fanout’s F2 is fired_at in the contract and in no wiring step — the three defects this note previously called “found by inspection, not by any gate” were found by the gates. Defensible Retention’s F5 is the surviving-field correction — the gate found that too, and the earlier attribution to a gate was right. Five of the 23 are defects in fixes landed the same day. So the net rate is negative on this sample, and a burn-down of the open count is the wrong shape: what governs completion is the rate at which gates return clean, and on this sample it is zero of four. The honest estimate is the one below, and its assumptions are now backed by four data points rather than one.

So the arithmetic, with its assumptions on the page: fifteen patterns × (one to two closure rounds + one gate) each, at the observed rate of one to two patterns per working session, is eight to fifteen sessions — if gates return clean. They have not been returning clean; the 2026-08-27 gates opened 23 foundational findings across four patterns that had nothing open. That measurement has now been taken (the table above): four gates on zero-open patterns, zero clean. The estimate that follows from it is not a session count but a condition — a pattern is done when a gate returns zero foundational, and the sample says a first gate after a closure round does not. Plan on two gates per pattern, not one, and treat any date as a wish until a gate somewhere returns clean.

Methodology debts — open

These are methodology-level items the library has accumulated and not yet resolved. They are recorded here so a future session picks them up rather than re-deriving them.

1. Propagation pass for the 92%-good threshold and three-class finding taxonomy. pressure-testing.md §”What grounded means” was extended on 2026-05-15 with the 92%-good grounding threshold (a pattern grounds when the Phase 4 clearance gate’s foundational findings reach zero, even if refining and rhetorical findings remain) and the foundational / refining / rhetorical three-class finding taxonomy. Capacity Constraint Enforcement is the first atom whose Lineage notes were authored under the new taxonomy and the new compact finding-→-fix line format (F-id — short name — class → fix in one or two sentences). All other grounded patterns retain Lineage notes in the prior narrative-paragraph form and Status lines that reference the prior unbounded “gate runs again until clean” rule rather than the threshold. A propagation pass should: (a) update each grounded pattern’s Status line to reference the threshold and the foundational-density-at-grounding count, (b) refactor each pattern’s Lineage notes to the compact format with explicit class labels per finding, (c) process in dependency order (atoms before compositions that name them) so cross-references stay stable. Priority order for the pass: Party Identity (most recent prior gate-clearing atom; the format is most directly comparable), then the canonical regulated-audit stack (Event Log, Actor Identity, Retention Window, Tamper Evidence, Audit Trail), then the remaining atoms and compositions in their grounded-date order.

Progress 2026-06-16: new patterns are now authored directly under the threshold and the compact F-id — short name — class → fix format (Compensable Workflow is the latest); the corpus-wide retrofit has not run — ~14 of 52 patterns reference the threshold and ~9 carry the compact format — so this stays open as a batched sweep, best ridden on the scheduled-rescan automation (and naturally paired with item 9’s fold). Item 2 rides the same pass.

2. Methodology cross-reference from existing pattern Lineage notes to the threshold. Patterns whose Lineage notes refer to “the gate runs again until clean” or similar pre-threshold phrasing should be updated to point at pressure-testing.md §”The 92%-good grounding threshold” once the propagation pass runs. This is a substring-search-and-replace rather than a content rewrite; the existing findings and fixes stay, only the methodology rationale anchors update.

Resolved 2026-06-26. The literal trigger — pre-threshold “gate runs again until clean” phrasing in pattern Lineage — no longer exists: a corpus sweep found zero occurrences in atoms//compositions/. Debt #3’s re-gating (the grandfathered cohort given real Final Critique rounds, 2026-06-18/06-23) already moved every pattern onto the threshold, so the pre-threshold rationale was rewritten as a side effect. The only residue was a citation drift — the same canonical passage cited two ways: the actual heading §"What grounded means" (the dominant form) and the bold inline label §"The 92%-good grounding threshold" (which is not a heading). Standardized the two outlier citations (capacity-constraint-enforcement.md) onto the heading form, so all pattern→grounding-criterion references now name the resolvable section. (The anchor named in this debt’s own text above is left as written — it is the description, not a live citation.)

3. Decide whether the threshold counts toward grandfathering — RESOLVED 2026-06-18. The grandfathered cohort was brought to standard in a dedicated sweep: every pattern that predated the AI adversarial round received its first real fresh-reader Final Critique under the 92%-good threshold and now carries the canonical grounded on Final Critique 4 (capacity-constraint at 5). The pragmatic read held — a threshold-clean Phase 4 is bringing a pattern to standard. Grandfathering and the legacy grounded — date form are retired (pressure-testing.md §Status line format; changelog Removed).

4. Author-fatigue / round-count signal. Capacity Constraint Enforcement required two Phase 4 rounds (11 + 9 findings closed across both) before clearing under the new threshold. The library’s prior gate-clearing pattern (Party Identity) cleared in one round (6 findings). The two-round count for CCE is correlated with the atom’s surface area — 14 invariants, four host obligations, two state machines, regulated overlay, eight composing patterns. The empirical pattern: more surface = more rounds, with diminishing structural-finding density per round. The threshold is what makes the loop terminate cleanly. No action required, but a useful data point for future rich-surface atoms (State Machine and Provenance are likely candidates).

6. Formal verification pass — Alloy for snapshots, TLA+ for traces. The library has no codified formal verification step. The three-pass methodology (GRID / EOS / Linus) plus Final Critique does the intellectual work that formal verification depends on — defining system state, naming actions, stating invariants, eliminating ambiguity — but stops short of machine-checked verification. The discovery (captured in discoveries.md, 2026-05-19): once a Grace Commons spec is grounded, generating Alloy or TLA+ models from it is largely mechanical, because the spec already contains the named actions, preconditions, postconditions, and numbered invariants the model requires. The feedback loop is: English specification → formal model → counterexamples → refined specification. The formal pass is not a separate discipline; it is a mechanical extension of the same thinking.

The tool split, by question type rather than by artifact type: Alloy handles snapshot questions — “is there any configuration of state where this invariant is violated?” (structural soundness, impossible constraints, reference validity, audit chain completeness). TLA+ handles trace questions — “is there any sequence of steps where this property breaks?” (concurrent action invariant violations, atomicity of operations, failures leaving state unchanged, temporal always/eventually properties, interleaving possibilities). In practice, atoms tend to generate structural questions (Alloy) and compositions tend to generate temporal and concurrency questions (TLA+), but the mapping is by question type, not artifact type — Invitation’s concurrent-accept is TLA+ territory even though it is an atom; a simple two-atom structural composition may be fully checkable in Alloy.

The ordering is fixed by the discovery: prose first, formal second. The English spec is canonical; the formal model translates from it, not the other way around. A formal model written before the prose spec is grounded is built on shifting ground — the three-pass review will change the spec and break the model.

What needs to land in pressure-testing.md: a named Step 4 — formal verification — with the Alloy/TLA+ question-type split, the prose-first ordering rationale, and guidance on when the step is required (regulated atoms and compositions with concurrency-critical invariants) vs. optional (structural-only compositions with no temporal emergent invariants). The Attributed Permissions Admin composition is the canonical worked example: it shipped with a static Alloy structural model and a dynamic Alloy 6 LTL (Linear Temporal Logic) model verifying its load-bearing temporal claims.

Resolved 2026-06-16. The premise — “the library has no codified formal verification step” — no longer holds. The formal layer is codified in pressure-testing.md: §Formal models carries the Alloy-structural / TLA+-behavioural question-type split, §The English/formal SSOT contract carries the prose-first, English-canonical / model-derived ordering, and §The formal-layer vote carries the per-pattern when-required-vs-optional guidance under the minimum-formalism principle — plus the model-present bar, the coverage cross-check, and the conflict protocol. Every vote-yes pattern now ships a verified model + a rejected buggy twin through tools/harness/ (Compensable Workflow, grounded 2026-06-16, is the latest worked example). What item 6 asked to land has landed and been exceeded; the lone residual — whether it is labelled a “Step 4” — is cosmetic and deliberately declined (the formal-layer vote, not a fixed pipeline step, is the right shape). Retire from the open list on the next pass.

7. Logic Confinement Principle — full application to projector and verification harness. The Logic Confinement Principle is now a first-class architectural commitment in execution-contract.md. The Beacon reference implementation satisfies rules 1 (core is pure), 2 (single seam), 3 (explicit inputs for clock/id), and 6 (async at the edge) fully. Two rules remain partially satisfied: rule 4 (explicit construction — createEvent before appendEvent — rather than hidden work inside transactional functions) and rule 5 (compiler-emitted local invariant assertions, not distributed runtime assumptions). Closing these requires: (a) separating event construction from event insertion in the composition layer, making the constructed event an explicit value before the transaction boundary; (b) designing the projector to emit local invariant assertions compiled from each atom’s named invariant set. First natural targets: the projector architecture and the verification harness derivation pipeline. Scoped to the NLnet grant period as a named deliverable; surfaced 2026-05-29.

5. Compliance-folder sustainability under the #11–#14 cluster — RESOLVED (2026-06-08). This debt anticipated that Credential, Session, Capability, and Invitation (#11–#14) would overload a compliance/ folder with atoms that carry regulated surfaces (NIST 800-63B, PCI DSS, OWASP ASVS, GDPR) but are not of compliance — they are authentication, session-management, object-capability, and onboarding primitives whose regulated surface exists only because regulation touches authentication and access. The forcing function landed and was resolved structurally rather than by re-foldering: the usage-derived taxonomy dissolved the category folders entirely, atoms are stored flat, and regulated / security are derived overlays read from the composition graph — so an authentication primitive carries the security and regulated overlays without being filed under compliance, and the “which folder” question disappears rather than being re-answered. See atoms/TAXONOMY.md and the 2026-06-08 entry in discoveries.md.

8. Spec-to-implementation lineage manifest (the “recipe”). Each reference implementation (Beacon, the Multi-Party Approval demo, and every future projection) currently records its derivation from the spec corpus only implicitly — recoverable only by reverse-engineering imports and domain-file names, as a 2026-05-29 audit of Beacon’s spec set demonstrated when its composition list had to be inferred rather than read. That implicit lineage is a gap, not a convenience: the grant’s round-trip benchmark (“regenerate the reference implementation from its grounded specifications”) cannot run without an explicit statement of which specifications, and the implementation-discovered-findings loop (contributing.md §”Implementation-discovered findings”) cannot close without it either — a spec that moves on Final Critique N must be able to name the implementations it has just made stale, and a finding surfaced during a build must route to a specific spec passage rather than to a whole file. The deliverable is a machine-readable per-implementation manifest that is (a) bidirectional — implementation → the spec files and grounding versions it derives from, and spec → its dependent implementations; (b) version-pinned — each dependency carries the spec’s grounding marker or commit so drift is detectable; and (c) granular enough to route findings — a code symbol (table, guard, invariant check) traces to a named action or numbered invariant in the spec, not merely to the file. Discipline: the manifest is generated from the implementation’s actual references and CI-checked against the corpus, never hand-authored — a hand-maintained lineage file is itself an unverified artifact, exactly the drift the methodology exists to prevent. The canonical manifest is structured; the human-readable lineage view is a projection of it — Grace Commons applied to itself. Scoped to the NLnet grant period as a named deliverable underpinning both the projector and the round-trip benchmark; surfaced 2026-05-29.

Adoption 2026-06-24 — rebuild-failure diagnostic. Operationalize the benchmark’s failure path: when a regeneration diverges, classify the failure — structural/stack gap (the agent cannot start), cross-constituent contract gap (integration divergence), missing decision rationale (business-logic divergence), or passes-tests-but-behavior-differs (test-coverage gap) — and fix in that order, structural first, so a failed rebuild localizes to a spec layer and routes to the specific invariant/action it implicates rather than to a file. Framing borrowed from the Augment Code “rebuild test” (spec-as-source guide, 2026; logged in the prior-art scan).

Adoption 2026-07-06 — backend-swappable generation: the agent behind a seam. The projector’s first generator backend is the Claude Agent SDK (the vendor’s programmatic agent toolkit, run headless) — chosen because the corpus’s seven renders were already produced by that workflow — but the backend is an adapter, never a dependency. Two requirements ride this manifest so the generating AI stays swappable. (a) The generator seam: the projector’s backend interface is one thin per-agent adapter (assemble prompt pack → dispatch → collect candidate artifacts); everything load-bearing — manifest resolution, prompt-pack assembly, the conformance + harness + lint gates, the regen loop — is backend-agnostic, mirroring the conformance validator’s architecture (same manifest, same evaluators, per-render adapters only). The prompt-pack template is tooling and lives with the projector; assembled packs are build artifacts, never committed (per the prompts-stay-out-of-the-repo rule in AGENTS.md). (b) The per-run provenance record: every generation run records, machine-readably — input identity (the spec files with their grounding markers or content hashes, the Execution Contract version, the prompt-pack template version); backend identity (model + version, toolkit version, sampling parameters); output identity (artifact hashes, each file stamped with the debt #13 marker); gate results (conformance percentage, harness verdicts, lint); and platform-sourced token cost (the measurement.md rule — never self-reported). Swapping backends is then a new adapter plus a re-run, and cross-generator agreement — agree.mjs one level up: two backends, same spec, verdict-by-verdict diff — becomes the calibration instrument, exactly as multi-render agreement localizes render defects: a divergence localizes either a backend weakness or a spec under-determination. This discharges the generation half of risks.md §Reviewer-vendor dependence; the review-council half (a cross-vendor control round for grounding gates) remains open there.*

9. Corpus Application-state audit under the composition-state rule. The 2026-06-10 adjudication (execution-contract.md §Composition state) classifies every composition Application-state element as derived index or extraction-pending, but the grounded corpus was authored before the rule existed and none of its specs carries a classification yet. The audit: for each grounded composition, classify every Application-state element against the rule’s one question (fully derivable from constituent stores through declared read surfaces?), record the rebuild procedure for derived indexes, flag non-derivable elements extraction-pending with the proposed atom named, and fold the classification into each spec’s Application state subsection. Every fold is an edit to a grounded pattern, so each rides a touch-triggered re-pass round — batch them with the scheduled-rescan automation wave rather than as manual one-offs. The known poles to run first: C6 disclosure_to_event (derivable), Idempotent Reservation token_results (non-derivable → Idempotency Result Memo), Reserve from Pool reservation_to_pool + slot_released (mixed — the flag may carry compensation truth the Event Log entries also record; the audit decides whether the atomic-write coupling makes it derivable or not). A provisional classification matrix is staged at working-ideas/composition-state-audit.md (working staging, not canonical; dies into the patterns’ Application state subsections and Lineage notes as the folds land). Surfaced 2026-06-10, Refactor 1.

Progress 2026-06-16: new compositions now carry the derived-index / extraction-pending classification (5 of 25 to date, Compensable Workflow included); the corpus retrofit fold across the older compositions remains open — pair it with item 1’s threshold-propagation sweep.

Progress 2026-08-25/26: the classification retrofit is now nearly corpus-complete. The 2026-08-24/25 closure campaign folded classifications into all nine downgraded patterns (Audit Trail’s seven-element split model — the Class A template — plus MPA, PAP, DR, PCRD, CO, EGW, CoC, RfP), and the 2026-08-26 batched pre-convention tail folded the eight May-grounded compositions (matrix rows 26–27, 32, 40–44; Idempotent Reservation’s settled pole had landed 2026-06-18). New classifications minted by the tail: APA’s attribution maps extraction-pending → Binding Registry (a new proposed atom, the registry-shaped pairing store also named for Authenticated Actor’s bijection — matrix row 28’s candidate now has two riders) and its orphan log re-house-on-Event-Log; Login’s cascade maps derived indexes over the substrate’s login-family events. Remaining unclassified grounded compositions: Resolve a Person’s Data Rights, Capability-Backed Sharing, Authenticated Actor, Actor Suspension (matrix rows 20–21, 28–31, 33–34) — C17/C18 are the matrix’s hard cases and ride the Binding Registry extraction decision.

10. Tiny Map / composition-card convention + sweep. A compact “composition at a glance” card — the constituent atoms feeding the composition, the composition’s emergent verb, and a footer naming its complement and sibling with the one-line distinction — proposed (2026-06-16) as a scannable Tier-1 bridge at the head of every composition spec. Worked exemplar (Compensable Workflow): State Machine + Event Log → Compensable Workflow · advance-or-compensate; footer complement · Undo History (compensating action vs replay-skip) and sibling · Execute Gated Workflow (failure-compensation vs approval-gating). The load-bearing semantic rule: the card renders composition — both constituents are parts of Compensable Workflow — not a dataflow pipeline (an early sketch drew WSM → Compensable Workflow → Event Log, which misreads as Event Log being downstream of Compensable Workflow). Two coupled pieces, neither yet done: (a) decide the convention — whether to adopt a ## Tiny Map section into spec-format.md’s composition shape, positioned near the head (the sketch put it directly after the title, before Summary), fixing the card’s content (constituents → composition + emergent verb; complement/sibling footer) and rendering (ASCII for portability and/or Mermaid for the site, per working-ideas/architecture-map.mermaid); adding a section to the canonical shape is a methodology change, so it lands via a short spec-format proposal, not ad hoc. (b) sweep — once adopted, add the card to every grounded composition and reconcile the complement/sibling vocabulary against each spec (the methodology distinguishes sibling — shared spine — from complement — opposite mechanism; Compensable Workflow’s own spec already carries both). Compensable Workflow is the natural first card. Surfaced 2026-06-16.

11. Method-takeaway adoptions from the agentic-formalization prior-art note (arXiv:2604.18228). Reading Towards an Agentic LLM-based Approach to Requirement Formalization (Tagliaferro et al., Politecnico di Milano, 2026) surfaced four method adoptions — full note and rationale at working-ideas/prior-art-agentic-formalization.md — each a touch-triggered edit to a grounded methodology doc: (a) a per-atom verifiability gate as an explicit, traceable field in the spec schema (verifiable? if not, why — unobservable / qualitative intent / model-external — and in which tool), not an implicit consequence of the assurance ladder (spec-format.md); (b) on the ladder, separate “intent-aligned” from “well-formed” so the Checked rung never conflates internal consistency with semantic fidelity to intent (pressure-testing.md); (c) mechanize equivalence, never LLM-judge it — wherever Alloy/TLA+ can decide equivalence it must; an LLM judge is never load-bearing for the Proved rung (pressure-testing.md); (d) decoupled per-stage validation — validate each derivation/render target against the canonical layer independently rather than end-to-end so regressions localize (execution-contract.md; applies to the derivation chain and Evergreen Modernization). The note’s fifth point — LLM extraction reliably drops logical boundaries (termination, completion, failure-detection) and invents unstated domain constraints — is empirical support for the existing grounding-threshold and adversarial-posture discipline, not a change. Each of (a)–(d) edits a grounded doc; batch with the touch-triggered re-pass wave. Surfaced 2026-06-24.

12. CWE weakness-class tags on the security overlay. The security overlay maps invariants to regulations (NIST 800-63B, PCI DSS, GDPR, FDA 21 CFR, SEC, HIPAA, OWASP ASVS) but to no weakness-class taxonomy — there is zero CWE reference in the corpus. Security atoms already enforce the behaviors recognized CWEs name (authorization gating, secret-surface separation, audit-on-mutation); tag the relevant invariants with their CWE IDs so which weakness class an invariant forecloses is explicit and machine-checkable, strengthening the regulator/audit surface. A security-overlay convention add to spec-format.md, landed only where an invariant demonstrably forecloses a named weakness — not blanket annotation. Source: the Augment Code spec-as-source guide’s constitution-pattern CWE mappings (2026). Surfaced 2026-06-24.

13. Inline generation-provenance marker on derived artifacts. Debt #8’s manifest records spec→implementation lineage externally; the complement is stamping each generated artifact itself with a generated — do not edit marker carrying its source spec, the spec’s grounding marker, and the generating model/version. This reinforces the discipline already stated for formal models — never hand-patch a derived artifact (pressure-testing.md) — by making a derived code artifact self-identifying as derived and traceable without consulting the manifest. Lands on the projector (debt #7) and is emitted and CI-checked alongside the manifest (debt #8). Source: the Augment Code spec-as-source guide (2026). Surfaced 2026-06-24.

14. Retire the C-number scheme — names are canonical. Compositions carry legacy Cn identifiers (C1–C19) inherited from the original planned-backlog sequencing (working-ideas/dream-compositions.md) — cryptic and anti-Grace: a human reading “C12” learns nothing, where “Chain of Custody” carries the meaning. Done 2026-06-24: the (Cn) suffix was stripped from the nine composition titles that still carried it, so titles are now name-only, matching the nav. Future goal: retire the Cn shorthand from cross-references too — ~1,500 in-corpus references (C1 alone ≈ 249) rewritten to the composition name/link, so no cryptic identifier survives anywhere. Scope: 19 numbers, C1–C19 — the eighteen-composition backlog plus C19 (Compensable Workflow, the one deliberate extension beyond it); the six compositions that predate C-numbering carry no number and need no rewrite. The roadmap’s composition catalog is the interim number↔name registry to rewrite against. Best done incrementally — one Cn at a time (rewrite that number’s references to the composition name/link, verify, then move to the next), each change riding the touch-trigger re-pass of the compositions it touches, rather than one big-bang sweep; once the last number is retired, a lint check enforces that no bare Cn composition reference remains. Surfaced 2026-06-24.

Progress 2026-06-24 — C1–C6 done; rename recipe, a readability step, and a lint gap recorded. C1 was a pure number-retirement (no rename): 232 cross-references → “Defensible Retention.” C2 was the first rename — number retired and the composition renamed to Propagate Consent Revocation Downstream, file included. The full rename recipe (when a Cn is also renamed, not just de-numbered): (1) git mv the spec file; (2) update its H1 and front-matter title; (3) rewrite the token, the old name (full + short), and every filename link corpus-wide; (4) regenerate atoms/index.md; (5) update the roadmap catalog entry (name + link); (6) rename the formal-model artifacts — the .tla/.als, the buggy twin, and their .cfgs — match the TLA MODULE name to the new filename, fix the old name in the model header comment, and re-run the checker (correct passes, buggy rejected); (7) readability pass — convert the composition’s self-references to “this composition” (subjects → “This/this composition”, possessives → “this composition’s”; the title/H1 keep the name), minding determiner artifacts (“the this composition X” → “this composition’s X”), hyphenated forms, and sentence-initial capitalization. Readability now runs on every retirement, rename or not. C1–C6 done (C3–C6 pure number-retirements; C5 was a no-op — already name-only in the specs, only registry/log tokens left; C6 the first big multi-file retirement, 13 files). Scope (held since C1): only spec bodies — atoms/, compositions/, root spec docs — are de-numbered; the roadmap catalog (interim registry), dated history (changelog, ai-usage-log), the tools/harness/coverage/ matrices, and working-ideas/ notes keep their Cn by design (they still carry C1–C4). Traps seen so far: ID-style false positives (e.g. APA’s “credential C2”, an ID — not the composition); non-breaking-space name doubles; a Cn embedded in a stable finding ID (the MC-Cn-N form) — leave those like the registry, historical labels not live cross-references; and a Cn carrying a leading letter (the then-current FCn form embedded a bare round-number Cn with no boundary after the FC prefix) — invisible to \bCn\b, but a landmine for any looser pattern; and (C6) redundant name+number glosses — Cn (Full Name), (composition Cn, …), [Name (Cn)](link) — collapse to the bare name rather than producing Name (Name), while per-composition round labels (Cn cluster) live in the finding-ID namespace and are left like finding IDs. Lint gap to close: the dangling-link check (A-dangling-link) validates only .md targets, so it did not catch the spec → missing .tla reference the rename briefly introduced; extend it to flag spec→model (.tla/.als) references to absent files — a companion to the no-bare-Cn check above. Finding-ID update: the MC-Cn-N / Cn-N finding IDs and Cn cluster round labels this pass deliberately left in place are now marked for removal under debt #15 — cryptic acronyms, the same anti-Grace problem.

Progress 2026-06-25 — C7 and C8 done. C7 was a rename: “Data Subject Rights Fulfillment” → Resolve a Person’s Data Rights (7 artifacts git mv‘d, 3 MODULE names matched, both twins re-verified; dated history kept the old name per the C2 precedent). C8 was a rename plus a full acronym kill — the first pass where retirement went beyond the number and the composition name. Per directive, “KYC” (not on the naming.md §6 cited-standard whitelist; correction 2 already named the target) was eliminated wholesale from the spec body, not merely glossed: the title/H1 → Customer Onboarding; the action initiate_kyc → initiate_onboarding; the id field kyc_case_id → case_id; the state map party_to_kyc_case → party_to_case; the event namespace kyc.* → customer-onboarding.* (8 event types); the example actor system_kyc_auto → system_verification_auto; and prose “KYC” spelled out to “Customer Due Diligence” / “Know Your Customer” or cut. Identifier rule (reusable): strip the acronym, then ask whether what remains needs a qualifier or already has one from context — travelling action names take it (initiate_onboarding), but in-file state keys do not (the file is the qualifier → bare case_id, party_to_case). The structural identifiers and event names were confined to the one spec (no cross-file or formal-model references — the .tla abstracts to state/openTriggers), so the rename stayed .md + model-header only (MODULE → customer-onboarding, checker re-run: correct passes, buggy twin rejected at 3 states). Scope held: spec bodies de-numbered and de-acronymed; the roadmap registry keeps its C8 tokens (display name updated to Customer Onboarding, .md/.tla links repointed); tools/harness/coverage/ and working-ideas/ left per precedent. Domain “KYC” deliberately left only where it is a generic acronym example in the acronym-policy docs (pressure-testing.md §Pass 1, spec-format.md) and a term-collision teaching example (the-spec-layer.md), plus dated Lineage acronym-gloss finding records — those are debt #15’s acronym-sweep scope, not a composition reference.

Progress 2026-06-25 — C9 done. C9 retired “Reservation Lifecycle” → Reserve from Pool — a clean rename (no acronym), and the first to dogfood the new naming grammar (working-ideas/naming.md §1): “Lifecycle” is exactly the banned category/process-shape head, replaced by the verb-led act head “Reserve” with the load-bearing distinguisher “from Pool” as its modifier (the bounded pool is what separates it from its sibling Idempotent Reservation). 5 artifacts git mv‘d to the reserve-from-pool slug; MODULE names matched, checker re-run (correct passes at 21 states, buggy twin — the non-atomic slot-leak — rejected at 5). No identifier purge: unlike C8, nothing was an acronym, so the domain vocabulary (reserve, confirm_reservation, reservation_to_pool, token_results) stays — “reservation” is the honest subject noun, not a dead token, and reserve now even echoes the verb head. 15 C9 self-refs → “this composition”; cross-files (capacity-constraint-enforcement, provisional-commitment, actor-identity, duplicate-prevention, event-log, idempotent-reservation, preference-aware-notification-fanout, README, TAXONOMY) repointed name + links, (C9) glosses collapsed. Roadmap registry keeps its C9 tokens (display name → Reserve from Pool, catalog link repointed); tools/harness/coverage/ and working-ideas/ left per precedent.

Progress 2026-06-25 — C10 done. C10 retired “Stateful Workflow Execution” → Execute Gated Workflow — the second grammar dogfood, and the sharper one. The old name’s head “Execution” was the marginal act-head flagged in the stress cases, and its modifier “Stateful” failed the word-function test (it restates the substrate — the State Machine atom is the stateful part). The spec’s own headline distinguisher is guard evaluation re-converges (the composition evaluates the approval gates the bare atom leaves caller-asserted), so by the “modifier carries the load-bearing distinction” rule the modifier resolves to Gated, not Stateful — giving the verb-led Execute Gated Workflow, which pairs as Gated Workflow vs Compensable Workflow (same head, modifier marking the real difference). 7 artifacts git mv‘d (note the extra -buggy-unaudited twin isolating the audit-binding invariant); 3 MODULE names matched, checker re-run (correct passes at 25 states, both buggy twins rejected — gate-clearance and audit-atomicity each on its own twin). No identifier purge (nothing was an acronym; start_workflow, gate_binding, decide_gate are honest domain vocabulary). 2 C10 self-refs (both parenthetical self-glosses) removed; cross-files (approval-step, state-machine, assignment, permissions, README, compensable-workflow) repointed name + links, (C10) glosses collapsed. Roadmap registry keeps its C10 tokens (display name → Execute Gated Workflow, catalog link repointed); the measurement.md token-cost ledger left untouched as dated history (it carries Stateful Workflow Execution (C10) rows by date, like ai-usage-log). Up next: C11 (Preference-Aware Notification Fanout) — already a clean name; a borderline four-word case (naming.md §4 flags it a watch item, not a correction), so likely a pure number-retirement.

Progress 2026-06-25 — C11 done. C11 was the first pure number-retirement of this run — the name “Preference-Aware Notification Fanout” stays (naming.md §4 watch item, not a correction; nounier than ideal but no better candidate found), so no git mv, no MODULE/title/slug change, no index regen. Just the number: 6 \bC11\b self-refs → “this composition” (one was the “(C11)” roadmap-row self-gloss, collapsed; the Structural-milestone “C11 marker”/”C11 row” rewritten descriptively), and cross-file C11/(C11) → the name in Preference, README, and Propagate Consent Revocation Downstream. The FCn trap bit here for real: the self-file carries 4 Final Critique 11 labels — the then-current FCn form, whose C11 substring sits behind the FC prefix with no \bC11\b boundary — all preserved at the time (finding/round labels, dated history) and since retired under debt #15, so a substring replace would have mangled them; the audit was done on \bC11\b only. Roadmap registry keeps its C11 tokens (name already canonical, slug unchanged — nothing to repoint). Model untouched (no rename), re-verified green for good measure. Up next: C12 (Chain of Custody) — already a clean, strong name (domain term of art; artifact-led head, legitimate per the §1 grammar), so another pure number-retirement.

Progress 2026-06-25 — C12 done. C12 retired as a pure number-retirement — “Chain of Custody” kept (clean domain term of art, artifact-led head, legitimate under §1). No git mv, no MODULE/title/slug change. The MC-Cn-N finding-ID trap was the live hazard here: the self-file’s 56 \bC12\b included 5 occurrences inside a stable MC-Cn-N finding ID (a \bC12\b match sits inside that ID), so a blind \bC12\b swap would have corrupted the token. Handled by protect-replace-restore (mask the finding ID → placeholder, swap the 51 bare self-refs → “this composition”, restore the finding ID); the 5 finding-ID labels were left intact for the C12 pass (dated finding IDs) and later retired wholesale under debt #15. Cross-files (provenance, README, forensic-recovery, immutable-transaction-ledger) collapsed (C12) glosses, bare C12 → Chain of Custody. Roadmap registry keeps its C12 tokens (name canonical, slug unchanged). Model untouched. Up next: C13 (Login) — clean name, pure number-retirement.

Progress 2026-06-25 — C13 done. C13 retired as a pure number-retirement — “Login” kept (clean one-word act head). No git mv/MODULE/title/slug change. Login is heavily cross-referenced by the auth family, so the work was cross-files: collapsed (C13) glosses and the slashed/bare forms (Login/C13, is C13 (Login)) across credential, session, actor-suspension, authenticated-actor, external-onboarding, and privileged-access-provisioning (whose stale Composition-notes link, pointing at ../roadmap.md, was also repointed to ./login.md); the self-file’s one marker reference de-numbered. One dated-Lineage exception left, by design: atoms/session.md Round-1 Pass-1 record quotes the rejected finding “C13/C14 sigil unexplained” verbatim — it’s a historical finding quote (and names C14, not yet processed), so it’s preserved like finding IDs; the eventual no-bare-Cn lint must whitelist dated-Lineage finding text. demos/ and tools/ reference Login by Cn but are excluded (not spec bodies), as in prior passes. Roadmap registry keeps its C13 tokens. Up next: C14 (Session-Gated Authorization) — clean name, pure number-retirement.

Progress 2026-06-25 — C14 done. C14 retired as a pure number-retirement — “Session-Gated Authorization” kept. No git mv/MODULE/title/slug change. Cross-files (credential, session, external-onboarding, login, privileged-access-provisioning): collapsed (C14) glosses and the bare/listed forms; PAP’s stale ../roadmap.md Session-Gated-Authorization link repointed to ./session-gated-authorization.md; self-file marker de-numbered; one Lineage finding-fold note de-numbered (credential.md “(C14 cross-reference linked)” → the name). The atoms/session.md:390 Round-1 quote “C13/C14 sigil unexplained” is left intact (dated finding quote — it carries both C13 and C14, preserved together). demos/, tools/, and dated history excluded. Roadmap registry keeps its C14 tokens. Up next: C15 (Capability-Backed Sharing) — clean name, pure number-retirement.

Progress 2026-06-25 — C15 done. C15 retired as a pure number-retirement — “Capability-Backed Sharing” kept. No git mv/MODULE/title/slug change. Self-file: 80 bare C15 self-refs → “this composition” (no finding-IDs to protect — trap check clean); artifacts and the self-marker de-numbered. Cross-files (capability, README, privileged-access-provisioning): collapsed (C15) glosses and bare forms → Capability-Backed Sharing; PAP’s stale ../roadmap.md link repointed → ./capability-backed-sharing.md. One dated-Lineage exception left: atoms/capability.md Lineage note quotes a dropped stale peer-status marker “C15 partially resolved” verbatim — preserved like finding labels (debt #15 scope), same call as session.md:390. Roadmap registry keeps its C15 tokens. Up next: C16 (External Onboarding) — clean name, pure number-retirement.

Progress 2026-06-25 — C16 done. C16 retired as a pure number-retirement — “External Onboarding” kept. No git mv/MODULE/title/slug change. Self-file (external-onboarding.md): 2 C16 self-refs → “this composition” / de-numbered marker. Cross-files (customer-onboarding, credential, invitation, privileged-access-provisioning): collapsed (C16) glosses and bare/C16-admitted forms → External Onboarding; PAP’s stale ../roadmap.md link repointed → ./external-onboarding.md. One data-contract change, by decision: customer-onboarding.md’s enrollment_path enum value c16 → external-onboarding (5×), since the value named the admission path by C-number — {direct, external-onboarding} now reads semantically (the prose C16-admitted branch → External-Onboarding-admitted branch to match). One dated-Lineage exception left: atoms/credential.md triage note keeps “C16 = External Onboarding are correct” (registry number↔name mapping, same call as its C8 = Customer Onboarding half). Roadmap registry keeps its C16 tokens. Up next: C17 (Authenticated Actor) — clean name, pure number-retirement.

Progress 2026-06-25 — C17 done. C17 retired as a pure number-retirement — “Authenticated Actor” kept. No git mv/MODULE/title/slug change. Self-file (authenticated-actor.md): 3 C17 self-refs → “this composition”. Cross-files (credential, session, README, actor-suspension): collapsed (C17) glosses, possessives (C17's → Authenticated Actor’s), and bare forms → Authenticated Actor. actor-suspension.md (C18) carried the most (9) — handled by ` (C17) → "" then C17’s/C17 → the name, with its own **C18 self-number left intact** (50 occurrences, for the C18 pass). Roadmap registry keeps its C17` tokens. Up next: C18 (Actor Suspension) — clean name, pure number-retirement; then C19 (Compensable Workflow) is the lone remaining rename.

Progress 2026-06-25 — C18 done. C18 retired as a pure number-retirement — “Actor Suspension” kept. No git mv/MODULE/title/slug change. Self-file (actor-suspension.md): 73 bare C18 self-refs → “this composition” (no finding-IDs to protect); artifacts and the one determiner (a C18 defect → a defect of this composition) cleaned. Cross-files (session, README): collapsed (C18) gloss and the bare C18 wires … form → Actor Suspension. Roadmap registry keeps its C18 tokens. Up next: C19 — the last C-number, and the one genuine rename of the back half.

Closeout 2026-06-26 — lint guards landed. The two checks debt #14 named as its closeout are now in tools/linter/lint.py: check L flags any bare composition C-number (C1–C19) in an atom/composition live body (example credential Cn IDs scrubbed; root policy docs that cite Cn as a teaching example are out of scope; Lineage skipped as dated history), and the dangling-link gap is closed by extending check A to resolve .tla/.als/.cfg markdown links, not just .md — which immediately caught a space-mangled compensable-workflow.cfg link left by the C19 rename. Corpus lints clean.

Progress 2026-06-25 — C19 done; debt #14 COMPLETE. C19 retired as a rename plus a domain-term purge: “Saga / Compensable Workflow” → Compensable Workflow (naming.md §4 correction 5 — “Saga” is jargon that must be looked up, and the slash is two names). Per directive the lowercase runtime noun was purged too: 7 artifacts git mv‘d to the compensable-workflow slug; 3 MODULE names matched and the checker re-run (correct passes; both buggy twins rejected — skip-comp → Inv4, double-apply → Inv7); self-file capital Saga self-refs → “this composition”, and ~120 lowercase runtime saga → “compensable workflow” (the cap/lowercase pattern↔instance distinction the spec relied on is preserved, just renamed). Prior-art kept literal: the Garcia-Molina Sagas citation, the io.temporal.workflow.Saga SDK class, and the “Saga Isolation / Semantic Lock” concept all stay “Saga” (external names, not internal jargon; audit-trail.md’s generic “saga compensation” mechanism term likewise). Cross-files (event-log, undo-history) → Compensable Workflow; roadmap registry display name + .md/.tla/twin links updated with C19 tokens kept; atoms/index.md regenerated (slug saga → compensable-workflow). debt #14 is COMPLETE — C1–C19 all retired; no bare Cn composition reference survives in any spec body. The Cn tokens that remain are the deliberately-kept ones: the roadmap registry, dated history (changelog, ai-usage-log, discoveries, open-questions, measurement), finding IDs (MC-Cn-N, FCn, the C13/C14 Pass-1 quote), tools/, working-ideas/, and demos/ — all debt #15’s deferred acronym-sweep scope. The no-bare-Cn lint check named as debt #14’s closeout can now be added and will pass.

15. Tighten the acronym rule to whitelist-only, and sweep out the internal coinage. The policy already exists from the prior language sweep — spec-format.md (every acronym spelled out and defined at first use, all tiers) and pressure-testing.md §Pass 1 (no undefined acronym anywhere — a reference-graph violation) — with a cited-standard whitelist already drafted in working-ideas/naming.md §6 (HIPAA, GDPR, SOX, PCI DSS, CFR, NIST, FHIR, FRCP, TCPA, FDA, AML — external standards, statutes, or regulatory bodies only; a whitelisted initialism may be cited in a spec but never be a pattern name). The gap: the enforced rule is gloss-at-first-use, which still admits the methodology’s own coined shorthand — FCn (Final Critique n), FCn-N, Fn, Cn-N, MC-Cn-N, Cn cluster / Refactor n, and the borderline GRID / EOS / Pass n — a reader gains nothing from “Final Critique 5” even glossed. Two accepted classes only: (a) the cited-standard whitelist above, and (b) a small whitelist of globally-accepted everyday initialisms (API, URL, ID, EU, US, …), each still defined on first use and kept rare-to-none. Everything else — the internal coinage — is marked for removal: spell the concept out or cut it, don’t merely gloss. Mechanism: generalize naming.md §6 into one corpus-wide allowed-acronym whitelist the Pass-1 check enforces (extending the linter’s standards-proper-noun scrub), then sweep the Status/Lineage labels and the few live-body leaks (one fixed in preference-aware-notification-fanout.md, 2026-06-24). This reverses #14’s interim “leave finding IDs” stance — those labels are on the removal list. Best ridden on the touch-trigger re-pass wave. Surfaced 2026-06-24.

Progress 2026-06-26 — spec bodies swept; regression guard landed; broad whitelist enforcement deferred. The internal coinage is out of the specs: FCn → “Final Critique n”, the MC-Cn-N coverage findings → descriptive (“the Invariant-4 coverage-gap finding”), and the finding-ID schemes Cn-N / Rn-Fn / OG-n / S-n / FC-Fn either dropped (the round/pass is already named in each section header) or rewritten to plain English, across all of atoms/ and compositions/ (prose and .tla/.als model comments). The bare composition C-numbers were taken out of the spec bodies too, per a follow-on directive — including the nameless cross-refs (unlike C7's → unlike Resolve a Person's Data Rights'). working-ideas/naming.md gained “Rule zero” (never coin an acronym/sigil; names for humans, IDs for machines; only cited standards + GRID/EOS excepted), and check M in the linter is the high-precision regression guard for the exact coinage shapes (bare S-n excluded — SEC “S-1” collision). Deliberately scoped/deferred: (a) the broad allowed-acronym whitelist enforcement — a general acronym scanner would false-positive every TLA+/GDPR/WASM and fight a prose pass, so the precise sigil guard stands in its place until a curated whitelist is worth building; (b) the internal docs (roadmap registry, working-ideas/, tools/, demos/, dated history) keep their tokens by decision — the C-number is the registry’s stable key, and the conformance tooling consumes Cn codes functionally. The spec layer is the part that had to be clean, and is.

17. Constituent-call contract check — LANDED 2026-08-24 (F-constituent-call), residual future work recorded. The 2026-08-24 batched fresh-reader rounds surfaced a recurring drift class no gate was catching: a constituent atom re-grounds and its action contract moves, but nothing mechanical re-checks the compositions that call it — Privileged Access Provisioning was found calling a removed Capability.expire, passing allocated_by_ref=/resource_ref= against allocate(allocator_ref, scope, max_redemptions, ttl), and a phantom retention_policy= argument on AuditTrail.record_action had spread to six compositions (and had even been adopted by Resolve a Person’s Data Rights’ Final Critique 5, which resolved the contradiction backwards by taking the sibling composition’s usage as the reference instead of the constituent’s contract — the propagation mechanism in miniature). Landed as tools/linter/lint.py’s F-constituent-call, the second mechanical slice of the capability-provenance rule (the first is F-invariant-ref): every qualified call site Constituent.action(args) in a composition body (above ## Status — Lineage legitimately quotes superseded signatures as history) must name an action the constituent declares, and every keyword argument must appear in that action’s parsed contract (Projected contract: lines and bold-inline signatures; ?/bracket optional markers stripped). Precision over recall: action existence is checked against a broad backticked-call set so odd declaration formats never false-positive, and keyword checks run only where a strict contract parsed. Deliberately out of scope (stays fresh-reader): positional-arity drift (read_chain(chain_id) against read_chain(actor_ref, query)), renamed rejection reasons, prose references without parentheses (the Capability.expire citation form), and semantic drift. First run: 13 findings, all true positives, zero false — five in Execute Gated Workflow (already routed as EGW-2.1), two in Privileged Access Provisioning (already routed), and six previously unknown in Capability-Backed Sharing (×3) and Resolve a Person’s Data Rights (×3), both grounded and outside the 2026-08-24 review batch. Progress 2026-08-24: the six newly-found sites were corrected same-day as editorial fixes (the parameter is unimplementable as written — see each pattern’s Lineage; RPDR’s entry also supersedes its Final Critique 5 backwards resolution), taking the check’s baseline to 7 findings, every one already routed (Execute Gated Workflow ×5 = EGW-2.1; Privileged Access Provisioning ×2 = its F9) — the check now goes green exactly when those patterns’ closure rounds land. Progress 2026-08-25: Privileged Access Provisioning’s closure round corrected its two Capability.allocate call sites (its F9 closed), taking the baseline to 5 findings, all Execute Gated Workflow’s EGW-2.1 — and later the same day Execute Gated Workflow’s closure round absorbed the regrounded record_action contract (EGW-2.1 closed), taking the check — and the linter as a whole — to 0 findings, fully green for the first time since the check landed.

19. Methodology verification-surface refactor — the campaign the authentication pass pointed at (sequenced next; 2026-08-26). Nine fresh-reader gates ran during the authentication-precedence application; none returned clean, and the findings were overwhelmingly not authentication debt. Read as a signal rather than a scoreboard, three things follow, and they are methodology work rather than pattern work.

(a) Capability provenance checks the wrong surface. The recurring classes — rebuilds sourced from event payloads the substrate lawfully destroys (three patterns), enumeration-shaped queries against a substrate that explicitly routes them to a forthcoming Reverse Index (three patterns), seal-range presentation contracts a composition cannot satisfy under a cadence it permits (two patterns) — are one meta-shape: a composition asserting a capability its substrate specifically disclaims. That is precisely what §Capability provenance exists to forbid, and it is not catching them, because the rule polices claims about capabilities (the Rests on: lines) and not uses of them. The uses live in rebuild procedures, Generation acceptance checks, enumeration and traversal logic, and presentation contracts — call sites that do not look syntactically like calls, which is exactly why they escaped. A mechanical slice is available with a working precedent: the linter’s F-constituent-call already verifies that every qualified Constituent.action(args) names a real action with real parameters; the extension is to subject every declared read, rebuild, enumeration and derivation to the same check against the constituent’s declared query surface. Widen the rule’s text first, then the check.

(b) grounded is a dated verification claim, not a permanent property. Today it means “cleared a gate at some point”, while the roadmap’s counts and milestone language read it as current state. The old gate results were not wrong — they have aged, and this campaign is itself a cause of that aging. The fix is to make the provenance explicit rather than to attach a bare expiry: a grounded marker should carry the gate that passed it, the methodology revision and corpus revision in force at the time, and the date, so grounded — current and grounded — stale are distinguishable without discarding the historical claim. The governing rule to state: any methodology change or constituent change affecting a pattern’s verification surface invalidates its grounded status until re-gated.

(c) Semantic-premise auditing is a distinct refactor operation and should be named as one. The applier-hazard entry in pressure-testing.md records the observation; the methodology should carry the operation. Updating step references is syntactic and cheap. Identifying every claim whose truth depends on the changed execution shape is a different class of dependency, and it is the one that inverted a guarantee three times in this pass while every step number stayed numerically correct. It is also measurable, and should be measured: per touch, record the count of sites that required changing but were not syntactically adjacent to the change. That number is a coupling metric for the representation itself, and the standard it serves is worth stating plainly — a competent editor should be able to make a bounded architectural change without a corpus-wide semantic archaeology expedition. A representation that is improving shows the count falling; a three-line change that reliably detonates six distant claims is failing a test rather than merely feeling awkward.

Pre-campaign survey — 2026-08-27 (measurement only; no pattern touched, no finding closed). Before designing anything, the three recurring classes the authentication pass surfaced were sized mechanically across all 52 patterns, over pattern bodies with Lineage and Status excluded so historical narrative could not inflate a count. Two results change the shape of this campaign.

Result 1 — the classes are small, and the largest is not the one that looked largest.

Transactional atomicity asserted over an append-only substrate: three instances — Capability-Backed Sharing, Propagate Consent Revocation Downstream, and Resolve a Person’s Data Rights, which the gates had not found — now routed into that pattern’s Lineage as SURVEY-F1 rather than left in this survey alone, since a survey entry is a weaker home for a foundational finding than the pattern’s own record. The test that isolates it is sharper than the phrase: not does the pattern say “together or not at all” (nine do, most benignly, over constituent-store writes only) but does an all-or-nothing sentence name an audit write inside its member set.
Payload-sourced rebuilds with no stated bound on their own totality: eight compositions — Customer Onboarding, Defensible Retention, Execute Gated Workflow, Login, Multi-Party Approval, Preference-Aware Notification Fanout, Privileged Access Provisioning, Propagate Consent Revocation Downstream. This is a floor, not a ceiling: the test keys on the literal *Rebuild procedure:* marker, so a pattern that rebuilds in prose is missed. The largest class, and the one whose consequences reach furthest — in Execute Gated Workflow it lets one human approval authorize a second regulated firing once a payload is purged.
Enumeration over an index that declares rebuild-on-miss: roughly three load-bearing instances — Execute Gated Workflow’s gate_binding (three sites, one driving a cascade over human approvals), Forensic Recovery’s and Reserve from Pool’s acceptance checks. Most of the fourteen candidates a loose test returns are term entrys and clock-stamping prose.

Result 2 — the corpus already contains the correct treatment for each class, gate-cleared, written by an earlier round. This is the finding that matters, because it turns the campaign from design a fix and apply it into propagate a fix that has already survived a fresh reader:

Atomicity → Chain of Custody Invariant 4, which states the split explicitly: “Because Provenance entries are immutable once committed and synchronous rollback is unavailable, the orphan state … is reachable under the prescribed design, durably, until compensation lands. The honest claim therefore splits” — safety as no unsurfaced orphan, liveness as detection-and-compensation with two mandatory legs including a reconciliation scan. It also shows the intent record sharpening that scan, so the authentication work composes with this fix rather than colliding with it.
Retention horizon → Audit Trail, whose rebuild carries “Bound on the rebuild’s totality, stated rather than assumed” and then states what the bound is and why it suffices for the marker’s one job. The substrate that performs the destruction is the pattern that reasons about it correctly, which is the right place for the exemplar to live.
Enumeration anchoring → Login, partially: its login_event_log is declared the durable intent — truth-bearing for exactly that window, a named bounded exception to the derived-index classification rather than an unexamined enumeration. Weaker than the other two exemplars and worth strengthening rather than copying verbatim.

Result 3 — the widened check of (a) is buildable, and this survey is its prototype. Two of the three classes were found by mechanical tests over the corpus, not by reading: an all-or-nothing sentence naming an audit write, and a payload-sourced rebuild with no totality bound. Both are the shape (a) argues for — they police a use of a constituent capability rather than a claim about one, at call sites that do not look syntactically like calls. Building them as linter checks is the concrete first deliverable, and the survey scripts are the starting point. Note what this does not yet reach: the third class needs to distinguish a keyed lookup from an enumeration over the same map, which is a parse rather than a match.

Revised sequencing for this campaign. (i) — DONE 2026-08-27. §Capability provenance now covers uses as well as claims: its heading, the four surfaces where a use hides (rebuild procedures, acceptance checks, enumeration and traversal logic, atomicity and presentation contracts), the unchanged four-source test applied to uses, and — the part worth keeping — an honest re-reading of its own 2026-06-08 corpus rescan, which found zero undeclared dependencies and was narrow rather than wrong: it swept the Rests on: lines, which is the surface the rule then named. Treat a clean sweep as evidence about the surface swept, and record which surface that was. (ii) — DONE 2026-08-27. Both checks are in the linter as P-atomic-audit and Q-rebuild-bound (tools/linter/lint.py), with fixture tests in tools/linter/test_checks.py. Exact counts, replacing the survey’s floors: P fires on 3 patterns / 9 sites (Capability-Backed Sharing, Propagate Consent Revocation Downstream, Resolve a Person’s Data Rights) — the survey’s three, confirmed; Q fires on 8 patterns / 15 sites (Customer Onboarding, Defensible Retention, Execute Gated Workflow, Login, Multi-Party Approval, Privileged Access Provisioning, Propagate Consent Revocation Downstream, Reserve from Pool). Both exemplars are silent, which is the property the fixture tests pin.

Three things the build settled that the survey could not. (1) P’s per-site count is the useful number, not its per-pattern one: Resolve a Person’s Data Rights fires four times, and one of those is the invariant the survey routed while the other three are unqualified restatements of the same claim in the Summary, the load-bearing wiring decision, and an edge case. A pattern can carry the qualification in one place and contradict it in three. (2) A generic hedge is not an acknowledgement: the first draft of P treated the word modulo as a suppressor, and a modulo-clause about a different boundary (an irreversible purge) then hid the claim about the audit write — the very finding the survey had routed. Suppressors must name what is acknowledged. (3) Widening Q to catch a known instance (Preference-Aware Notification Fanout, whose rebuilds read payload fields through phrasings the check does not see) also made Audit Trail fire falsely, on a rebuild reading event_id and sequence_number — fields the cascade preserves. That names the real test: not does it touch a payload but does it read a field the cascade destroys, which needs the surviving-field set subtracted from what the clause names. The widening was reverted, the gap written into the check’s docblock, and the count left at 8 — recall grows by adding checks, not by loosening one until it matches the answer you expected.

Both codes are advisory: they print and are tagged, and do not fail the continuous-integration gate. Turning the gate red before the findings are worked is how a check gets muted rather than fixed. They become gating when step (iii) closes them — the moment a check starts defending a property instead of measuring it. (iii) Propagate the three exemplar treatments, cheapest class first — atomicity (three patterns, one of which reaches a formal model), then enumeration anchoring (three), then the retention horizon (eight, and the one that needs a configuration obligation rather than only a clause). In progress — one of three atomicity instances landed 2026-08-27: Resolve a Person’s Data Rights, the instance that reaches a formal model, restated as safety plus liveness with its model and both twins rebuilt (bound dropped, coverage re-keyed onto the sealed event, 4 reachable states where there were 2, each config-listed invariant with a dedicated rejecting twin). P-atomic-audit fires zero times on it, where it fired four; corpus advisory total 24 → 20. The propagation cost more than the survey estimated, and the overrun is the useful finding. The survey scored this instance as the cheapest of the three because its write order was already correct — and that was true, and the English restatement was indeed small. What was not costed is that stating liveness raises the question the atomic claim suppressed: compensate with what. The compensating event needs the disposition set, which existed in neither the event that failed to land nor the process that died; the reconciliation scan the safety arm names needs a join key, which the disclosure scope did not carry; and the bound the liveness arm asserts needs a declared configuration value, or it is not a bound. So the round added two Configuration knobs, a payload to each of two intent records, a request_id to the disclosure scope on both paths, a mandated scan with a restart trigger and a cadence, and one Generation acceptance check. Budget the mechanism, not the sentence. A restatement that stops at the sentence produces a liveness claim no deployment can discharge and no auditor can test, which is a worse artifact than the overstatement it replaced: the overstatement was at least falsifiable.

Second instance landed 2026-08-27 — Capability-Backed Sharing — and it changed what this class is. The survey had scored it as a third restatement. It was not. Its claim was not merely unprovable; it was false, and the wiring made a forbidden state reachable: both committing actions put an Audit Trail append inside a host transaction’s atomic set, so a transaction aborting after the append had landed left the trail asserting a sharing.disclosed disclosure the canonical state said never happened. The treatment was a protocol repair, not a restatement — both actions rewired to durable intent → transactional domain mutation → durable outcome, a new service-attested recovery marker on the redemption path, a transactional pending seal state, a mandated three-direction reconciliation scan, and a rebuilt formal model whose third twin is the composition’s own previous wiring, rejected on the invariant the repair introduced.

The class therefore has two manifestations, and telling them apart is the first thing a round must do:

	The claim	The wiring	The treatment
Manifestation A — Resolve a Person’s Data Rights	impossible to prove	execution order already preserves safety; the reachable partial is the recoverable one	restatement — safety plus liveness, plus the mechanism that makes liveness dischargeable
Manifestation B — Capability-Backed Sharing	false	rollback makes a forbidden state reachable, and it is a state nothing can repair	protocol repair — move the durable append out of the atomic set, then restate

The discriminator is a single question: does anything durable end up asserting a fact the canonical state denies? A missing record is recoverable; a false one is not. Equivalently, as the third instance made concrete: is the reachable partial recoverable? If the composition can still reach a coherent state from it — append the missing seal, revoke the unattached capability — the ordering was already right and the claim was the only thing wrong. If it cannot — because the durable thing that landed asserts a fact the canonical state denies, and un-appending is foreclosed while manufacturing the missing record would fabricate evidence — then no restatement discharges it, because a composition cannot honestly restate its way out of a reachable state it has no way to leave. Manifestation B is the more dangerous of the two precisely because it reads as better-defended: this pattern argued for its atomicity, reasoning correctly that its Capability counter rolls back and concluding the whole set was atomic, and a previous gate had hardened the wrong claim by adding a qualifier to it.

The rule this campaign converged on. It landed 2026-08-27 as pressure-testing.md §Durability boundaries, when the class closed — the first of three sections debt #19 produced, alongside §A derived index is trustworthy only where a miss is observable and §Derived state has a validity duration, all three frozen together on 2026-08-29 (debt #20 below), after the two remaining classes of this debt ran and neither returned a case the sections did not cover. The section carries the two manifestations, the discriminator, the three tells, the material-versus-boundary rule for compensation, and what the class did to the formal layer. Its core:

Never include an independently durable append in a host transaction’s atomic set. If the append cannot participate in the transaction — and an append-only audit substrate never can — then specify the ordering across the durability boundary, the reachable partial states it admits, and the recovery for each, explicitly. An all-or-nothing claim whose members straddle a durability boundary is not a strong guarantee stated loosely; it is a false one, and the direction it fails in decides whether the fix is a sentence or a protocol.

Third instance landed 2026-08-27 — Propagate Consent Revocation Downstream — classified A, and it is the purest instance of the class. Both members of its “atomic” pair are irreversible: Consent’s revocation is terminal by the atom’s own invariant, and the substrate’s append cannot be withdrawn. Neither was ever enlistable, so unlike its two siblings there was not even one member a host transaction could have rolled back — and the pattern’s own edge case states the refutation two sections from where the claim was made. It classifies A because its reachable partial is a missing propagation record, never a false one, and because processing suppression is not deferred by it at all: the gate reads the consent store and is honest the instant the revoke commits. The gap is in the accounting, not the lawfulness.

It also produced a cheaper variant of the treatment. Its gate had found a third leg: the propagation set’s boundary was “registrations ordered before the consent.revoked event”, which is sound for a clean withdrawal and wrong for a compensated one, because a compensating append lands in a later invocation than the read it reports — so the boundary would have convicted a correct compensation, and the compensation had nothing to compute the set from anyway. Moving the boundary to the withdrawal’s own intent event fixed both, at no new field on any event and no second copy of the set. That is materially cheaper than the sibling treatment, and the reason generalizes:

When a compensation needs material the failed write carried: carry the material if it is a computed verdict, carry the boundary if it is derivable from an append-only log. Resolve a Person’s Data Rights had to duplicate its disposition set because no log records a verdict. Propagate Consent Revocation Downstream carried a boundary because its scope set is derivable from processing.registered events — and a boundary is strictly better where it is available, since it cannot drift out of agreement with the thing it bounds.

The class is closed. All three instances repaired; P-atomic-audit fires zero times corpus-wide and was promoted from advisory to gating — the condition this section set for promotion, a check becoming gating at the moment it stops measuring a backlog and starts defending a property. The fixture test’s corpus pin set is empty and its exactness turns that emptiness into an assertion: any future firing is reported as an unpinned pattern rather than joining a backlog, and the regression coverage lives in synthetic fixtures that do not need a broken corpus pattern to exist.

One cross-pattern observation the class produced, worth keeping when the rule is frozen. isolate.mjs reports Propagate Consent Revocation Downstream’s no propagation event without its revoke as by-construction, with no dedicated twin — correctly, because no wiring of that composition can violate it: the earlier write’s terminality is the constituent’s guarantee. The identical claim in Capability-Backed Sharing had a reachable, unrepairable violation and now has a twin that is the composition’s own former wiring. The same claim is a frame property in one pattern and a reachable defect in another, and which it is depends entirely on whether the earlier write can be taken back — which is the discriminator again, arriving from the formal layer instead of the prose.

Next class: enumeration anchoring. Its classification sweep ran 2026-08-27 and changed the class in three ways — the count, the exemplar, and the statement. Running the sweep before designing anything is now standing practice for this debt, because it has twice returned something the pre-campaign survey had wrong.

The count: five instances, not three. The survey found three by mechanical test (Execute Gated Workflow’s gate_binding at three sites, plus Forensic Recovery’s and Reserve from Pool’s acceptance checks). Since then the authentication-precedence gates routed two more that the test could not have found, because they are not enumerations of an index at all — they are other read shapes that step outside the same contract. Two of the five are newly identified here and are not yet routed in their patterns.

The statement: the class is not “enumeration over a rebuild-on-miss index”. That named one symptom. The class is:

A derived index can only be trusted where a miss is observable. Rebuild-on-miss is a keyed-lookup contract: it repairs a gap because a lookup that finds nothing is a signal. Every other read shape steps outside that contract and the index’s guarantee silently stops applying — enumerating the index, counting its entries, quantifying an acceptance check over it, reading a list under a key where the loss is per-element, or rebuilding it while something depends on its current contents. The Contract classification says derived index, rebuild-on-miss, and a reader reasonably concludes losses are self-healing. They are self-healing only at the shape the contract names.

The five, and they are four distinct shapes:

Pattern	Site	Shape	What a lost entry does
Execute Gated Workflow — F10, routed	`gate_binding`, enumerated to derive the moot-gate plan; and acceptance check 4	enumeration: a miss cannot fire	silent safety failure — the gate is absent from the plan, the cascade never withdraws it, and a moot human approval survives Pending; check 7 keys on the plan, so it cannot notice
Capability-Backed Sharing — F6, routed	acceptance checks 2 and 3	the quantifier is the record whose absence defines the orphan; check 3 verifies a derived index against its own source	silent blindness in the audit surface — the check cannot see the thing it exists to find
Multi-Party Approval — F6, routed	`chain_store` rebuild inside an open recovery window	rebuild-on-miss collides with a truth-bearing declaration	silent data loss at a crash — the rebuild destroys the only record for that window
Forensic Recovery — closed 2026-08-27	`recover_history` read the `record_to_events` list	miss detector at key granularity, loss at element granularity	silent, and it broke the pattern’s load-bearing Invariant 3 — a short list is not a miss, so a truncated forensic history returned as a complete one
Reserve from Pool — new, unrouted	acceptance check 1 (allocation coherence)	index gap misdiagnosed as a substantive violation	loud but wrong — the count comes up short and the check reports an allocation divergence; the obvious remediation (reconcile the pool counter) would be a real corruption

The discriminator, as with atomicity: what does the gap cause? Four of the five fail silently, and three of those break a load-bearing claim. One fails loudly and wrongly, which is the benign end — it wastes an auditor and invites a harmful fix, but it hides nothing. Order the rounds by that: Execute Gated Workflow first (real harm, silent, and its plan’s exactness argument was strengthened during the authentication campaign on an enumeration that cannot support it), then Forensic Recovery, then the three audit-surface instances.

The exemplar: Audit Trail, not Login. The pre-campaign survey named Login’s login_event_log bounded exception and called it “weaker than the other two exemplars and worth strengthening rather than copying verbatim.” That was looking in the wrong place. Audit Trail’s unretained-event sweep (the third half of Invariant 2’s liveness arm) is the complete, gate-cleared treatment and states it outright:

“Enumerate the audit log through the declared open-upper-bound read … For each returned event, test event_to_retention[event_id], and rebuild on miss first. The ordering is load-bearing … a scan that read a lost entry as *no retention exists would misdiagnose an index gap as a compliance finding — and then compensate it, placing a second retention over an event that already had one … So the scan rebuilds from the retention store’s own record_ref before it concludes anything, and only a miss that survives the rebuild is a miss.”*

That is the treatment: anchor the read in the authoritative record, and use the index as a cache probed per element with rebuild-on-miss before concluding anything. It carries an assumption that Forensic Recovery’s round (2026-08-27) forced into the open: that the authoritative source outlives the cache. Where a retention horizon can reverse that — the substrate enumeration keys on a payload field the purge destroys, while the index’s ids still resolve — replacing the index with the enumeration turns a completeness fix into a completeness regression at exactly the horizon a forensic reader cares about. So:

Variant: where a retention horizon can make a derived index outlive the record it derives from, anchor by reconciliation rather than by replacement. Compute both directions and report each divergence for what it is — a transition the index lost is an index gap the rebuild closes; one the enumeration can no longer reach is a lawfully-purged payload, which is a fact, not a gap. Each side can hold what the other has lost. This is where the enumeration-anchoring and retention-horizon classes meet, and they meet in a direction that reverses the fix — an anchoring round that ignores the horizon does not merely leave the next class work, it can regress the thing it repaired.

The variant then generalized, and it is the class’s real statement. Multi-Party Approval’s instance is the mirror of Forensic Recovery’s and breaks the same move from the opposite side. There the cache can outlive the source, because a retention horizon destroys the payloads the source is keyed on. Here the cache can precede it: chain_store is truth-bearing inside a declared [Initiate Chain] recovery window, before the chain_initiated event exists, so a rebuild running in that window enumerates the events, does not find the chain, and reconstructs a store without it — destroying the only record of it. Two different mechanisms — retention on one side, a timing window on the other — falsifying one assumption:

“Anchor in the authoritative record” silently assumes the authoritative record is both complete and current with respect to the cache. Where it is neither — a horizon behind it, a write window ahead of it — replacement loses data that only the cache holds. So the class’s treatment is reconciliation, and anchoring is the special case that is safe only when that assumption holds. On the read side: compute both directions and report each divergence for what it is. On the write side: a rebuild must be additive over the surviving store while any truth-bearing window is open — never let the repair mechanism outrank the record it is repairing.

Stated this way the five instances stop being five shapes and become one: a derived index is only self-healing where a miss is observable and the source is complete and current. Each instance fails one of those two conditions, and the sweep’s four “shapes” are which condition, on which side. It restores the keyed-lookup shape the contract is written for, one element at a time, inside a read that is anchored somewhere the losses cannot occur. Multi-Party Approval’s instance needs the variant its own finding prescribes — a rebuild that is additive over the surviving store while any truth-bearing window is open — which is the same principle from the write side: never let the repair mechanism outrank the record it is repairing.

The class is closed — all five landed 2026-08-27. Execute Gated Workflow F10 (the moot-gate plan anchored in the gate_opened events); Forensic Recovery SWEEP-F1 (the history read reconciled in both directions — the round that found the retention variant); Multi-Party Approval F6 (the rebuild made additive — the write-side mirror that generalized the variant into the class statement above); Capability-Backed Sharing F6 (check 3 anchored in the intent events, applying the residue triage check 5 already carried); Reserve from Pool SWEEP-F1 (the allocation count taken from the journal).

The rule landed in pressure-testing.md §A derived index is trustworthy only where a miss is observable — the five read shapes that step outside the rebuild-on-miss contract, the reconcile-never-replace treatment with both of its failing assumptions, the three tells, and what the class did to twin coverage. It was written after the third class’s rule rather than with its own, which is worth recording as a process miss: the reasoning given when landing the first rule — a finding that lives only in a roadmap debt entry is a finding on its way to being lost — was applied to classes one and three and skipped for class two, leaving a dangling cross-reference in the meantime. A campaign step that is discretionary gets skipped under momentum; landing the rule belongs in the class’s own closing round, not after it.

No linter check was built for this class, and that is a decision rather than an omission. The survey said so in advance — distinguishing a keyed lookup from an enumeration over the same map “is a parse rather than a match” — and the closed class confirms it: two of the five instances are not enumerations at all (a list read under a key; a rebuild colliding with a write window), so a mechanical test keyed on read syntax would have found three and pronounced the class clean. The classification sweep found five and reclassified the shape, which is the argument for keeping the sweep as a campaign step rather than treating it as a stopgap until a check exists. What is mechanizable and worth building later is narrower and honest about being so: flag a Composition-state element classified derived index / rebuild-on-miss that is also declared truth-bearing in any window, which is the collision Multi-Party Approval’s instance was.

Three cross-cutting tells this class confirmed, each observed in three or more of the five: the principle already present in the pattern and applied to one site but not its neighbour (Forensic Recovery’s step 6 versus step 4; Capability-Backed Sharing’s check 5 versus check 3; Execute Gated Workflow’s keyed lookups versus its enumeration); a check that verifies an index against its own source, which finds dangling references and by construction cannot find omissions, so a clean pass is not evidence; and a claim strengthened by an earlier campaign resting on a set a later class shows to be incomplete (Execute Gated Workflow’s exact plan).

Third class: the retention horizon. Its classification sweep ran 2026-08-27 and it is not the cleanup round the sequencing implied — it is the floor the other two classes are standing on.

The central technical result, and it is worse than the class’s name suggests. Event Log’s contract is append(data) → event_id: an entry is an opaque payload and its id. There is no separate action_ref field, no separate actor_ref field — Audit Trail packs all of it, plus the caller’s own data, into that one payload. So the surviving-field set after a purge is the event’s event_id, sequence_number and recorded_at, plus the attestation’s action_ref, actor_ref and attested_at — the latter three reached through the destruction record’s (event_id, attestation_id) pair, which Audit Trail captures before the delegation runs precisely so a purged event stays answerable. (This sentence originally read “event_id and sequence_number, and nothing else” and was corrected 2026-08-27 by a fresh-reader gate on Defensible Retention (its F5), verified against Audit Trail’s purge clause; the error is analysed in pressure-testing.md §Derived state has a validity duration.) A purge therefore does not thin a rebuild’s fields, and it does not erase the event’s identity either — it destroys the payload, and with it every binding a composition wrote there. Identity survives; binding does not. Every rebuild phrased as enumerate the substrate and filter to events whose action_ref is one of this composition’s own — the standard move, used by most of the instances and by the substrate itself — stops being able to find its own events at all past the horizon. It does not return less; it returns nothing and cannot tell that it should have returned something. This is also why Audit Trail’s own event_to_sequence is the one index of its four that is unconditionally rebuildable: it maps event_id to sequence_number, which is exactly the surviving pair.

Count: 14 genuine firing sites across 8 patterns from Q-rebuild-bound (15 before the polarity fix below) — plus known recall gaps. The check keys on the literal *Rebuild procedure:* marker, so it misses Preference-Aware Notification Fanout (which the pre-campaign survey found by reading) and Forensic Recovery, whose instance is routed as AP-F1 by a gate rather than by the check. Call it ~16 sites across 10 patterns, and treat the check’s count as a floor, as its own docblock says.

One false positive, and it is instructive about the check rather than the corpus — fixed in the same change. Privileged Access Provisioning’s request_to_capability fired on the phrase “audit event data” — occurring inside a clause saying the raw token appears in no audit event data. The rebuild it describes enumerates the Capability store’s immutable records and parses their scope, so it is genuinely outside the class: the binding lives in a constituent’s own record, not in a payload the cascade destroys. The check matched a negation and read it as an assertion. A polarity error, not a loose trigger, which is why the repair is a guard rather than a tightened trigger: the match’s own sentence is tested for a denial, deliberately not the whole rebuild clause, so an unrelated negation elsewhere in a long clause cannot suppress a real finding — the failure mode P-atomic-audit’s modulo suppressor taught. Pinned in test_checks.py by site rather than by file, for the same reason as before: this pattern has two other genuine firings, so a file-level pin would pass either way and the run would look healthy. Verified by removing the guard, which the test then reports. Sites now 14 across 8 patterns, all genuine.

The reframe, and it is why this class is not cleanup. Six of the genuine sites are now load-bearing for repairs the first two classes landed the same day: Propagate Consent Revocation Downstream’s compensation re-derives affected_scopes from processing.registered payloads at the intent-event boundary; Execute Gated Workflow’s moot-gate plan is anchored in gate_opened payloads; Reserve from Pool’s allocation check counts from journal-entry payloads; Multi-Party Approval’s rebuild is additive over payload-sourced reconstruction; Forensic Recovery’s history read reconciles against a payload-keyed enumeration. Every anchoring fix and every compensation mechanism those classes built reads a payload. Each of those rounds stated the bound honestly and deferred it here, which was right — but the aggregate is that the corpus’s newest guarantees rest on a substrate capability that lapses on a schedule the compositions do not control. Closing this class is not tidying; it is the load-bearing floor under the other two.

And the pattern that performs the destruction is itself an instance. Defensible Retention’s record_to_retentions rebuilds by reading retention_placed event payloads — which its own cascade destroys. Self-referential, and the first place to look, because a pattern that cannot reason about its own horizon is unlikely to have given its callers a bound they can use.

The treatment is three tiers, not one clause — and the exemplar already does all three. The pre-campaign survey characterized Audit Trail’s answer as “Bound on the rebuild’s totality, stated rather than assumed”. That is only its first tier. What Audit Trail actually does with event_to_attestation:

Tier	What the spec does	When it is enough
1 — state the bound	say what the rebuild’s totality is bounded by, and why that suffices for the index’s one job	nothing in the pattern needs the recovered fact after the payload is gone
2 — split the classification by retention state	classify entries for live events derived index, entries for purged events extraction-pending — stop claiming a rebuildability the substrate withdrew	the fact is needed past the horizon, so the spec must stop asserting it can be recovered
3 — capture the fact at purge time	write the fact into the destruction record before the delegation runs, riding the cascade’s own write, with the durability obligation that carries; name the forthcoming atom that will own it	a load-bearing claim depends on the fact surviving its payload

The discriminator: does any claim in the pattern need what the rebuild recovers, after the payload is gone? No → tier 1. Yes → tier 2 at minimum. Yes and a load-bearing invariant depends on it → tier 3, because tier 2 only makes the loss honest and tier 3 is what prevents it.

The fourth element, which is a deployment obligation rather than a spec one, and is what the sequencing note meant by “needs a configuration obligation rather than only a clause”. Tiers 1–3 govern what the spec says. None of them makes the horizon long enough. A composition whose claims read a payload must declare the ordering constraint its deployment has to satisfy — the audit retention horizon must outlast the longest claim that reads the payload — in the same way compensation_window and reconciliation_cadence were made declaring sources for the atomicity class’s liveness arms. An undeclared ordering is not a safe default; it is an unfalsifiable one.

A fourth treatment shape, supplied by the first round and cheaper than any of the three tiers. Defensible Retention landed 2026-08-27 and found that its lost fact had a second declared source: the record_ref → retention_id binding lives in Retention Window’s own records as well as in the audit payload. So the past-horizon rebuild sources from the constituent store, and what it loses is not the binding but the placed-via-this-composition scope filter that only the audit traversal supplies — meaning the fallback over-includes, and over-inclusion on a destruction gate can only refuse a purge, never permit one. Invariant 9 stays sound; Invariant 2’s scope claim is what degrades.

Before reaching for a tier, ask whether a second declared source holds the fact — and if it does, which direction its loss runs in. A fallback whose error direction is safe for the claim that matters costs a sentence; tier 3’s capture-at-purge-time costs a mechanism, a durability obligation and a forthcoming atom. Audit Trail had no second source for event_to_attestation, which is why the exemplar goes to tier 3 — tier 3 is what you need when nothing else holds the fact, not the default. Whichever applies, name which claim degrades: a fallback that silently answers a different question than the one asked is worse than an honest gap.

That round also converted the class’s fourth element from a recommendation into an obligation, and the shape is reusable. Defensible Retention’s Configuration already said the audit trail should outlast the record it describes — advice, given for litigation-defensibility reasons, with nothing resting on it. Invariant 9 rested on it, for a different and stronger reason: the trail is not only evidence there, it is rebuild source. Look for that pattern in the remaining instances — a horizon recommendation stated for one reason while a load-bearing claim silently depends on it for another — and when converting, say both reasons and name the invariant that spends it.

A second general statement, from the second round. Propagate Consent Revocation Downstream landed 2026-08-27 and is the case where the cheap fallback exists and is forbidden: three of its maps declare the audit traversal their only permitted rebuild source, because a constituent-store rebuild would resolve the bypassed consent_id that audit-first resolvability must leave unresolvable — the traversal/enumeration disagreement is the bypass detector, and taking the fallback would delete a security property rather than degrade a scope claim.

“Is there a second source?” and “is using it permitted?” are two questions, not one. Where the traversal’s exclusivity is itself the guarantee, the fallback shape is unavailable and the treatment goes to tier 2 plus a deployment obligation with no mechanism in between.

That round also showed the horizon can cost availability, not just evidence — and it is the sharpest consequence the class has produced. Past the horizon a consent.granted payload is gone, consent_to_subject_purpose cannot be rebuilt, and [Withdraw Consent] answers not-known for a consent that is still Granted: a live consent becomes un-withdrawable because the record of its grant aged out before the consent did, a GDPR Article 7(3) failure reached with no partial failure, bypass, or bug. When classifying an instance, ask not only what evidence is lost but what stops working.

And a timescale asymmetry worth carrying into the remaining instances. The same fact — that a set is derivable from the log — was sound for that pattern’s compensation, which runs inside a declared compensation_window measured in hours, and unsound for its acceptance check, which an auditor runs whenever they run it. A payload-sourced derivation is not simply safe or unsafe; it is safe up to a duration, so the question is always derivable for how long, against a claim that lives how long.

Two tooling findings from the third round, both about the check rather than the corpus, and both worth keeping. (1) The suppressor read across sibling list items. Q’s enclosing-block scan was blank-line delimited, and markdown bullets sit on adjacent lines — so once one entry in a run stated a retention bound, its neighbours went quiet without stating anything. Multi-Party Approval’s chain_store was suppressed that way, and the corpus count fell in a shape that reads as progress. Clamping the block to its own list item revealed it and one other site that had been hidden since the check was written. (2) Widening the trigger to match is not symmetric. The same round tried extending the *Rebuild procedure:* clause from end-of-line to end-of-paragraph, to catch a wrapped rebuild; it over-captured the following bullets and silently dropped a live finding, because an over-captured clause picked up a negation and the polarity guard suppressed it. Reverted, with the wrap gap recorded as a known limitation on that evidence.

Tighten a suppressor freely; widen a trigger carefully. Both move the finding set, in opposite directions of harm: a narrower suppressor can only reveal, and a false positive is visible and cheap to fix, where a false negative is neither. This is the operating rule these two attempts produced, and it is the third distinct way a regex over careful prose has gone wrong in this campaign — after P’s hedge-word suppressor and Q’s polarity match.

Q now has synthetic fixtures, added at the class’s halfway point rather than at its end, because its corpus floor set was already emptying — the perishability that made P’s corpus pins untrustworthy. The unbounded/bounded pair found the wrap gap on its first run, which is the argument for synthetic fixtures in miniature: a corpus-only test cannot show you a shape the corpus does not happen to contain. The suppressor’s vocabulary also gained three markers, each chosen against the rule the modulo regression taught — a suppressor marker must state the bound, never signal that the author was being careful.

Round order. ~~Defensible Retention first~~ — done 2026-08-27 (self-referential, and it owns the destruction contract the others cite; Q now silent on it, sites 14 → 13). ~~Then the six sites the other two classes now depend on~~ — done 2026-08-27 (Propagate Consent Revocation Downstream, Execute Gated Workflow, Reserve from Pool, Multi-Party Approval; and the collision is real, not theoretical — Execute Gated Workflow’s anchored moot-gate plan and Reserve from Pool’s anchored allocation count both degrade past the horizon back to the state their anchoring removed, so a second-class repair is undone by a third-class gap unless the deployment closes it). ~~Remaining: 4 sites in 3 patterns~~ — done 2026-08-27, including both recall-gap instances the check cannot see.

The class is closed: sixteen sites across ten patterns. Customer Onboarding (a live gate — a lost entry reads as never-onboarded and opens a second active case for a party that already has one, against the declared one-active-case relation); Login (tier 0 — the cascade skips non-Active sessions, so the rebuild need only outlive a session TTL, hours against years, and the comparison is what proves it rather than what excuses it); Privileged Access Provisioning ×2 (one of which has a second source that is not one where the two compositions share an audit instance — a constituent whose state is a derived index over the same substrate is erased by the same purge, and reads as coverage); Preference-Aware Notification Fanout, which turns out to be the shape already discharged — it journals to a bare Event Log rather than through an Audit Trail substrate, so it inherits no purge cascade it does not control, and its externally-clearable set already carried the provisioning obligation (refined to name the two different durations its two indexes need); and Forensic Recovery’s AP-F1, closed by taking the first of its two prescribed options — reclassify honestly — since the event_id is already written into the list at commit time, so the fix is a durability obligation rather than a capture mechanism.

Q-rebuild-bound is now gating, and the promotion deliberately waited on the class rather than on the check going quiet. Q fired zero times a full round before the class closed, because its two remaining instances were invisible to it. A check going silent measures the check’s reach, not the corpus’s health — the same lesson the 2026-06-08 capability-provenance rescan taught when it found zero undeclared dependencies by sweeping the one surface the rule then named. Its pin set is empty and exact, so any future firing is reported as unpinned; the regression coverage lives in the synthetic fixtures. Both linter checks are gating and ADVISORY_CODES is empty.

The rule landed in pressure-testing.md §Derived state has a validity duration — four treatments cheapest-first, the deployment obligation none of them supplies, the two-edged interval, and the surviving-field fact the class turns on. Frozen 2026-08-29 with the rest of #19 (debt #20).

Two of the four treatment shapes came from instances the linter cannot see, which is the argument for keeping the classification sweep as a campaign step rather than a stopgap: the sweep found sixteen sites where the check saw fourteen, and tier 0 and the durability-obligation form of tier 3 both came out of the difference.

Step (iii) is complete: all three classes closed. What remains of debt #19 is (iv) — (b) grounded-as-dated-claim and (c) semantic-premise auditing — which are representational and were never blocked by the above. Q-rebuild-bound stays advisory until the class closes, and its polarity false positive should be fixed with a pinned fixture before it is promoted. (iv) Then (b) grounded-as-dated-claim and (c) semantic-premise auditing, which are representational and do not block the above.

Sequencing. Both preconditions are met as of 2026-08-27: every applicable authentication seam is resolved, and the rule is frozen (debt #18). This refactor is unblocked and is the next campaign. (The reason for that ordering — that a rule still in flight makes the next round’s findings unattributable — is recorded with the freeze in debt #18.)

20. Rule freezes from the fresh-reader gates — 2026-08-29 and 2026-08-30; fifteen frozen rules, three mechanical checks, forty-seven foundational closed. Two freezes in two days, each sequenced by the same discipline debt #18 established: a rule is frozen on the day its evidence is recurrence across independently gated patterns, so that the next round’s findings are attributable to a rule that already covered them, and reopening requires a case none of its arms covers, recorded first.

2026-08-29 — the second gates. Eight patterns whose open foundational findings had all been closed were gated again by fresh readers (Login, Defensible Retention, Multi-Party Approval, Resolve a Person’s Data Rights, Customer Onboarding, Capability-Backed Sharing, Privileged Access Provisioning, Notification Fanout). None returned clean, and the findings recurred in shape across patterns that had never shared a round. Nine rules froze that day in pressure-testing.md: the three debt-#19 sections (§Durability boundaries, §A derived index is trustworthy only where a miss is observable, §Derived state has a validity duration) and six stated from the gates — §A reconciliation is bounded at both ends, §Intents pair with outcomes by an invocation identity the seam injects, §Recovery commits under a declared service identity, §A transcribed rejection arm keeps its payload and its reachability, §A seal presentation is keyed by log position, §A derived index splits at the horizon. Two linter checks landed advisory and were promoted to gating the same day when the sweep under the rules emptied them (S-recording-step, twenty-two sites; T-seal-key, one). The sweep then ran over every partially-resolved pattern; the second-gated eight showed residue only.

2026-08-30 — the third gates, and the prediction that failed. The eight patterns the 2026-08-29 freeze had not gated (Chain of Custody, Execute Gated Workflow, Reserve from Pool, Immutable Transaction Ledger, Forensic Recovery, External Onboarding, Propagate Consent Revocation Downstream, and Actor Suspension to re-ground) were predicted to come back mostly clean after the sweep. All eight returned NOT CLEAN: forty-seven foundational findings, forty-five confirmed and two partially by a second reader given the full record, none refuted, three already carried as refining. Twenty-seven mapped to a rule frozen the day before — the sweep had added the vocabulary and not re-read the site — and twenty were shapes no rule named. Six recurred and froze that day: §A compensator is exclusive (one writer per act; the invocation yields at its bound), §Lawful destruction is answered before absence (the constituent’s purged verdict precedes any composition pre-check), §An outcome is sized before the intent, §Liveness is arithmetic (bound plus cadence plus latency, strictly less than the window), §A stamp from another seam never decides a write alone, and §A composition’s own rejection arm carries the retry bit — the last being the case §A transcribed rejection arm was written not to cover, recorded first and closed by a rule of its own rather than an amendment. §Capability provenance, the oldest open rule on the page, froze with six tells for uses drawn from six foundational findings of that shape. A third check, U-retry-bit, landed advisory at ten sites across five patterns and was promoted to gating the same day at zero.

What closing the forty-seven cost, and what the closure check found. Every foundational finding was closed in the normative body, each pattern swept under the six new rules, and a fresh-reader closure check run on all eight. The closure check reported all forty-seven closed and found one shape in nearly every pattern: each fix of §A compensator is exclusive rested on a per-key critical section that was itself an undeclared multi-call capability with no lease semantics — the tell §Capability provenance had just frozen, arriving from the fix rather than the finding. Closed uniformly in a second pass: a declared instance capability per pattern, a lease exactly the completion bound long whose expiry is the invocation’s terminus, every later write only under the section. Every one of the eight formal models is now pending — re-derivation: each protocol gained a second writer serialized on a declared section, a counted or leased retry terminus, and positioned rejection codes the models do not carry. That is the formal-layer debt this freeze leaves, and it is the next block of work after the grounded sweep below.

The grounded sweep ran the same day. Nine grounded patterns carried a shape (the other twenty-seven were swept clean by survey — no reconciliation, window, cross-seam comparison, or boundary token in the body); read-only sweeps found thirty-four foundational sites in seven of them, all closed, with a fresh-reader closure check on the six compositions and a second pass on its residue; six returned to partially resolved (Audit Trail — internal sites only, its four contract-shaped sites Ledgered with the ripple named; Preference-Aware Notification Fanout; Attributed Permissions Admin; Authenticated Actor; Compensable Workflow; Idempotent Reservation), and the three atoms stayed grounded (Clinical Observation and Medication Order by striking the crash-recovery-scan alternative to transactional atomicity; Provisional Commitment on three refining sentences). Fourteen models are now pending — re-derivation. The closure checks found the same residue in every fixed pattern — the per-key section each fix rested on was itself an undeclared multi-call capability with unstated lease semantics — which is the finding that turned this debt from a rules campaign into an extraction.

What the campaign proved, and the candidate it names. Twenty compositions re-derive the same six-component protocol in their own words — roughly 920 kilobytes of it, 8% to 55% of a body (tools/survey/protocol_prose.py) — and each round’s fix is where the next round’s finding lives. That is the evidence pressure-testing.md §Pass 2’s higher-order composition test (written 2026-08-30, with its five-exact-instance floor) asks for, and §Formal models — Where the protocol lives says what it means: the protocol was being carried in English, where the interleaving space is unbounded, and the formal layer was checking a version of it that could not fail. Candidate: the Recoverable Invocation (working name), a substrate composition of compositions. It owns the six components — an intent record before the act, a serialized section on the act’s key with a lease exactly the completion bound long whose expiry is the terminus for writes, an outcome record paired to the intent by a seam-injected key, a reconciliation bounded below by the bound and above by the journal’s horizon that writes under a declared service identity behind a recovery-intended record and names candidates where pairing is undecidable, and a rejection code that carries its position — and its invariants: one writer per act; every intent closed within bound + skew + cadence + closure latency < window or escalated with a record; pairing exact where the key is present and candidates otherwise. Its model has two processes over one act, the invocation and the leg, with the crash, the lease, and the bound as state. A caller binds the act’s key, the constituent commit call, the completion bound, the pairing field, the journal instance, and the recovery identity or none; a caller declares its deviations (a clock-free invocation that counts attempts rather than leasing time, as Chain of Custody does). Fourteen compositions are exact instances — the Audit-Trail-journaled group — and qualify; the four bare-Event-Log instances are one short of the floor and wait. Audit Trail is the journal, not an adopter. The pilot adopter is Immutable Transaction Ledger (all six components, 43 kilobytes of protocol prose, model already pending), and the deletion count is measured on it before the other thirteen are swept.

What remains, in order. (i) Specify the Recoverable Invocation through the three passes, model it, and gate it with a fresh reader — the one page the interleaving questions are asked of from now on. Progress 2026-08-30: the draft exists (delivered for review, not yet in compositions/) and has been through five fresh-reader gates in one day — 8, 6, 4, 8, 5 foundational, every finding real. The count did not converge; the category changed: gates one and two found protocol shape (a credential no signature carried, a report-only mode that locked keys, pairing on a clock window, an operator’s close the pre-check refused), gates three to five found timed concurrency (a relative deadline against a paused process, a journal write landing after the sweep’s re-read, a closing record purged before its intent, a lagging replica followed by a retry, a run the inequality did not bound, an allowance needed twice). That is the phase change §Where the protocol lives predicts, and the reason prose review stops here: a sixth cold reader would be simulating a timed distributed system by hand, which is what the model is for. The model: recoverable-invocation.tla with the invocation, the sweep, the section host, the store, and the journal as distinct processes; the bounds (completion_bound, journal_write_bound, clock_offset_allowance, reconciliation_cadence, run_bound, retention_period, the fence) as explicit parameters; deliberate twins for a sweep with no lower edge, a lease that does not expire, and a fence-less abandonment. Only rules the model establishes go back into the English. The success criterion, stated before the model is written so it cannot be fitted afterwards: the fresh gate that follows the model should find mostly semantic and binding problems — meaning, authority, what a caller may rely on, whether a binding is a parameter or a behaviour — and not another crop of lease, clock, and interleaving defects. Five foundational timing defects after the model lands means the model has not absorbed enough of the protocol, and the boundary is drawn in the wrong place. Before formalization, fresh readers discover concurrency behaviour; after it, they should be challenging meaning. If that transition happens, the draft will have proved more than one compound: it will have proved where this library’s protocol logic belongs. Progress 2026-08-30, the model: recoverable-invocation.tla derived and run through the harness — five components over one act (the invocation; a section host with the lease as terminus; a fenced-or-fenceless store; a journal with a landing bound; two sweep runs on two nodes with a blocking take and a death budget of one), time discrete and scheduled rather than fair; it holds (38,394 states) and three twins are rejected on exactly the invariant each was built to break (-buggy-death, -buggy-lease, -buggy-fence). It corrected the prose twice, in places five fresh readers had passed: the section host must release on return or expiry and never on the holder’s death (a run dying with its write in flight otherwise frees the section to a second closer), and the closure inequality budgets one dead run — 2 × completion_bound + … — which the probes show is exactly one lease. It also demoted one thing: the sweep’s lower edge is not what forbids the second writer (the model holds with it removed at zero skew — the section is), so the planned no-lower-edge twin was dropped as not a bug. Both corrections are transcribed into the draft with a Decisions entry; the draft still sits outside compositions/. Progress 2026-08-30, the sixth gate — the success criterion, and what it cost. The gate returned NOT CLEAN: three foundational findings, all timing, which is the shape the criterion named as failure (it named five as the threshold; three, all of one class, is a fail on shape if not on count). The tail moved as predicted — five semantic, six structural, two timing, and zero binding, the adopter surface holding completely. The three had one cause: at each point the model had been more disciplined than the page — fusing the lease check with the write so the admitted pause could not occur, holding the section until a write had landed where the page releases on return, and giving the sweep the act’s bound where the page gives it max(completion_bound, closure_latency). So the model was corrected rather than the prose, which is this debt’s own thesis applied to its first real test. Model v2: every journal write split into its gate and its issue with time free to pass between; a write given separate return and visibility instants; the sweep’s lease its own constant; and the two candidate remedies made constants, so the twins with each turned off are the page as written. It holds at 58,115 states and rejects five twins. It reproduced all three findings unaided and added a fourth: in a controlled two-by-two, the remaining >= journal_write_bound gate carries none of Invariant 2 — the fence does — so the page now declares a journal_fence instance capability and states the degradation where a substrate cannot offer one. It also measured the dead-run term directly: one death costs exactly the sweep’s lease. All of it is transcribed, with a Decisions entry; the draft still sits outside compositions/. Progress 2026-08-30, the seventh gate and model v3. The gate returned seven foundational findings — more than the sixth — and the classification is the result rather than the count. Three were damage from the previous round: a journal_fence introduced in one paragraph without the conveyance, clock and edge its own analogue commit_fence carries three sections away, which contradicted a sentence in its own paragraph and left the fence defeatable by the skew it never budgeted. The other four were pre-existing and unmasked. Model v3 took the two that sat in its declared holes — the fence’s two clocks, and the lost reply with its read-back and retry — and reproduced both; the remedy the gate prescribed for the second failed until the fence margin was applied to the per-write instant as well as the lease’s, the same skew defect a second time. It holds at 41,291 states and rejects seven twins, two of them new and both of them the page as written. journal_fence is now a declared degraded mode rather than a start condition, since no substrate in this library can supply one and requiring it would make the composition unadoptable; the degraded Invariant 2 is stated over something an auditor can check and its duplicate handling is placed in real steps of [Read Invocation] and [Reconcile]. A new metric now rides in the gate log: each foundational finding is classed as outside the model’s frame, inside-and-the-model-was-wrong, or inside-and-the-transcription-was-wrong. Gates six and seven read 0/3/0 and 5/0/2 — model-fidelity defects gone, the residue moved to the frame’s edge, and transcription now the weak joint, failing by under-claiming what the model proves. Both new rules are frozen on the methodology page. Progress 2026-08-30, the eighth gate and the third layer. Gate 8 returned six foundational — one of them timing, down from four, and that one arithmetic rather than interleaving; three structural, two semantic, no binding findings for the third gate running. The frame classification read 6 outside / 0 model-wrong / 0 transcription-wrong: both inside-frame buckets empty. So the interleaving problem has collapsed. What replaced it is worse on its own axis: measuring findings caused by the previous repair round gives 35% at gate 7 and 67% at gate 8, so the prose is not converging — but ten of gate 8’s twelve caused findings are mechanically decidable, which makes it a tooling gap rather than a discipline gap. The campaign therefore ends with three layers, not two: the formal model owns concurrency and bounds, the linter owns internal consistency, the fresh reader owns semantics — with a promotion pipeline between them (finding → recurring shape → check → corpus sweep → zero → gating), frozen on the methodology page. Gate 9 is deliberately not scheduled: another reader now would mostly measure the repair pass’s own error rate. The next work is (i-a) below. (i-a) Build the consistency checks gate 8 named, promote each through the pipeline, and only then spend a ninth gate on semantics. The first is prototyped (E-code-not-in-signature: one finding on the draft, and on the corpus one true defect it reported under the wrong description — customer-onboarding’s initiate_onboarding signature is missing a | between invalid-request and invalid-credential, so the alternation reads as one item — plus one genuine false positive where the prose quotes a constituent’s arms). It was not promoted: its rule is wrong even though its finding was real — the code is in the signature, and what is broken is a missing | — so it stays a prototype until it can tell an own export from a transcribed constituent code. What was promoted the same day is the rule that actually held: V-signature-alternation, GATING — pure syntax, five synthetic fixtures verified in both directions against a deliberately broken check, corpus swept to zero after the one true defect was fixed. Two methodology entries came with it: a checker’s finding being true does not make its rule correct (correct result, invalid proof path), and a fixture pins nothing until the check has been broken on purpose and seen to fail with it. A second landed the same way: W-step-reference, GATING — a cross-reference to [Action] step N where that action declares fewer than N steps; four fixtures, mutation-verified, corpus zero. It is labelled preventive: unlike V it has never fired and fixed nothing on the way in, so its silence is its expected state rather than evidence it works, and it can be retired if it stays silent. Two further prototypes were built and not promoted, and the reason generalised into the boundary’s real definition: a check may ask what a document contains and never what a sentence claims. E-code-not-in-signature cannot tell an own export from a transcribed constituent code; the mechanism check — does step 2 carry what the page says step 2 carries — found gate 8’s F1 on the draft buried in a dozen false positives, which is the trap, since a heuristic that finds a true thing is still a heuristic. The remaining two shapes gate 8 named were then triaged before any effort went into them, and both were rejected — the first time in this campaign that a check’s cost was predicted rather than discovered. A declared partition adding up is decidable in a narrow form and was rejected on frequency: the a + b + c = d expression occurs exactly once across fifty-six files, in the draft that produced the finding, so a gating check for it is a hand-fix wearing a tool’s clothes (the one instance is a hand-fix on the repair list). A retired abbreviation surviving at a call site was rejected on the boundary: the retirement is declared in prose, so reading it as a declaration asks what a sentence claims, and the corpus carries no machine-readable convention to read instead. That added the pipeline’s second triage question — does the shape occur often enough that a check beats fixing the instances? — recorded in pressure-testing.md §A check needs a population, not just a rule. So the check-building phase closed at two promoted (V evidenced, W preventive), two rejected on the boundary, two triaged out on frequency; python3 tools/linter/lint.py reads 0 findings over 52 patterns.

Progress 2026-09-08 — the gate-8 repair round, the first run with the mechanical layer active. All twenty-four findings closed (6 foundational, 12 refining, 6 rhetorical), nothing routed. Two of the six foundational fixes departed from what the gate prescribed, both under evidence. The window inequality’s prescribed remedy — a second run_bound — is still wrong: a forty-line enumerator over the schedules the page’s own timeline admits breaches the page’s old form on 420 of 432 parameter tuples and the prescribed correction on 396, and the form that holds carries three run_bound terms and two cadences, a budgeted death involving three runs rather than two. It also produced a configuration obligation nobody had asked for — the corrected form breaches on exactly the tuples where the disclosed run bound is below one sweep lease plus one closure — which is what lets the sweep’s lease drop out of the inequality instead of being double-charged. That is the frame metric paying out: the finding sat in the outside the modeled frame bucket because the formal model has no backlog and therefore no run-bound term, and the right answer to an outside-frame finding turned out to be a small purpose-built instrument rather than a bigger model — now a frozen rule in pressure-testing.md §An outside-the-frame finding names the instrument you are missing. The second departure removed a code rather than adding three: the read-failure arm the gate wanted at four actions belongs at one, and the sweep’s separately-named read failure collapsed into the same code. The round introduced at least three defects of its own and the linter caught one of them — the mechanical layer’s first honest measurement on a repair round — and one of the other two was a code collision introduced by the repair of a code collision, four paragraphs from the paragraph explaining why they are defects (§Fixing an instance of a shape is not the same as knowing the shape). Two further check candidates fell out of those defects and both were triaged out before building, on population and on the boundary respectively — the pipeline’s third and fourth predictions. Gate 9 ran the same day and is the measurement that closes this arc. 7 foundational, 12 refining, 8 rhetorical, and Pass 2 — conceptual independence — returned clean for the first time in the page’s life. The caused rate came down, 67% → 58% (11 of 19), which by itself says little; what it is made of says everything. Gate 8’s caused set was 10-of-12 mechanically decidable; gate 9’s is 1 of 11. The bookkeeping class is gone, the reader is spending itself on semantics, and that is the three-layer architecture doing exactly what it was proposed to do — the first round with evidence for the claim rather than an argument for it. The frame metric reads 7 outside / 0 model-wrong / 0 transcription-wrong, and foundational timing findings are 3 → 4 → 1 → 0: the success criterion recorded before the model existed, that a post-model gate should return semantic and binding problems rather than timing defects, is met. Five of the seven foundational findings land on [Resolve] or the retention purge, both on the model’s NOT MODELED list — which has now predicted the next gate’s foundational locations three gates running, and is therefore an instruction: [Resolve] is the next component to bring inside the frame, being a third writer on the same section with its own clock, its own supersession semantics and its own purge interaction, against a model that carries two writers. One check candidate was built from gate 9’s R1 and rejected despite the best population any candidate has had (27 findings across 10 files), because all 27 dismissals require deciding whether a sentence written elsewhere covers this action — which refined the pipeline’s boundary rule from can the rule avoid the word claims to can a finding be dismissed without reading what a sentence claims (pressure-testing.md §The boundary’s real test is the dismissal, not the rule). The gate-9 repair round ran the same day, model first. All twenty-seven findings closed. Model v4 brings [Resolve] inside the frame as the protocol’s third writer — v1 to v3 modelled two writers against a page that always had three — taking the same section on its own seam reading, with SupersedesNamed and OperatorSkew as constants so the twin with each turned off is the page as written, and service_identity promoted to a modelled dimension. Main run 71,249 states, all invariants hold; the two new twins are rejected (F6: Invariants 2 and 6; F7: Invariant 5), the other seven still are, and probe-reportonly-clean holds at 32,228 states so the second twin’s violation is attributable to the clock rather than to its configuration. Three reachability probes — each a deliberate falsehood about the operator, each rejected — are new machinery answering the failure this model was already caught in once: an invariant that holds because its antecedent cannot fire. Both are now frozen rules (pressure-testing.md §A new component earns its invariants only after a deliberate falsehood about it fails). The round’s most useful hour was a wrong turn: v4’s first cut did not terminate, and the fix was not a budget but a fidelity correction — an operator races the sweep to an open intent only where the sweep writes nothing — which shrank the space and corrected the model in the same edit (§When a model will not terminate, ask whether the excess behaviour is behaviour the spec actually admits). The round introduced three defects and all three were caught mechanically — the linter’s term-registry check for the second consecutive round, the harness for a twin config left behind by new constants, the parser for a junction — against one of three last round. Gate 10 ran 2026-09-09 and the counts went the wrong way — 8 foundational, 15 refining, 7 rhetorical, against 7/12/8. The caused rate fell again (67% → 58% → 52%, 12 of 23) but two findings fit neither bucket and needed a third, exposed by promotion: both are defects in the two journal_write_bound start checks, which had sat unread in Configuration for rounds and which this round copied into an acceptance check so an auditor would run them. The sharper one is real and serious — max(completion_bound, closure_latency) > closure_latency + journal_write_bound is unsatisfiable whenever closure_latency ≥ completion_bound, so the max that exists to protect a slow closure guards a case the start check makes unstartable. Promotion is worth doing even though it raises the count: a wrong check nobody runs and a wrong check an auditor runs are not equally bad. The mechanical class came back — caused findings that are mechanically decidable went 10 of 12, then 1 of 11, now 5 of 12 — because this round was a large structural edit (a parameter added to six signatures, a fourth derived index, a disposition matrix, a rename) where gate 9’s was small and semantic. Two of those five are shapes the pipeline triaged out on population, and that is the round’s most valuable finding: the declared partition has now been hand-fixed three rounds running and escalated to foundational, and the retired-token shape recurred with the round’s own sweep printing the line the reader looked past. The population rule’s measurement was right and the conclusion drawn from it was wrong — population must be counted in recurrences, not instances (pressure-testing.md §Count a shape’s population in recurrences, not in instances), and both checks are now justified. The frame metric grew a third failure mode. Timing findings stay at zero two gates running, but one finding is the model being wrong for the first time since gate 6 — [Open]’s intent write is exempt from the lease gate and its pre-check read has no disclosed bound, which refutes the justification for v4’s choice to make the intent’s return and visibility one event — and one is inside the model and switched off by a configuration constant, a supersession chain that needs two resolutions against a budget of one. The reachability probes invented last round would have caught it had they asked does it ever happen twice rather than does it ever happen (§Write the probe for the second occurrence, not just the first). Part (i) of the gate-10 repair round — model v5 — completed 2026-09-09, and it overturned the gate’s own diagnosis. [Open] is split into take → read → gate → issue → return, the intent write carries its own return instant, and the operator re-arms for a second call. F6’s prescribed remedy is refuted by the model: the gate-off configuration holds under a journal_fence, and the gated configuration violates without one — so the fence is the load-bearing mechanism and the lease gate is neither necessary nor sufficient, which makes the load-bearing half of F6’s repair its third clause (count open intents per (kind, act_key)) rather than its first. That is four consecutive gates that found a real defect and prescribed the wrong mechanism, now a frozen rule: a plausible remediation from a fresh reader is still only a hypothesis until the model distinguishes it from its siblings (pressure-testing.md). The miscast reachability probe was promoted to Invariant 8 — an intent is never in flight while its own invocation no longer holds the section — which states the obligation the fence earns directly instead of witnessing it through a modelled second actor. The suite at horizon 5: main holds at 21,974 states; all nine twins still fail; three operator reachability probes and the supersession-chain probe are rejected; the fenceless configuration violates Invariant 8 and the fenced-ungated one holds. The horizon is part of the claim and is stated as such — v5 does not finish at six or seven, so nothing is claimed beyond five ticks, and the twin suite is the evidence that five covers each property it checks (§A model’s claim is bounded by its horizon). Two further rules came out of the round’s own errors: splitting an action silently redefines every phase label it touches, and a probe that holds names a switch that is off which is rarely the one the configuration documents — here the operator’s phase machine was terminal, so the budget constant the round raised was never binding. Parts (ii) and (iii) completed 2026-09-10. Part (ii) built no checks, and the reason is a new rule. Both shapes the recurrence rule justified were built far enough to measure and rejected. The instructive one is the declared partition: it had cost three hand-fixes and escalated to foundational, so the recurrence was undeniable — and its decidable form (every name in an a + b + c = d expression is a field of that action’s declared return) runs clean on the very instance that motivated it, because the defect was never an undeclared name but a path falling into no bucket. The check would have been built, run green, and prevented nothing while carrying a gating check’s authority. The second, a retired token surviving at a call site, measured 178 instances of which one is a defect. So the pipeline’s triage is now three questions in order — dismissible without reading a claim; recurring often enough; and does the mechanical shadow of the shape cover the defects that made you want it (pressure-testing.md §Before building a check, ask whether its decidable form would have caught the instances that motivated it). Part (iii) closed all thirty findings. F6 is repaired at the fence and at the duplicate surfaces, which now key on both invocation_id and (kind, act_key), with the page stating plainly that a deployment adding the lease gate and reading it as the remedy has fixed nothing; the under-section read gains a disclosed read_bound. F4 is the round’s most serious arithmetic finding: the sweep’s lease check was unsatisfiable wherever closure_latency reached completion_bound, so the lease is now stated directly and the schedule enumeration was re-run under the new definition before the prose was written — the window inequality still holds with one tick of slack. F5’s transitivity is a prose repair the Ledger marks as not model-confirmed. Gate 11 ran 2026-09-10 and is the measurement that should change the plan. 9 foundational, 17 refining, 5 rhetorical — a third consecutive rise — and the caused rate is the highest of the campaign at 73% (19 of 26), with eight of the nine foundational findings created by the previous round. Sixteen of the nineteen are a single shape: an obligation introduced in one place and not carried to the places that must honour it. Supersession made transitive at one action and left pairwise at the three surfaces the same paragraph names; a second duplicate key added without exempting the report-only mode the page itself says produces duplicates by design; the last producing source of not-open deleted with the code still exported; a closure_latency floor added that the walkthrough eight lines below it breaches, so under the page’s own worked bindings the sweep can never land a closure; and the count partition for the fourth consecutive round, this time self-contradicting inside the paragraph the last round rewrote. The round did sweep, and it swept tokens — which reported clean, correctly, and cannot see an obligation (§Sweep obligations, not tokens). The measurement that reframes this: the defect density is flat. 19.8, 19.7, 19.1, 18.2 KB per foundational finding across gates 8 to 11, while the body grew 38% and the foundational count grew 50%. The repairs are not reducing the density; they are growing the denominator (§A flat defect density means the repairs are growing the denominator). So gate 12 is not the next step — another fresh reader would measure the repair rate and nothing else. The two live options are to pay the propagation cost explicitly, with an obligation sweep derived from each round’s own diff, or to stop adding surface and spend the same effort on extraction: the fence, the lease, the findings surface and the duplicate machinery are all atom-shaped and would each remove a class of obligation this page currently has to propagate by hand. The second is the one the density argues for, and it makes debt #20’s forthcoming Lease atom the head of the queue rather than a tail item.

Lease extracted 2026-09-10 — atoms/lease.md, draft. The first extraction this library has made on recurrence evidence rather than on shape: lease semantics were the largest single source of the obligations gate 11 showed propagating badly, reaching into the section, both fences, the timing arithmetic, expiry, remaining and the worked examples. The atom covers the grant and the terminus-as-fence together, because splitting them would preserve exactly the propagation the extraction removes — a fence is a terminus handed to another party, and stating it twice is how the two got out of step. It is deliberately small: six invariants, four operations, no records, and two things it explicitly refuses to own (which key protects what, and how long a grant must last). Its release-on-death rule carries the formal model’s rejected twin as its argument, so a pattern citing the atom inherits the proof rather than restating it. This brings the library to 53 grounded patterns (25 grounded compositions) — the count the linter checks, which counts pattern files rather than grounded ones, so it is worth saying plainly that Lease is draft and is the one file in that total not yet grounded, and that Recoverable Invocation is still outside compositions/ entirely and is in neither number. Recoverable Invocation shrunk against the atom the same day: 185,741 → 182,187 bytes, 1.9% removed. The citation is correct — the four operations’ semantics, the waiter’s bound, the never-on-death rule and the two-clock minting rule both fences restated are all gone, and try_take went entirely, the atom declaring it and this page never having had a caller. The number is the finding, and it says the experiment as designed is underpowered: at ~19 KB per foundational finding, 3.5 KB predicts removing 0.19 findings, so gate 12 cannot detect this extraction and a result at the old level would prove nothing (§Say a measurement is underpowered before you run it). Classifying all forty foundational findings by obligation source explains why: lease-owned findings ran 2 of 3, 3 of 7, 0 of 6, 1 of 7, 3 of 8 and — at gate 11 — 1 of 9. The share is real and declining, because the rounds in between argued lease semantics out by hand. The queue’s head was chosen on the cumulative record, and an extraction removes future propagation, so the ranking should have been by the current round’s obligation sources (§Choose an extraction by where the obligations are now). By that measure the next extractions are the findings surface — gate 11’s F9 says compliance_surface is a state machine no atom names, and F3 and F8 are both its obligations — and the duplicate-and-supersession machinery, which produced three of gate 11’s nine and two of gate 10’s eight. Gate 12 therefore gets two questions: did the density move (expected: no), and did the lease-owned class go to zero — which is the extraction’s actual claim and is directly attributable at any volume.

Recoverable Invocation moved into compositions/ 2026-09-10 as draft, rewritten in GRACE lang v0.28 — 54 grounded patterns (26 grounded compositions). *Gate reality, recorded 2026-09-14: the three passes and the fresh-reader gate (i) asks for are done — twelve gates through 2026-09-10, then council read 7 on the rewrite and council read 50 on the current state. The page’s own Status line claimed they were still owed until council read 50 caught it.*

The decision rule sharpened, and a second cure found — 2026-09-10. DRY here is one authoritative owner per obligation, not the absence of a repeated noun: a repeated use is composition, a repeated ownership is duplication (§DRY on responsibility, not on nouns). That test has two cures and this campaign had been reaching for only one. Owners in more than one pattern → an atom they cite, which is Lease, −3,554 bytes. Owners in more than one site in one pattern → a single statement the others cite, which is the supersession rule — stated at [Resolve], at [Read Invocation], at Invariant 2 and at check 2, with a fifth restatement in [Reconcile] step 5, and found by gate 11 made transitive at one and left pairwise at three. It now lives in §Which closing stands, and consolidating it added 932 bytes. Extraction shrinks, consolidation grows, both reduce owners — and only owner count predicts the propagation failure. Size was never the axis the rule was about; it was a proxy, and this pair of measurements retires it. No atom was warranted for supersession and the ownership test is what says so: no other pattern owns the obligation, and Duplicate Prevention owns a different one. The findings surface was consolidated the same way — the fifth Composition state element, the compliance_surface entry reduced to its binding, and the store-unavailable producer gate 11’s F8 asked for — and gate 12 then ran, 2026-09-10: 6 foundational, 15 refining, 6 rhetorical against 9/17/5, with the body flat. The fall must not be read as a repair result: gate 11’s findings were never repaired, so gate 12 read the same defective page plus two consolidations, and of gate 11’s nine foundational findings three recurred, two were closed by the consolidations, and four were simply not re-found — the clearest measurement this campaign has of fresh-reader variance, and a reason to trust per-class tracking over totals. Per class, the claim held where ownership actually moved: lease rule 3 → 1 → 0; supersession 1 → 2 → 0; findings surface 0 → 2 → 1. And every survivor is one shape: a consolidation created a new owner and did not carry every obligation into it — an exemption left behind (gate 11’s F3 recurring as gate 12’s F1), a Contract classification never given to the new element (F6), and a binding never consolidated at all (F3: one page binds its store fence three ways, one of them asserting what another denies). Two rules follow, both frozen: ownership has levels — extracting a rule leaves its bindings behind, so count owners once for the rule and once for each binding; and consolidating needs the obligation sweep run on it, asking not what must change because of this but what did the old owners say that the new one must now say. Next: the gate-12 repair round, with commit_fence’s binding as its first consolidation, and gate 11’s four un-re-found foundational findings folded in, since they are still open whatever gate 12 saw.

Progress 2026-09-10 — the gate-12 repair round. All twenty-seven of gate 12’s findings closed, together with gate 11’s four still-open foundational ones. Two consolidations, both written in the controlled normative form debt #21 opens — §Where the allowance goes (3 owners → 1; the fence instant, which one entry described by asserting of another the opposite of what it says) and §Instance start (4 owners → 1; five conditions, of which the check that is instance start named four and the page’s own walkthrough breached the fifth). The page grew 16.6% and should have: the round added five obligations that did not previously exist, gave the findings register its full Contract treatment as extraction-pending against a forthcoming Condition Register, and gave [Read Invocation] two arms it lacked. The result worth carrying forward is not either consolidation. It is that two of this round’s findings were prose drifting away from a machine-checkable form that was already correct. The page’s run_bound floor read 2 × closure_latency + journal_write_bound while the schedule enumerator that refuted two earlier forms of the same inequality had been filtering on the max form since the round that wrote it; re-run over the same 432 tuples, the prose floor admits 324 and the window inequality breaches on 15 of them, the enumerator’s admits 288 and breaches on none. And the duplicate key’s missing report-only branch — gate 11’s F3, gate 12’s F1 — has been in the formal model as ServiceIdentity => ~secondOpened since the gate that added the invariant. In both cases the machine-readable artifact was right, the sentence was wrong, and the sentence was the newer of the two. That is debt #21’s thesis measured rather than argued, and it converts into a standing instruction: at the end of every round, diff the prose against the model, the enumerator and the fixtures in the direction of does the page still say what the code checks (pressure-testing.md §Where a claim lives in both a controlled form and a prose form, the prose is the half that rots). Two further results: gate 12’s R1 is the first prescription in five gates the evidence confirmed rather than refuted — and the reason does not weaken the rule, since the evidence for it already existed — while F3 is the rule holding in its usual direction, the prescribed bare instant being the construction the Lease atom declares non-conforming, so the repair mints the allowance in and then sizes for the minting. The obligation sweep found one defect the round did not introduce: the Summary and the Ledger each said the model has five components and each then listed six, the operator having been added at gate 9 without the count moving (§The sweep finds neighbours, not only the diff’s own sites). The linter caught a self-introduced defect for the fourth consecutive round — two Ledger open: lines written as prose. What gate 13 tests is specific: every one of gate 12’s foundational findings was a consolidation that had not carried every obligation into its new owner; this round performed two more and ran the sweep on them deliberately. If the shape recurs, the sweep is not sufficient for consolidations and the discipline needs a stronger form.

What remains after (i), in order. (ii) Adopt it in Immutable Transaction Ledger; re-run the survey; the seventh rule of the test decides whether the compound stays. (iii) Sweep the other thirteen exact instances onto it, re-deriving each model against the compound’s rather than re-deriving fourteen protocol models. (iv) Reserve from Pool’s ripple from Idempotent Reservation (it inherits token_results, the five-field entry, outcome-unknown, and the acknowledged-atomic-write antecedent). (v) The residual refining and rhetorical lines (python3 tools/linter/lint.py --census is the count; the hand tally is not maintained). (vi) Debt #19’s (b) and (c), unchanged. A fourth round of fresh gates on the same prose is deliberately not on this list: the stopping rule stated above — the round that returns no recurring uncovered shape — is reached by moving the protocol out of the prose, not by gating the prose again.

21. Controlled Grace English — opened 2026-09-10. Semantically a superset of Cucumber; syntactically a much smaller subset of English. Ordinary English keeps explanation, rationale and examples; normative behaviour moves to a fixed set of canonical sentence shapes — short sentences, one obligation per sentence, one canonical term for one meaning, no rhetorical prose inside load-bearing logic. The semantics do not get simpler; the language does, and the more primitive the normative syntax the less the parser has to infer. See discoveries.md §The linter’s own track record is an argument for a controlled language.

Why this is not speculative. The corpus has been running the experiment for months without reading it: sorting all eleven promotion-pipeline checks by what surface they parse, six of six promoted checks read an already-controlled form (the Ledger block, the Status line, the Terms registry, the signature fence, numbered steps, a bolded count claim) and five of five rejected checks were inferring from ordinary English. One sentence predicts every rejection. The corpus already has four controlled sub-languages and they are exactly where its most reliable checks live.

The vocabulary is discovered, not designed — and the first measurement of it was wrong in a way worth keeping on the record. A 2026-09-10 count reported MUST, MUST NOT, BEFORE, AFTER, EXACTLY ONE OF, IS DERIVED FROM and ONLY IF as “earned now, 45–57 files each”. That count measured English words, not controlled forms, and ignoring case was only half of it. It also matched fragments and merged synonyms: derived from is in 48 of those 57 files while IS DERIVED FROM in any case is in 7, MUST NOT was counted together with never and EXACTLY ONE OF with at most one, and only if is in 29, below the reported range unless only alone was matched. The any-case column below falls to 6, which case-insensitivity alone cannot explain. The count was presented as evidence that the corpus had already discovered most of the vocabulary. Re-measured the same day, whole word, over the 56 Markdown files in atoms/ and compositions/ — 53 patterns and 3 index files; the first count’s 57 also included the Recoverable Invocation draft — counting the uppercase token in its controlled role against the same words in any case:

form	UPPERCASE files	any-case files
`MUST`	3	54
`MUST NOT`	1	40
`MAY`	1	54
`EVERY`	0	55
`EXACTLY ONE`	0	47
`WITHIN`	0	47
`ONLY IF`	0	28
`ONLY AFTER`	0	20
`ONLY UNDER`	0	15
`IS AUTHORITATIVE FOR`	0	6
`IS DERIVED FROM`	0	6

The three files carrying an uppercase MUST are Attributed Permissions Admin, Audit Trail and Multi-Party Approval, and APA’s arrived on 2026-09-10. So the controlled forms are not earned. The concepts are — and the two are different claims about different things.

Which forces the question this debt actually turns on: what does earned mean? It cannot mean the token already appears in its controlled role, because that is circular — a controlled form’s whole purpose is to replace the free-prose expression of a recurring idea, and the token only appears once someone decides to admit it. So it must mean the concept recurs. But recurrence alone is not the case for controlling something: before is in 55 files and most of those are ordinary narrative. The admission test needs its second half, which the promotion pipeline already supplies: the concept recurs AND its free-prose expression has drifted or produced findings. only if in 28 files carrying real conditions is a candidate on that test; before in 55 files of narrative is not.

And one form is a deliberate introduction rather than a discovery, which is worth labelling wherever it is admitted: IS AUTHORITATIVE FOR names the concept three consecutive gates have been about and the DRY rule depends on, in six of the 56 files in any case and in none as the controlled form. The concept is earned; the phrasing is invented. It is introduced in one spec — the Recoverable Invocation draft, where §Where the allowance goes and §Instance start each name what they own and list their citers — and propagated only after use (§Introducing a form is riskier than discovering one). A grammar that admits it while claiming every form is earned has one unlabelled exception; naming it preserves the claim everywhere else.

Structurally half-controlled already, and unaffected by the correction above because these were counted as containers rather than as words: COMPOSES (26 of 26 compositions: the 25 in compositions/ and the Recoverable Invocation draft) and BINDS (557 spans in 37 files), where the container exists and only the sentence shape is free.

Order of work, deliberately slow. (i) Canonicalize the earned forms where they already carry obligations, one pattern at a time, starting with the page under active review. (ii) Fix the sentence shape before writing any checker for it — the corpus’s own record says control the surface first, since the reverse produces a check that runs, passes and lies. (iii) Only then extend the linter to lower normative sentences into a normalized SUBJECT / MODAL / ACTION / OBJECT / CONDITION form, at which point the obligation-propagation checks this campaign keeps wanting — every WITHIN names a declared duration, every DERIVED FROM names a declared source, every normative reference resolves to one authoritative owner — become structural rather than linguistic. (iv) The same normalized form is the natural feed for the models, the acceptance checks and generated tests, but that is downstream and nothing here depends on it.

Progress 2026-09-10 — step (i)’s first increment landed, and the thesis got its first measurement. The gate-12 repair round wrote its two consolidations in the controlled form rather than in more prose: IS AUTHORITATIVE FOR at three owner sites, EXACTLY ONE OF for the applied/minted split, MUST / MUST NOT / ONLY IF / STRICTLY on the obligations themselves, and the five instance-start conditions as five numbered lines each carrying one inequality and nothing else. The per-instant facts reuse the corpus’s existing aligned-key card shape with a new field set (Instant / Minted by / Judged by / Value / Bound at) rather than a new table form — a new field set inside an established shape is a discovery, a new shape is an introduction, and the risk budget belongs to the second (pressure-testing.md §Extend an earned form’s field set before inventing a new one). And the round produced the thesis’s first evidence rather than its first argument: two of its findings were prose that had drifted away from a machine-checkable form which was correct all along — a configuration floor the schedule enumerator had been filtering on correctly for two rounds, and a report-only branch that has been in the formal model’s invariant since the gate that wrote it. Neither rotted through carelessness. Both rotted because nothing was reading them, which is the whole of the case for controlling the surface.

22. Deployment obligation sheet — opened 2026-09-10. A spec that delegates a decision upward has no way of knowing whether anyone made it. The corpus is careful about this in one direction and blind in the other. An atom that will not settle a question says so and hands it to the composing layer; a composition that will not settle it says so and hands it to the deployment. Both halves are honest, both are load-bearing, and nothing anywhere tracks whether the last party in the chain ever discharged what it was handed.

How it was opened, and the misattribution that opened it. Beacon demo issue #2 — an actor’s permission list showing invite_actor eleven times — was first traced to a delegated obligation nobody discharged, on the strength of two edge cases: atoms/permissions.md Concurrent grant proliferation (“Composing systems that intend to issue a single authoritative grant should guard against concurrent issuance”) and compositions/attributed-permissions-admin.md Concurrent issuance of the same grant (“handled at the composing layer”). That reading was wrong, and the correction is instructive. Both clauses are scoped to simultaneous calls; the reported behaviour is sequential re-granting — an administrator pressing Grant repeatedly, each request completing before the next — which neither clause covers. The real finding is against the composition and is recorded on its own Ledger (2026-09-10-a, foundational): APA’s write surface is keyed by grant_id while its evaluation surface is keyed by (subject_ref, action_scope), and Permissions Invariant 7 makes [Check] set-valued, so revoking one of several active grants on a pair leaves permitted answering permitted and the composition exposes no action that changes it. A demo whose ✗ appears to remove a permission and does not is a security misread, not a cosmetic duplicate.

So the class this debt is about is real, but this was not a clean instance of it, and saying so is the point. The reasoning that produced the misattribution is exactly the failure the sheet is meant to prevent in the other direction: a delegation clause was read as covering a case it explicitly scoped itself away from. Correctly captured, correctly delegated, never discharged remains a fourth class the frame metric has no bucket for — not an uncaptured requirement, not a transcription failure, not silent completion — and it is the mirror of the defect recorded under debt #20, where a finding notated downstream in a render’s CORNERS.md never travels up. Together they say the return path is broken in both directions. The rule is frozen in pressure-testing.md §A delegated obligation needs a discharge record, or it is not delegated — it is dropped. A clean exemplar is still owed and step (ii) below is where it will come from — walking Beacon’s 51 clauses is the first real measurement of how many delegated decisions a working deployment has actually skipped, rather than one asserted from a single bug.

Population, measured. The delegation formula is near-canonical already — “the composing system is responsible for…”, “composing systems that intend to… should…”, “must enforce uniqueness at the composing layer, not within this atom” — and it appears 159 times across 40 of the corpus’s files. For the Beacon wiring alone (14 specs) it is 51 clauses. Grant uniqueness is one of the 51, and nobody had ever seen that list, because it did not exist.

What to build. For a given wiring, generate the transitive set of delegated obligations as a deployment obligation sheet: one line per clause, each naming the spec, the clause, and what the deployment must decide. It is the exact mirror of the generator’s adaptation report — instead of here is what I had to decide, it is here is what you were told to decide and have not. Cheap, because the source clauses are already written and nearly formulaic.

What this is not. It is deliberately not a linter check, and the third triage question says why. The decidable form — every delegated obligation in an atom is acknowledged by every composition that composes it — passes on the instance that motivated it: Attributed Permissions Admin acknowledged the clause and re-delegated it. The hop that failed is composition → deployment, and a deployment is not in the corpus, so no corpus-scoped check can reach it. The artifact is the remedy; a check would run green and prevent nothing (pressure-testing.md §Before building a check, ask whether its decidable form would have caught the instances that motivated it).

Order of work. (i) Fix the extractor’s clause pattern against the 159 and hand-audit a sample, since the clause shape is earned but not yet controlled (debt #21 owns making it so). (ii) Emit Beacon’s 51-line sheet and walk it — the first real measurement of how many delegated decisions a working deployment has silently skipped. (iii) Fold the sheet into the demo regen, so a render ships with its obligations answered or explicitly deferred. (iv) Only then consider whether the atom → composition hop is worth a check on its own terms.

18. Authentication-precedence pass — RULE FROZEN 2026-08-27; every applicable seam resolved; one template round remains. The rule is closed to amendment in pressure-testing.md §Authentication precedence. Eleven patterns carried it, each gated by a fresh reader; the record below is the freeze’s evidence, and it is a fixed historical record rather than a live count.

The eleven, and what each contributed. Defensible Retention — the first round, and the one that established that the intent record does two jobs at once (it is where the credential is verified and the marker-before-act recovery record). Forensic Recovery — the residue field on a recovery action, and the discovery that the applier’s own renumbering is the expensive part. Resolve a Person’s Data Rights — the nesting probe: authentication is not inheritable across a composition boundary, because the inner surface is independently callable; what is owed instead is provenance. It also produced the loop/shape rule, when a per-record loop was found resolving and destroying in one pass. Chain of Custody — a principal produced by the commit, and the formal-layer pattern (an intentState variable, a dedicated invariant, a second rejecting twin). Customer Onboarding — a subject produced by the commit; this round closed by construction what the pattern had closed by declaration. Reserve from Pool — an attestation that was prose at every site, so the credential was verified nowhere rather than late. Immutable Transaction Ledger with Selective Disclosure — a permanent, non-removable disclosure record written before verification, and the payload-budget rule against the maximal constructed payload. Capability-Backed Sharing — the corpus’s cleanest instance of the third sound answer, written down rather than left as an unexplained absence, plus the rule that an invariant’s opening sentence must carry its own scope because that sentence travels alone. Propagate Consent Revocation Downstream — the escape hatch caught in the wild: the pattern declared the check impossible at its boundary and pushed it to deployments, and the declaration was false. Execute Gated Workflow — the campaign’s seed finding, closed; the worst seam in the corpus; and the first intent record to carry a plan. Multi-Party Approval — corroboration of the delegated-exclusivity shape in a second, independent pattern, and the carve-out correction that a third-answer exemption must be checked against the constituent’s record.

What the freeze settles, and what it deliberately leaves open. Settled: the rule, its three sound answers, the refusal of a declared deployment obligation as a fourth, the binding half, the four applier-checklist items, the plan-carrying discriminator, the delegated-exclusivity flag, and the constituent-record test for carve-outs. Left open: every pre-existing foundational finding the eleven gates routed (each carried in its pattern’s Lineage with its prescribed fix), the formal-layer extensions three patterns owe, and one remaining round — Privileged Access Provisioning’s template, which is not a window but the canonical precedent whose own template is incomplete (only the approver check carries an invariant, the credential_check_on_request knob has no acceptance consequence, and it never states what a credential validation does not establish). That round applies the frozen rule; it cannot amend it.

Why the freeze is sequenced here rather than after the template round. Capability provenance is about to widen under debt #19, and the next campaign’s findings have to be attributable to the rule that caught them. A rule still in flight cannot be told apart from the corpus archaeology running beside it — which is the same conflation the operating rule below was written to separate, arriving one level up.

18a. The original triage board and operating rule (retained for provenance). pressure-testing.md §Authentication precedence now states the rule — no consequential state transition may rely on an actor identity that has not yet been authenticated, and the authenticated principal must be the principal whose authority the guarantee asserts — with three sound answers (nothing commits first; verification precedes the commit; the transition relies on no actor’s authority) and an explicit refusal of a declared deployment obligation as a fourth. The rule was written before touching patterns, deliberately: applying it changes several currently-grounded patterns’ status, and the human triager owns when to take that.

Triage board, 2026-08-26 (the eighteen credential-taking patterns, as they stood that day). No window — Audit Trail (the attestation is the first write), Attributed Permissions Admin (attest-first as a stated architectural commitment), External Onboarding (an attempt record opens every action), Login’s own login, Session-Gated Authorization (writes nothing), Actor Suspension at its default all-or-nothing posture (its best-effort knob opens one). Window, declared in identical words — “a deployment obligation, not an option” — Chain of Custody, Customer Onboarding, Reserve from Pool; under the new rule a declaration is no longer sufficient where the composition can enforce the seam itself, so these are re-opened rather than left. Window, verified — Privileged Access Provisioning, the canonical precedent (Credential.verify before the constituent writes at four of six actions, a credential_type knob, a credential-invalid rejection, an invariant, an acceptance check); its own residue is that only the approver check carries an invariant, the credential_check_on_request knob has no acceptance consequence, and it never states what verification does not establish. Window, undeclared or only conditionally declared — Defensible Retention, Forensic Recovery, Capability-Backed Sharing, Immutable Transaction Ledger, Propagate Consent Revocation Downstream, Resolve a Person’s Data Rights, plus Multi-Party Approval and Execute Gated Workflow (the latter already carrying it as an open routed finding, Final Critique 9’s F1).

Two live falsehoods the triage surfaced, both foundational-grade and both currently sitting in grounded patterns. Forensic Recovery’s prose claims it “records whoever calls it with a valid credential” on a path where the irreversible destruction commits a step before the credential is touched — a pattern claiming a guarantee its own steps deny, a different and worse class than silence. Resolve a Person’s Data Rights nests the window: it purges through Defensible Retention, which itself destroys at its step 4 and verifies at its step 5, so an irreversible erasure of personal data runs under two unverified layers while the guarantee names the operator. Capability-Backed Sharing carries a third, smaller one — a worked example narrating the reverse of its own normative step order.

The binding half, which re-opens work the recovery sweeps just did. The 2026-08-26 recovery-machinery closures established composition-actor re-emission — an owed record landed outside the original invocation is attested under the deployment’s service credential with the human named in the payload. That is the right recovery move and it has the property the rule now names: the substrate verifies the service and says nothing about the human, so any guarantee those records support speaks about a person whose credential was never checked on that path. Login has this shape everywhere by design. The application pass must decide, per pattern, whether the guarantee’s asserted principal survives the re-emission — and where it does not, say so rather than inheriting a claim the wiring does not make.

Operating rule, set by the triager 2026-08-26 after the destruction-path cluster (Defensible Retention, Forensic Recovery, Resolve a Person’s Data Rights) completed. The gate is doing two jobs at once and they are now formally separated: applying the authentication rule is the campaign, and discovering unrelated foundational debt is a by-product worth keeping but not worth chasing. So: continue applying the authentication rule until every applicable seam is resolved; route unrelated findings immediately into their own classes; do not fix them opportunistically. Unrelated foundational findings do not block the application and do not stop the sweep — they block only if they invalidate the authentication work itself. Emerging structural classes are spun into dedicated passes once they carry enough independent evidence. The reason not to let the discovery rate redirect the campaign: the corpus would accumulate forty interesting findings and still not know whether its authentication seams conform, which is the question that started the pass.

Why finishing matters more than it looks. The destruction cluster established the rule under the hard conditions — nesting, independently callable inner surfaces, a shared audit substrate, per-record loops, and irreversible operations. What remains tests whether it generalizes outside those conditions, which is cheaper per pattern and is the actual generalization claim.

Remaining applicable seams (8), as of the cluster’s completion. Undeclared or conditionally declared: Capability-Backed Sharing, Immutable Transaction Ledger, Propagate Consent Revocation Downstream, Multi-Party Approval, Execute Gated Workflow (already carrying it as an open routed finding, its Final Critique 9 F1). Declared-and-reopened, since a declaration is no longer sufficient where the composition can enforce the seam itself: Chain of Custody, Customer Onboarding, Reserve from Pool. Plus Privileged Access Provisioning’s own residue — not a window (it is the canonical precedent) but the template is incomplete: only the approver check carries an invariant, the credential_check_on_request knob has no acceptance consequence, and it never states what a credential validation does not establish.

Progress, 2026-08-27. Applied and gated: Chain of Custody, Customer Onboarding, Reserve from Pool, Immutable Transaction Ledger with Selective Disclosure, Capability-Backed Sharing, Propagate Consent Revocation Downstream, Execute Gated Workflow (which closes the routed Final Critique 9 F1 that started the campaign), Multi-Party Approval. Every applicable seam is now resolved. Remaining before the freeze: only Privileged Access Provisioning’s template residue above, which is not a window — it is the canonical precedent whose own template is incomplete.

Multi-Party Approval corroborated the Execute Gated Workflow shape rather than merely repeating it, which is why the generalization is safe to state. Its three step-decision actions carry no Permissions check for the same declared reason — Approval Step’s approver-exclusivity invariant is the authorization — and that invariant is a byte comparison of two references neither of which had been verified. Two independent compositions, arriving at the same hole by the same reasoning, in patterns whose Lineage says they share a recovery vocabulary but not this. The rule to carry forward: delegating authorization to a constituent’s exclusivity check also delegates away the moment a credential would have been consumed, and the delegation reads as more rigorous rather than less.

Its gate also produced the campaign’s sharpest self-correction. The round’s own carve-out — that the lost-evaluation cascade and the recovery sweep commit nothing on the caller’s authority — was false at the constituent: both call ApprovalStep.withdraw(step_id, withdrawn_by = initiator_ref, …), which that atom admits only on the initiator’s reference, so its immutable record permanently names an actor who did not act and, on the sweep’s path, was not present. There is no honest alternative available, because the atom exposes no composition-actor withdrawal surface. The generalizable point is about carve-outs, not about this atom: a third-answer exemption must be checked against what the constituent record will say, not only against what the composition’s own audit trail will say — the two can disagree, and only one of them is what a later reader finds first.

Execute Gated Workflow was the worst seam in the corpus, and it is worth recording why. All four of its state-changing actions committed before the credential reached a checking write — but the load-bearing one was [Decide Gate], which carries no Permissions check by design because Approval Step’s approver-exclusivity invariant is the authorization. That invariant compares the supplied actor reference against the step’s recorded approver reference, and neither side had been verified: the composition’s foundational claim, a guarded transition fires only when the named approver approved, was a comparison of two strings. The lesson generalizes past this pattern: wherever a composition delegates authorization to a constituent’s exclusivity check instead of performing its own gate, it has also delegated away the moment where a credential would have been consumed — and the delegation reads as more rigorous, not less, which is why it survived nine critique rounds. Any future pattern that says no redundant Permissions check is added here should be read as a flag for this shape.

A second methodology rule fell out of it, and the campaign has now seen both sides. [Fire Transition]’s intent record carries the plan of the moot-gate cascade it will occasion, where Propagate Consent Revocation Downstream’s deliberately carries no propagation set. The discriminator — carry the plan when plan and outcome are separately recorded and divergence is diagnostic; never when the outcome record is the datum’s single authoritative carrier — is recorded in pressure-testing.md, together with a related discipline these rounds argued for: cross-references that leave a section should name the step rather than number it, since the campaign’s most expensive errors were distant paragraphs carrying correct step numbers while describing an order that no longer held. Every gate so far has returned NOT CLEAN and none of the new foundational residue has been authentication debt — which is the observation debt #19 was opened to act on.

Capability-Backed Sharing settles the rule’s third answer with a worked instance, which the pass needed. Its [Redeem And Disclose] takes no credential by design — the bearer token is the authority and the composition’s load-bearing invariant makes the redeemer structurally unnamed — so it is the first pattern where the correct application is to write down why there is no intent record rather than to add one. Two things generalize from it. First, the invariant’s own opening sentence must carry the scope: a first draft opened Invariant 6 with “no call that commits is reached on any path”, which, quoted alone, asserted precisely the thing the pattern refuses to do; the fix is to name the covered actions in the sentence, not to add a disclaimer after it. Second, an inheritance claim must be routed through an authoritative record: what a redemption inherits is the allocator’s authentication, and the first draft reached it through two derived indices rebuildable from the same trail — verifying a reconstruction against itself. The sealed disclosure event already carried the keys; the route now goes through it.

A new cross-cutting class, opened by this pattern’s gate: transactional atomicity asserted over an append-only substrate. Capability-Backed Sharing claims in three places that a write set including an AuditTrail.record_action commits “together or not at all” under a host transaction boundary, while the Audit Trail contract states twice that synchronous rollback is unavailable to it and all three constituents declare durability on return. The prescribed repair is a restatement in safety-plus-liveness form — order the un-withdrawable audit write last, claim no sealed event without its record as safety and no record without its sealed event within a declared compensation window as liveness. This is not a paragraph edit: for this pattern the atomicity claim is the formal-model subject, so the class reaches the TLA+ layer. It is very likely not confined to one pattern — every composition that binds a substrate audit write to a constituent store write under a “host transaction boundary” is a candidate, and that phrase is common in the corpus. It belongs with debt #19(a): it is another use of a capability the substrate specifically disclaims, invisible to a rule that polices only the Rests on: claims. Sweep for the phrase before designing the fix, so the shape is known before any pattern is touched.

Second instance, same day, same position: Propagate Consent Revocation Downstream. Its Invariant 3 — also its formal-model subject — claims the Consent.revoke and the consent.revoked propagation event commit together or not at all, over the same substrate that declares an appended event cannot be withdrawn. Two patterns in two consecutive rounds, both with the class landing on the one invariant each pattern chose to model formally, is enough to stop treating it as a per-pattern defect. It also arrived with a leg the first instance did not have, and the leg is instructive: this pattern permits registration against an already-revoked consent and scopes its serialization obligation to invocations, so during a revoked-but-unpropagated recovery window a conforming registration can land an event that its acceptance check then brands a conformance failure. The absolutism and the atomicity are one defect — an invariant stated as an unconditional absolute has no vocabulary for a recovery window, so every gap the substrate genuinely admits reads as a violation. The repair is therefore not “add a modulo clause” but restate in safety-plus-liveness at quiescence, which is the form the Audit Trail substrate already uses for its own version of this gap. A compensation_window configuration entry is what makes at quiescence checkable rather than rhetorical, and the sweep should expect to add one wherever it lands.

Note on the formal layer. Chain of Custody’s round extended its TLA+ model with an intentState variable, an Inv7_AuthPrecedence invariant, and a second dedicated rejecting twin — the pattern for carrying the authentication rule into the formal layer. Capability-Backed Sharing deliberately did not follow it: its model’s existing subject is now under an open foundational finding (the atomicity class above), and extending a model whose central claim is about to be restated would be work done twice. That obligation is recorded in the pattern’s Lineage as open, not discharged — the honest state, and the sequencing follows the freeze-then-refactor order below.

16. Method-takeaway adoptions from the Augment brownfield spec-driven-development guide. Reading Spec-Driven Development for Brownfield Enterprise Codebases (Augment Code, 2026) surfaced three method adoptions and two positioning contrasts — full note and rationale at working-ideas/prior-art-augment-brownfield-sdd.md: (a) the four-element change-level spec (current behavior / target behavior / invariants-in-adjacent-systems / scope boundary) as the per-change delta container for Evergreen Modernization engagements, with the invariants element resolved to named pattern invariants and the pattern’s Generation acceptance queries run as the regression gate — deltas anchored to grounded absolutes rather than prose, and their migration-spec pattern slotting compositions in as the target state; (b) the specced-vs-unspecced defect-density metric for measurement.md once modernization engagements produce the data — no one has published rigorous brownfield before/after numbers, so the first credible dataset wins the citation; (c) never attempt comprehensive system specification on brownfield entry — the entry move is pattern recognition against the bounded atom set (the concept-recovery routing test), stated explicitly so the guide’s correct critique of full-system specs is never mistaken for a critique of this library. The positioning contrasts (drift-rate metric concedes spec-chases-code where conformance inverts the authority; “machine-checkable contract” meaning schema lint where the conformance validator measures implementation behavior) route to the prior-art/positioning staging note, not to canon. Surfaced 2026-07-06.

Taxonomy question — resolved (2026-06-08)

The workflow category’s one-atom question was resolved 2026-06-04: it stands on two atoms — Approval Step (the fixed-state pole — states fixed by the atom) and State Machine (the general-declared pole — states declared by the deployment). The broader axial-split question is now also resolved — see below.

The broader axial split — resolved (2026-06-08). The categories (productivity, temporal, resource-lifecycle, compliance, messaging, workflow, healthcare) did mix conceptual axes — healthcare domain-scoped, the others concept-scoped, compliance conflating pure-infrastructure atoms with atoms-that-happen-to-be-regulated. The usage-derived taxonomy (atoms/TAXONOMY.md) resolved it: atoms are stored flat, cross-cutting classification (regulated, security, standards) is derived from the composition graph as overlays, and domain is the single intrinsic, EOS-gated axis (seeded on Medication Order; held on Clinical Observation as the masquerade case). The resolution came out sharper than the “regulation as a regulated: true flag” framing once guessed here: regulation is not a stored flag but a derived fact. The deferral discipline paid off — waiting until the catalog forced the cut let classification be read off a reviewed substrate (the composition graph) rather than guessed one folder per atom.

Capability-vs-Invitation bearer-token question. Both Capability (atom #13) and Invitation (atom #14) use bearer-token transport: the holder of the token is authorized to take an action, with no identity check at the point of action. Both are time-bounded and both can be revoked. The argued distinction is that Capability is for resource access — the token authorizes access to a specific resource or action, and the redeemer’s identity is permanently and intentionally irrelevant — while Invitation is for identity onboarding — the token authorizes a single entry event, and the resolution of that event binds an identity that is then permanently recorded. The structural difference is Declined as a first-class outcome: a Capability has no declined state because a bearer either redeems it or doesn’t; an Invitation carries Declined as a named terminal state because a human’s deliberate refusal is semantically distinct from non-use. The authoring discipline resolves this: draft Capability first (atom #13) and use it as the Pass 2 mirror when drafting Invitation. If Invitation cannot be specified as freestanding — if its specification must name Capability’s structure to distinguish itself — the two collapse into one atom (bearer-token-with-lifecycle) and the distinction is carried as a mode or subtype rather than a separate atom.

Q3 2026 – Q2 2027: Year 1 Goal — ~100 Near-Perfect Atoms

Target: Reach approximately 100 high-quality, pressure-tested atoms and compositions by the end of the first year, with strong healthcare coverage and initial cross-domain atoms. The first 25 atoms and 13 compositions were produced in roughly three weeks while simultaneously building the methodology, the framework, and the live demo — with a second architect and dedicated tooling, this target is directional but realistic.

Key Initiatives

1. Logic Confinement Principle. Formalize and fully apply the Logic Confinement Principle across the entire library and tooling. Core must remain pure (synchronous, deterministic, no I/O, no implicit time, randomness, or crypto). Single seam discipline, explicit inputs, behavior as data transformation, and async-at-the-edge rules apply to all projections. Update projector and verification harness to enforce these constraints mechanically. Beacon demo refactored to fully conform as the reference implementation.

2. Tag-Based Ontology (not folders). Replace folder hierarchy with a rich, multi-dimensional tagging system driven by data rather than card-sorting. Tags will cover: Domain, Behavioral Property, Lifecycle Stage, Regulatory Anchor, Composition Role, Technical Property, Maturity. Enables dynamic views — “All EHDS-relevant atoms”, “All audit-related patterns”, “Cross-domain universals”. Ontology evolves organically from actual composition usage, regulatory overlap, and implementation data. The usage-derived taxonomy (flat storage + derived overlays, landed 2026-06-08) is the first realization of this tag-based direction — overlays are data-driven tags read off the composition graph; this initiative extends it into a richer multi-dimensional ontology.

3. Healthcare Core Expansion. Ground 55–65 new healthcare-focused atoms, building on the existing Observation and Medication Order base. Primary downstream target: EHDS implementation patterns. A first triaged candidate backlog — separating genuinely-new atoms from domain specializations of existing concept-scoped atoms — is recorded in §”Healthcare atom backlog” below; the expansion draws from that deduplicated backlog, not a raw wishlist.

4. Cross-Domain Attack. Begin deliberate extraction and generalization of universal atoms — Audit Trail, Multi-Party Approval, Defensible Retention, Consent Propagation variants and related patterns. This phase will intentionally stress and evolve the ontology.

5. Tooling Maturity. Deliver second-author-ready projector and verification harness — the core NLnet grant deliverable. The tooling makes the ~100-atom target achievable by a two-person team within the grant period.

Healthcare atom backlog — triaged candidate list (2026-06-04)

Seeded from an external brainstorm of OpenEMR / Open Hospital atom candidates and triaged against the library’s reuse thesis. The thesis matters here more than anywhere: most healthcare “atoms” people list are domain specializations of existing concept-scoped atoms, not new freestanding concepts. “Audit Logging” is not a new atom — it is Event Log + Audit Trail. “Patient Identity” is Party Identity with a medical-record-number field. Grounding redundant domain-named atoms would defeat the cross-domain reuse the library exists to demonstrate. This section records the triage so the Healthcare Core Expansion initiative draws from a deduplicated backlog.

Triage verdicts: grounded (already in the library); reuse (covered by an existing pattern — no new atom; the candidate is that pattern applied to a healthcare subject); not-an-atom (deployment config, a reference enumeration, a wire format, a foreign-key link, or a projection — not a stateful EOS concept with its own state machine, actions, and invariants); new-atom (a genuinely freestanding concept worth grounding, subject to the EOS Pass-2 test); composition (an application of two or more atoms).

Already grounded, or covered by reuse (no new atom)

Candidate	Verdict	Covered by
Medication Order	grounded	`atoms/medication-order.md`
Vital Signs Observation	reuse	Observation (a vital sign is an observation)
Patient Identity	reuse	Party Identity (a patient is a party; MRN is a deployment field)
Patient Consent	reuse	Consent (purpose-scoped agreement; treatment-consent and HIPAA authorization are scopes)
Patient Record Access / PHI Access Event	reuse	Permissions + Session-Gated Authorization (C14) + Selective Disclosure + Audit Trail
Encounter Status / Order Status	reuse	State Machine (a declared status lifecycle)
Appointment Slot / Booking / Cancellation / Provider Schedule	reuse	Capacity Constraint Enforcement + Provisional Commitment + Reserve from Pool (C9); provider availability is a time-indexed capacity pool
User Authentication	reuse	Credential + Session + Login (C13)
Role-Based Access	reuse	Permissions (a role is a named reusable grant set — see the Role new-atom note below if the bundle itself earns an atom)
Audit Logging	reuse	Event Log + Audit Trail (the canonical “do not re-invent the audit atom”)
Data Retention Rule	reuse	Retention Window + Defensible Retention (C1)
Provider Credential (authentication sense)	reuse	Credential
Patient Demographics	not-an-atom	a mutable attribute schema; its correction history is Observation’s amendment-chain shape, not a new concept
Encounter Type	not-an-atom	a reference enumeration (a code)
Billing Encounter Link	not-an-atom	a cross-reference / foreign key — composition-layer state, not an atom
FHIR Resource Export / HL7 Message / Document Import / External System Sync	not-an-atom	serialization / wire formats / integration projections; PHI crossing the boundary is a Selective Disclosure event, message delivery is Notification, idempotent receipt is Duplicate Prevention, document custody is Provenance
Facility Configuration	not-an-atom	deployment configuration

Genuinely-new atom candidates (worth grounding, pending EOS Pass-2)

Candidate	Category	One-line scope	EOS note / composes
Problem / Condition Entry	healthcare	a longitudinal clinical condition with an active → resolved/inactive status lifecycle and an amendment trail; Problem-List entries, diagnoses, and Allergy Records are instances	distinct from Clinical Observation (a point-in-time measurement) — a condition persists and changes status over time; composes Clinical Observation, Provenance, Audit Trail. Highest-leverage healthcare atom on this list.
Fulfillable Order	healthcare / generic	the general order-with-fulfillment lifecycle (placed, in-progress, then completed or cancelled, with a result attachment); Lab Order, Procedure Order, and Medication Order are specializations	the general primitive Medication Order is a specific case of (as Approval Step is to State Machine); Pass 2 decides whether to extract the general atom or keep per-domain order atoms
Clinical Administration Record	healthcare	an immutable “substance/treatment X was administered to patient P at time T” event (immunization, medication administration, infusion) with site/dose/lot	borderline — may be Clinical Observation specialized; resolve at authoring whether administration-vs-observation earns its own atom. Consumed by the MAR composition
Record Merge / Identity Reconciliation	resource-lifecycle (generic)	merge two duplicate identity records into a surviving record, with merge provenance and (often) reversible un-merge; Patient Merge, customer dedup, party reconciliation are instances	own state machine (two sources to one merged record, reversible); composes Party Identity + Provenance + Audit Trail
Qualification / Credentialing Record	compliance (generic)	a verifiable professional qualification — license, board certification, clinical privilege — with issuer, scope, expiry, and verification status	the licensure sense of “Provider Credential”, distinct from the authentication Credential atom (name-collision flag); composes Actor Identity, Retention Window. Recurs across healthcare licensure and financial KYC
Ledger Entry / Posting	resource-lifecycle (generic, financial)	an immutable financial posting against an account (debit or credit) with a reference and reversal-by-new-entry discipline	Charge Capture and Payment Posting are instances; the home composition is Immutable Transaction Ledger (C6)
Amendable Document / Signed Note	generic	a narrative record with addendum/amendment history and an author signature; Clinical Note is the canonical instance	likely covered by Clinical Observation’s amendment-chain shape + an Actor Identity signature — resolve at authoring whether a distinct document atom is warranted
Role / Permission Bundle	compliance	a named, reusable set of permission grants assignable to actors (the “role” in RBAC)	borderline — Permissions composes individual grants; a Role atom adds the reusable named bundle + assignment. Decide whether the grouping earns an atom or is a Permissions composition
Time-Slot Schedule	temporal / resource-lifecycle	a recurring time-indexed availability calendar (a provider’s bookable slots over time)	borderline — Capacity Constraint Enforcement covers the bounded-pool side; a distinct atom is warranted only if recurrence / calendar arithmetic recurs widely

Healthcare composition candidates (applications, not atoms)

Patient Record — Party Identity + Problem/Condition entries + Observations + a State Machine encounter lifecycle, under Audit Trail.
Patient Encounter — an episode of care: party references (patient, providers) + a State Machine encounter-status lifecycle + the observations and orders recorded during it.
Medication Administration Record (MAR) — Medication Order + Clinical Administration Record + Chain of Custody (C12) for the drug, under Audit Trail.
Prescription Fulfillment — Medication Order + the dispensing event + Chain of Custody.
Insurance Claim Lifecycle — a State Machine claim lifecycle (submitted, adjudicated, then paid/denied/appealed) + Ledger Entries + an encounter link, under Audit Trail.
Clinical Trial Data Capture and Immunization Registry Reporting — downstream healthcare compositions noted elsewhere as worked-example targets.

Sequencing note

The recommended first picks when Healthcare Core Expansion begins are the three highest-leverage genuinely-new atoms: Problem / Condition Entry (anchors the longitudinal clinical-record surface; unblocks Patient Record), Fulfillable Order (generalizes Medication Order; unblocks Lab and Procedure orders), and Qualification / Credentialing Record (recurs across healthcare licensure and financial KYC). Every candidate above must still clear the EOS Pass-2 freestanding test before it earns an atom file — the entries flagged borderline are flagged precisely because that test may route them back to an existing pattern rather than a new atom.

Concept-recovery atom backlog — candidates surfaced in reverse (2026-06-13)

Seeded from the reverse concept-recovery exercise (working-ideas/recovery/) — ten runs mining real systems across six languages and six domains plus the FHIR standard (ERPNext, hrms, frappe/crm, Odoo, OpenMRS, Akaunting, Medplum/FHIR, OpenBoxes, and two small libraries), running the routing test and the three gates backwards against deployed code. Same triage discipline as the healthcare backlog above: the dominant result was reuse — the existing atom set recurred as the substrate everywhere — and only genuinely-freestanding concepts the library lacks earn a candidate row. All entries are candidates pending EOS Pass-2; none is grounded, and this section changes no count (grounded counts live only in the Current-state section, per pressure-testing.md §The no-snapshot rule). Evidence is labelled by recovery tier per working-ideas/concept-recovery.md: tier-1 computed, tier-2 inferred from schema, tier-3 read from source — none was runtime-verified (“read, not run”), so a candidate’s invariants are recovered, not executed.

Genuinely-new atom candidates (pending EOS Pass-2)

Candidate	Category	One-line scope	Witnesses (recovery runs)	EOS note / composes
Acyclic Recursive Composition	generic / structural	a record that recursively contains records of its own type under an acyclicity invariant (and, for quantity-bearing forms, a rollup-by-summation invariant); Bill-of-Materials, observation groups, category trees, concept sets, role hierarchies are instances	6 — ERPNext BOM, Odoo `mrp.bom`, OpenMRS `obsGroup`/`ConceptSet`/role-hierarchy, Akaunting `Category`, FHIR `Observation.hasMember`, OpenBoxes `Location`/`ProductComponent` (runs 3, 6–10; all tier-3)	Resolved 2026-06-13 → not an atom. On classification (GPT / Grok / author + the witnesses) this routes to a 4th structural-relation invariant template — acyclicity / well-foundedness (`spec-format.md` §Structural-relation invariant templates) — not a new atom: all six witnesses are self-referential relations on existing concepts’ records (Product, Location, Category, Obs…), so it owns no state, only a relation’s integrity. Tree vs DAG = the relation’s parent-cardinality; the closure/rollup is a derived index. The Workflow-precedent atom case was weighed and declined (Workflow owns state; an acyclic-containment relation does not). Distinct from compositions of compositions (which is spec-artifact nesting — a composition naming another composition); this is a domain-data self-relation one layer down.
Coded Category (+ Terminology Binding overlay)	generic	a typed, coded, often-recursive controlled vocabulary (Coded Category); plus an overlay binding concepts across vocabularies with a typed equivalence (Terminology Binding)	4 — OpenMRS `Concept`/`ConceptMap`, Akaunting `Category` (coded core, no binding), Odoo/ERPNext categories, FHIR `CodeSystem`/`ValueSet`/`ConceptMap` (runs 6–9)	FHIR supplies the structure: CodeSystem (vocabulary) + ValueSet (constrained binding) + ConceptMap (cross-vocabulary map, whose `equivalence` lattice is the load-bearing invariant). Nuances the “a code is not-an-atom” verdict above — a single enum is not, but a vocabulary + mapping system is. May subsume the forthcoming Definition Registry.
Sequential Identifier / Naming Series	resource-lifecycle (generic)	a human-readable, per-scope monotonic identifier with uniqueness and gap/rollover-on-cancel behaviour (`INV-2026-00042`), distinct from the library’s opaque-id discipline	2 — ERPNext `naming_series` (64 DocTypes), Odoo `ir.sequence` (1,481 uses) (runs 3, 6)	Invariants: per-scope monotonicity, scoped uniqueness, declared rollover/gap behaviour. The library gives every atom an opaque id; this is the orthogonal human-facing identifier concept.
Orthogonal / multi-dimensional state	workflow	one entity running concurrent independent sub-lifecycles (Sales Order `delivery_status` ⊥ `billing_status`; an asset’s operational ⊥ financial state)	1–2 — ERPNext (Sales Order, Asset), Odoo (multiple `*_state` fields) (runs 3, 6; tier-2)	Borderline — needs the gates. State Machine is single-dimensional (Harel orthogonal regions unmodelled); resolve whether this is a new atom or a composition of several State Machines.
Deadline / SLA	temporal / compliance	a commitment to act by a computed time, with breach observable from the records (holiday-calendar-aware)	2 (weak) — frappe/crm SLA (`response_by`/`first_responded_on`) + the regulatory-deadline case; Odoo `crm.lead.date_deadline` is advisory only (runs 5, 6)	Weak recurrence; no strong third witness (Odoo’s deadline is advisory). Time-bound obligation + records-clearable breach detection. Hold pending a stronger witness.

Strengthened existing candidates (cross-reference — no new row)

Ledger Entry / Posting (listed above) — recovery adds the single-entry vs double-entry axis: the double-entry form (Odoo account.move._check_balanced, tier-3) carries a debit = credit binding-bijection invariant; the single-entry form (Akaunting signed transactions, tier-3) does not. Both sit under Immutable Transaction Ledger (C6). The taxonomy distinguishing the two — present in one system, correctly absent in the other — is the cleanest recovery confirmation, not a gap.
Idempotency Result Memo (extraction-pending, 2026-06-10 above) — confirmed in the wild by recovery run 2 (asgi-idempotency-header): the middleware’s response cache is the token → result memo the composition-state audit predicted, with a reproduced bricked-key bug violating its at-most-once invariant. Corroboration of the existing proposal, no change to it.

Composition-pattern candidates (applications, not atoms)

Balance Ledger — append-only ledger + a derived running balance + Capacity Constraint. Five corpora (ERPNext stock/GL, hrms leave, Odoo account/stock, Akaunting transactions, OpenBoxes TransactionEntry; runs 3, 4, 6, 8, 10). Reusable wiring, not a primitive (the balance is a derived index, the bound is Capacity Constraint — no new state). Carries the single/double-entry axis noted under Ledger Entry / Posting.
Reconciliation / Count-and-Adjust (new, run 10) — reconcile a recorded balance against an externally-observed truth (a physical count, a bank statement), record the discrepancy, and post an adjustment so recorded = observed. Two witnesses, two domains: OpenBoxes CycleCount* (inventory) + Akaunting Banking/Reconciliation (bank rec). Likely a composition (Balance Ledger + an observation/count event + an adjusting entry); the Gate-3 question is whether the discrepancy record is an emergent surface of its own. Tier-2 inferred (model names) pending a tier-3 read of CycleCount.groovy. Not to be conflated with conflict / replica reconciliation (offline-first multi-source merge-repair) — a distinct, harder pattern that breaks the single-consistency-domain scope assumption and is staged with the known boundaries in working-ideas/no-global-services.md §Strange-pattern forecast, not here; this count-and-adjust row owns no such boundary.
Cross-document fulfillment rollup — a status derived from the state of downstream documents (“Partly Delivered”, “Partially Received”; ERPNext, run 3). Almost certainly the existing derived-index construct as a recurring cross-document pattern, not an atom.

Sequencing note

First picks: Acyclic Recursive Composition (five cross-language/cross-domain witnesses including the FHIR standard, gate-ready — carry the tree-vs-DAG sub-form distinction into Pass 2) and Coded Category (+ the Terminology Binding overlay, for which FHIR’s CodeSystem/ValueSet/ConceptMap factoring is the proposed structure). Sequential Identifier follows. Orthogonal state and Deadline / SLA stay flagged borderline / weak until the gates — or a stronger witness — settle them. Excluded by author decision (2026-06-13): Invertible Delta / Reversible Change (recovery run 1, pboyer/rec) — a sub-atomic change-with-captured-prior primitive below the library’s granularity; it belongs to utility-spec territory (Undo History’s compensating events already instantiate it), not a freestanding library atom. Every candidate must still clear the EOS Pass-2 freestanding test before it earns an atom file.

Forthcoming-pattern backlog — the homes migrated specs delegate to (2026-09-15)

Every row here is a pattern a migrated spec names *(forthcoming)* — as the owner of a declined delegation, as the proposed atom behind an extraction-pending classification, or as the composing layer a Non-goal points at. Until this section existed, seventeen such names had no row on the planning surface: fifteen appeared nowhere in this file at all, one (Reverse Index) was named only inside a prose paragraph, and one (Condition Register) surfaced when the check was tightened from mentioned to listed. The specs said someone else owns this and no one was listed. lint.py’s M-orphan-forthcoming now reads every named forthcoming marker in a migrated spec against this file and reports any that is not here, so the set cannot silently grow again. (Linked forthcoming markers that have since landed are D-stale-forthcoming’s, the sibling check.)

These are not scheduled and carry no sequence number. A row is a recorded delegation, not a commitment: each states what the naming spec says the pattern owns, in that spec’s own terms, so a future drafter inherits the scope rather than re-deriving it. Two are load-bearing enough to name as such — Actor Registry and Failed-Attempt Log are the homes of live extraction-pending classifications, so until they land those classifications point at proposals rather than at patterns.

Pattern	Named by	What the naming spec says it owns
Actor Registry	Actor Suspension (`Composition state 10 through 11`), Actor Identity	Actor registration, deactivation and suspension — the actor lifecycle Actor Identity explicitly defers. Actor Suspension’s own Active → Suspending → Suspended index is extraction-pending against it past the audit horizon.
Failed-Attempt Log	Actor Suspension (`Composition state 15`), Audit Trail, Defensible Retention	Attempted-but-not-committed actions — the refusals no constituent replays. Actor Suspension’s suspension-log refusal entries are extraction-pending against it.
Review Schedule	Customer Onboarding (`Non-goal 17`)	Recurring-review deadlines: open, advance, freeze, read. Named as a Non-goal rather than a classification — Customer Onboarding’s schedule is a derived index on the Contract’s own test.
Ownership Structure / Beneficial Owner	Customer Onboarding (`Non-goal 8`)	The ownership graph across Party Identity records — percentage and control type under the FinCEN Beneficial Ownership Rule’s 25% threshold. Customer Onboarding is a constituent of it, not its replacement.
Policy Reconciliation	Customer Onboarding, Audit Trail	The longest applicable retention across every regulation in force, the strictest data-minimization posture, and conflicting destruction rules reconciled — producing the `policy_ref` a composition consumes.
Policy Registry	Retention Window (`Non-goal 7 through 8`)	What a retention policy says, and who attests to it.
Cryptographic Shredding	Retention Window (`Non-goal 4`)	Purge for records that cannot be deleted; deletion and key destruction as one transition.
Erasure Tombstone	Event Log	True deletion of recorded content where GDPR Article 17 or a healthcare regime overrides append-only — designed with counsel, appending rather than editing.
Storage Tier	Event Log	Moving cold events off the hot log, which the bare log knows nothing about.
Sliding Window	Duplicate Prevention (`Non-goal 9`)	A guard that resets on every sighting — the opposite of Duplicate Prevention’s Invariant 2, and therefore a different concept.
Compromise Disclosure	Actor Identity (`Non-goal 9`)	Reinterpretation of attestations made under a compromised credential — writing new records rather than editing old ones, since an attestation that could be revoked would prove nothing.
Seal Lifecycle	Audit Trail	Re-sealing a partly-purged seal’s survivors and rotating a seal onto a fresh mechanism, with the supersession bookkeeping both require.
Hold-Aware Audit Retention	Defensible Retention	The hold gate over audit events — the audit-side counterpart Defensible Retention explicitly does not provide, for a deployment whose holds can outlive its audit horizon.
Override Authorization	Defensible Retention (`Capability requirement 33`)	In-system records of the authority behind an advisory-mode override, which the composition records the fact of and owns no record of.
Trusted Timestamping	Actor Suspension, Customer Onboarding	The verifiable time anchor that binds Event Log insertion order to wall time, where a window or a deadline has legal force as wall-time bounds.
Binding Registry	Attributed Permissions Admin (`Non-goal 11`)	A write-once, durable pairing of one key to another. Attributed Permissions Admin’s two attribution maps are extraction-pending against it; the composition-state audit names the same shape for a principal-to-actor bijection, which is the recurrence argument.
Scope Registry	Attributed Permissions Admin (`Non-goal 16`)	What scopes exist in a deployment’s vocabulary and whether a given scope stood in it at the time of a grant. Attributed Permissions Admin treats every scope as opaque.
Condition Register	Recoverable Invocation	The register of what a sweep could not close and what an instance could not do, written to the deployment’s compliance surface. Recoverable Invocation’s `findings` register is extraction-pending against it.
Reverse Index	Event Log, Audit Trail, Defensible Retention, Customer Onboarding	Finding an event by what is inside its payload — the query shape the substrate declines, which every composition’s enumerate-and-filter rebuild works around.

Sequencing note. None of these is picked. Of the nineteen (the Attributed Permissions Admin migration added two, reported by M-orphan-forthcoming on its first live run), the two carrying live extraction flags (Actor Registry, Failed-Attempt Log) are the ones whose absence is currently load-bearing, and Condition Register is the third live extraction flag, and Reverse Index is the most-named at four migrated specs — which under Standard label 4’s own logic is the shape of a recurrence argument, though the promotion path governs label families and not patterns, so the count is recorded here rather than treated as a trigger.

Exhibit-sourced candidate — Branching Undo (2026-07-06)

The third engine of the Undoing Undos exhibit (a Jackson-meeting artifact, linked from The Corpus landing): reversal that preserves every timeline — undo then diverge keeps the abandoned branch reachable, so the shape of the past is a tree and the promise is no state is ever lost. Its two siblings are grounded (Undo History, replay-skip; Compensable Workflow, compensating action); this one has not yet faced the routing test or the freestanding gate.

Use-case triage (2026-07-06). The realistic demand clusters in two places, and both are draft-space, not record-space. (a) Scenario modeling — financial planning, budgeting, actuarial and supply-chain what-ifs: fork a baseline, explore variant assumptions, abandon, return, fork again, with abandoned variants reachable for comparison and audit. The wild implements this badly by hand everywhere it is missing (Budget_v3_FINAL_revised2.xlsx is branching undo by filename); the enterprise-shaped witnesses are Salesforce sandboxes and SAP transport variants, the design-shaped ones Figma branching and CAD alternatives, the editor-shaped ones Vim undotree / Emacs undo-tree, with Git’s commit graph as the limiting case. (b) Agent exploration — the fastest-growing witness class: an AI agent that tries, backtracks, and forks working state traverses an undo tree by construction (checkpoint-and-rewind features, per-agent worktrees).

Adversarial pass on the hypothesis (2026-07-06, external model review). Three findings folded. (a) The naming point strengthens the hypothesis: if the concept renames itself the moment it crosses spaces — becoming “versioning” or “scenario management” in draft-space — that is the purpose test firing: undo’s purpose is recover from my own recent action; the tree’s purpose is hold open possibilities. Different purpose, different concept. (b) The acid test — systems where branches are the record — survives, narrowly: Git’s DAG is canonical but its purpose is coordinating divergent work, not undo; blockchain forks are consensus repair; database branching is ephemeral environments that promote or die. The hard case is regulated considered-alternatives (the road not taken retained for audit) — and record-space handles it by recording that the tree existed as ordinary total-ordered entries: record-space can record a tree without being a tree. The tree’s shape becomes data in the record, never the structure of the record. Pressed harder on Git specifically, the acid test resolves rather than survives: Git’s DAG is structurally a union of linear timelines plus lineage metadata (every branch’s first-parent chain is linear — the Scenario Workspace decomposition, implemented); a merge commit is the promote seam (an ordinary append into the receiving timeline’s first-parent order, carrying the second parent as the lineage reference; fast-forward literally collapses); and Git’s own undo surface confirms the taxonomy (reset linear, revert compensating — while checkout -b is not undo but the start of new work). The boundary in one sentence: the tree is the record exactly when the tree is the subject — a version-control system’s domain objects are timelines, so its record-space is about draft-space (the hypothesis operating one level up); this catalog’s domain objects are deeds, and deeds want total order. (c) The composed-alternative reading (“Undo History with multiple pointers”) mechanically collapses: a pointer picks a position in one log, but a branch needs a divergent future — appends after two different cursors — which a single Event Log cannot hold under its own total-order invariant. Followed honestly, the multi-pointer reading decomposes into per-branch log instances plus a lineage index, which is the Scenario Workspace shape. Promote’s minimal interface is deliberately boring: an ordinary append into the target log’s total order carrying a lineage reference — append plus provenance; content-addressable storage is realization, below the contract.

The draft-space hypothesis (route this at triage). Regulated record-space actively wants the opposite — a single authoritative timeline is Event Log’s total-order invariant, which is precisely why the grounded corpus has never needed branching. The tree plausibly lives above the canonical store: scenarios, drafts, explorations — and the chosen branch promotes through the ordinary seam, collapsing the tree to lineage metadata at commit. If the hypothesis holds, the candidate resolves not to a “Branching Undo” atom but to a composition — working name Scenario Workspace: fork / explore / compare / promote over snapshot state, where promote is the boundary that rejoins Event Log and Provenance. This also draws the sibling boundary crisply: Undo History rewinds a timeline, Compensable Workflow reverses effects on one, Scenario Workspace multiplies timelines in draft-space and reconciles to one on commit. (House witness: the derive-expiry sweep of 2026-06-23 — applied, gated, reverted, with the abandoned branch kept reachable as a dated discovery — is this pattern operating on the spec corpus itself.) Pending witnesses plus the gates — recorded here so the exhibit’s third engine points at a registered candidate rather than a dangling claim.

Witness candidate registered (2026-07-11). Grace Desk (working-ideas/grace-desk-brief.md, staging tier) — a shared plan board and triage desk for the library’s own operations: draft-space plan branches operated by the agent fleet over a Shared Todo record-space, promoting through the ordinary seam, with the human adjudicator holding promote. If built, it is the first instance of the agent-exploration witness class this entry names, and a second witness besides — scenario planning over shared tasks. Route per the hypothesis above: witness first; extraction (or routing to reuse) only after witness data exists.

The roadmap is a living document. Patterns are added as the library’s content forces resolution of open questions, not on a fixed schedule.

Roadmap

Current state

Planned-sequence atoms — all grounded (roadmap history)

7. Provenance

9. State Machine

10. Preference / Personalization

11. Credential

12. Session

13. Capability

14. Invitation

Grounded atoms — short status (formerly atoms #1–#6, #8)

Compositions — current state

Grounded

C11 grounded — the C-numbered backlog closes

C11. Preference-Aware Notification Fanout — partially resolved (returned 2026-08-30 by the sweep under the frozen rules; prior grounded on Final Critique 12 — 2026-06-12)

Compensable Workflow (C19) grounded — first of the dream-compositions pipeline

Summary table

Formal model coverage

Convention

Health census — 2026-08-27

Methodology debts — open

Taxonomy question — resolved (2026-06-08)

Q3 2026 – Q2 2027: Year 1 Goal — ~100 Near-Perfect Atoms

Key Initiatives

Healthcare atom backlog — triaged candidate list (2026-06-04)

Already grounded, or covered by reuse (no new atom)

Genuinely-new atom candidates (worth grounding, pending EOS Pass-2)

Healthcare composition candidates (applications, not atoms)

Sequencing note

Concept-recovery atom backlog — candidates surfaced in reverse (2026-06-13)

Genuinely-new atom candidates (pending EOS Pass-2)

Strengthened existing candidates (cross-reference — no new row)

Composition-pattern candidates (applications, not atoms)

Sequencing note

Forthcoming-pattern backlog — the homes migrated specs delegate to (2026-09-15)

Exhibit-sourced candidate — Branching Undo (2026-07-06)

C11. Preference-Aware Notification Fanout — `partially resolved` (returned 2026-08-30 by the sweep under the frozen rules; prior `grounded on Final Critique 12 — 2026-06-12`)