The re-evaluation problem

When a rule changes, the status of everything evaluated under the old rule must be resolved.

Consider a jurisdiction that raises its minimum capital requirement for financial institutions from $1 million to $5 million. Entity A was evaluated last month under the old rule and found compliant with $3 million in capital. Under the new rule, entity A is non-compliant. What is entity A’s status?

Legal systems answer through the principle of temporal application – tempus regit actum: an act is governed by the law in force at the time it was performed. Both facts about A stand, indexed to different rules. Last month’s evaluation was correct and remains a true statement about last month. From the new rule’s effective date, A is non-compliant and must raise capital, restructure, or exit. “What is A’s status?” is underspecified until it names a time and a rule version, and the system’s obligation is to keep both answers available without confusing them.

The alternative – rule changes silently invalidating prior evaluations – would put the historical record in constant flux. Every audit, every compliance certificate, every verification would be provisional, subject to revision whenever any relevant rule changed, and the record would be useless as evidence, because no one could know whether a given evaluation would still be considered valid next month.

The principle that emerges: the validity of an evaluation is judged by the rules in force at the time of the evaluation, not the rules in force at the time of audit.

The principle is a default, and legal systems maintain named exceptions to it. A court may strike a framework down from inception, with immediate effect on everything in flight: when Schrems II (Court of Justice of the European Union, C-311/18, 2020) invalidated the EU-U.S. Privacy Shield, transfers that relied on it lost their legal basis at once, not at their next evaluation. Legislatures enact curative and retroactive tax statutes, and constitutionally may (United States v. Carlton, 512 U.S. 26 (1994)). Procedural rules routinely apply to matters already pending. None of these rewrite the record. The old evaluation stands as a record of what the law said and what was decided; the exception arrives as a new event with its own date – an invalidation, a retroactive statute – and the system appends a re-evaluation under the changed law. The companion paper Lex: A Logic for Jurisdictional Rules gives these events typed form. What matters here is the shape: the record grows, and it never mutates.

Version chains

If past evaluations must remain valid under the rules that governed them, the system must retain those rules. You cannot overwrite the old rule with the new one, because the old rule is still needed to verify historical evaluations. What is needed is a chain of rule versions: the current version plus every predecessor, linked so the full history is traversable.

A version carries four things: the rule content, the version or versions it supersedes, the interval over which it is effective, and the time it was published. Effective time and publication time are distinct coordinates, and neither substitutes for the other: a rule published in March may take effect in June, and a curative statute enacted in June may carry an effective date in January. The distinction is the valid-time/transaction-time split standard in temporal databases (Snodgrass and Ahn 1985), developed for institutional records in the companion paper Time in Institutional Computing. Activity is read with both coordinates. A version is active at time t as of publication time \tau when t lies within its effective interval as the log records that interval at \tau. Supersession closes the predecessor’s effective interval at the successor’s effective start, by an entry made at the successor’s publication; the earlier entry stands. One coordinate does not give a unique answer: the June statute and the version it supersedes both cover March 15th. Two do: as of any time before the statute’s publication, the predecessor is active on March 15th, and as of any time after, the statute is. The log holds both readings. “Which version was active on March 15th?” is answered from the effective intervals as of a named time – not by walking back from the current version in publication order, which conflates the two coordinates.

An evaluation record binds a verdict to its context: the entity evaluated, the facts consulted or a commitment to them, the version evaluated against, and the time. When a regulator asks “was this entity compliant on March 15th?”, the system answers from the version active on March 15th as of the time the regulator names – March 15th itself for the law that governed the act, the present for the law as since rewritten – and the record made against that version. If versions have been lost or overwritten, the question is unanswerable. Retention is what makes evaluations evidence.

This paper assumes each version supersedes exactly one predecessor, the first version excepted, and has at most one successor, so that versions form a chain. Concurrent amendments to different parts of a rule, and partial repeals, generalize the chain to a directed acyclic graph – one version superseding several, or several superseding one – in which activity at t is resolved per part; the definitions extend, and this paper does not develop the general case.

The chain supports delta computation: the difference between a version and its predecessor states exactly what changed. The delta alone does not identify which entities change status, because verdicts change only under re-evaluation. What it supplies is the candidate set: only evaluations that depended on the changed portion of the rule can differ. Evaluating the candidates under both versions and comparing verdicts yields the affected set, and the same side-by-side pattern returns at full scale during transitions.

Replayable evaluations

In most software, backwards compatibility is a promise: a best-effort commitment that new versions will not break old behavior. A rule system with evidentiary obligations can hold something stronger, provided the property is stated exactly.

Four conditions make evaluations verifiable, in the sense that any alteration of what was decided, or of the text it was decided against, is detectable; a fifth makes them replayable. Versions are content-addressed: each is identified by a cryptographic hash of its content, so a published version is immutable by construction – an edited text is a different version with a different identifier, and every record that named the original still names the original. Evaluation records are committed: each carries the version’s hash, a hash of the fact snapshot consulted, and the verdict, and is appended to a log anchored outside the system’s own control. Effective intervals are committed in the same log. The evaluator is deterministic: the same version applied to the same facts yields the same verdict. The fifth condition is retention: the version text and the fact snapshot whose hashes the log carries remain available to whoever replays. The log certifies them without containing them.

The claim these conditions support is exact, and it splits at the fifth condition. From the log alone, a third party can detect any retroactive alteration of a version, an effective interval, or an evaluation record. Holding in addition the version text and the fact snapshot the log’s hashes certify, the third party can re-run any historical evaluation and check its verdict. The argument is three steps. Altering a version’s content changes its hash and severs every reference that named it, so content tampering is detectable unless the adversary produces a hash collision. Altering a committed record or interval is detectable against the external anchor. Determinism makes replay decisive: evaluating the committed facts under the committed version either reproduces the committed verdict or convicts the record.

Three limits bound the claim. Replay certifies what was evaluated, against which text, with what result; it does not certify that the verdict was legally sound, and a mis-drafted rule replays perfectly. An evaluation that consulted an external oracle or a human judgment replays only to the committed answer – the answer is reproducible, the oracle is not. And a new version makes no preservation promise about prior evaluations because it needs none: each record is bound by hash to the version that produced it, where no successor can reach it.

Refinements and replacements

Some rule changes are refinements within the same framework: a threshold moves, a deadline extends, a category joins an existing taxonomy. Others are replacements: an entirely new regulatory approach supersedes the old one. The difference decides what happens to historical evaluations.

A refinement is legible in the old framework’s terms. When the minimum capital requirement moves from $1M to $5M, “minimum capital requirement” means what it always meant; only the value changed. Anyone who understood the old rule understands the new one, and historical evaluations are interpretable without translation.

A replacement is not legible this way. When a jurisdiction moves from principles-based to rules-based securities regulation, the categories of evaluation change. An entity that was “compliant” under the principles-based regime may map to no status at all under the rules-based one, because the two regimes ask different questions.

Distinguish three levels of change by what the change preserves.

1. Value changes. The evaluator is unchanged; a parameter differs – a number, a date, a list entry. Old and new evaluations answer the same question and are directly comparable.

2. Schema changes. The structure of the rule’s inputs or categories changes, but a total mapping carries every old status to a new one, together with an explicit loss set: the propositions the mapping fails to preserve. Historical evaluations translate, and the loss set states exactly what the translation dropped.

3. Replacements. The approach itself changes – “paradigm” in Kuhn’s (1962) sense, and with Kuhn’s consequence: some historical evaluations are incommensurable with the new framework. They answer a question the new framework does not ask, so no mapping carries them anywhere. They are preserved as records, interpretable under the framework that produced them and not re-derivable under the new one.

The first level is absorbed by the machinery already described. The second adds the mapping and its loss set. The third is change to the frame within which the first two are measured, the framework of change itself changing. That is what meta-evolution names, and the level at which it earns the name.

The self-revision paradox

The machinery described so far – version chains, evaluation records, supersession – is itself governed by rules: who may propose a change, what review it undergoes, how conflicts between old and new are resolved. Hart (1961) called these rules of change, and they are rules like any other. They too will need to change.

This is the paradox of self-amendment, posed by Ross (1969) and examined at book length by Suber (1990): the procedure for changing the rules of change must be applied to itself, and a procedure that can amend itself can, through a sequence of individually valid steps, become anything at all.

Constitutional practice spans the full range of responses. Germany entrenches: Article 79(3) of the Basic Law places human dignity and the federal and democratic order beyond amendment. The United States entrenches almost nothing: Article V shields only equal state suffrage in the Senate. The United Kingdom entrenches nothing, and continuity rests on convention. New Zealand entrenches singly: section 268 of the Electoral Act 1993 places six reserved electoral provisions, the three-year term of Parliament and the voting age among them, behind a vote of three-quarters of all members of the House or a referendum, while section 268 itself yields to a simple majority, so the protection is one layer deep and ultimately rests on convention as well. Entrenchment is a design choice, not a property of legal systems.

For a rule system whose evaluations serve as evidence, the choice is forced – and the obvious entrenchment is the wrong one. Entrenching the bare axiom the system can revise itself protects nothing: an amendment procedure lawfully amended, step by step, into “any party may change any rule at any time” still satisfies that axiom, and it produces exactly the condition entrenchment exists to prevent – no continuity, no basis for long-term commitment. What must be entrenched is a floor under the process of change itself: the founding act that records the system’s origin, and the authority and thresholds required to alter the amendment procedure. Concretely, the parties whose signatures authorize the founding act are held disjoint from any signer set the amendment process can later create. No sequence of amendments, each valid on its own, can then confer the authority to dissolve the floor, because the process cannot mint the signatures that hold it. The construction adds two assumptions of its own, parallel to the collision caveat above: signatures are unforgeable, and the founding keys stay in their holders’ custody. Founding keys leaked to the entrenched threshold dissolve the floor through steps the system counts as valid; keys lost below it freeze the floor, which then moves only by the abandonment described next. Under those assumptions, within the system the path does not exist; the guarantee is structural, not prudential. Everything else – every specific rule, every threshold, the amendment procedure above its floor – changes through the governed process.

Entrenchment binds change inside the system and has no force outside it. A community can abandon the system wholesale and build a successor; no rule prevents revolution. Abandonment is a replacement in the sense of level 3, and what survives it is what survives every replacement: the preserved record, interpretable under the framework that produced it.

Concurrent operation during transitions

A rule change does not take effect all at once. Between enactment and full effect, entities evaluated under the old version coexist with entities evaluated under the new one, and operations begun under the old version are still in flight.

Each change therefore declares a transition provision: what happens to evaluations and operations that straddle it. The default is completion – an operation initiated under the old version finishes under the old version’s terms, so an entity partway through a multi-month authorization is not forced to restart because the rules moved midway. Some changes declare the opposite. A sanctions designation or an emergency suspension is fail-closed: affected operations halt rather than complete, and the halt is recorded as an evaluation under the new version. Which regime applies is declared with the change, not inferred after the fact.

During the transition the system runs dual operation: old and new versions evaluated concurrently, every evaluation tagged with the version that produced it. Comparing verdicts on the same entity yields one of three outcomes: the versions agree, they disagree, or the proposition one evaluates has no counterpart in the other. The third outcome is not noise. Incomparable verdicts are direct evidence that the change reaches level 3 – the frameworks differ in what they ask, not only in what they answer – and the rates of all three outcomes are the information a regulator needs to judge whether the new rules behave as intended.

The transition has a governed end. Entities still evaluated under the old version receive a path to re-evaluation under the new one, and then the old version sunsets as active law, never as record. “Was this entity compliant in 2024?” keeps a definite answer after 2025 changes the rules. What must survive indefinitely is the record: which version, which facts or their commitments, which verdict, and the evidence that none has been altered. The underlying data may not survive. Statutes cap retention periods, and data-protection law grants erasure rights (Article 17 of the GDPR is the type case). An evaluation whose fact snapshot has been erased remains verifiable – the commitments still prove what was decided and against which text – but it stops being replayable. Erasure moves records from the second class to the first, and a system with evidentiary obligations tracks which class each record occupies.

The permanent next paradigm

Replacements are the hardest transitions, and they announce themselves late. Beginning translation only after a jurisdiction announces a fundamental restructuring means building the bridge from scratch under time pressure, and the result is a rushed, lossy translation or a prolonged period of incompatibility.

The alternative is a standing shadow of the most plausible next framework. If the evidence points from principles-based toward rules-based securities regulation, the translation work begins before any announcement: the mapping is drafted, its loss set is computed, candidate incommensurable propositions are identified, and the two frameworks run side by side against live records.

The forecast will often be wrong, and when it is, the bridge content – the specific mappings into the anticipated framework – is discarded. What survives is paradigm-independent: the machinery for constructing a translation and computing its loss set, the tests that detect incommensurability, the tooling for dual operation with tagged verdicts, the practice of reading divergence. A real transition consumes exactly these, whichever paradigm arrives. The shadow’s value does not depend on the forecast being right; it depends on the transition machinery being exercised before the day it is needed.

Why this matters

Version control, deprecation, migration: the vocabulary is software’s, and the mechanisms look familiar. The rule problem is harder than its software analogue because rules carry normative weight that code does not. When a library deprecates an API, old code gets updated. When a jurisdiction deprecates a regulatory framework, historical compliance determinations – relied on by entities, certified by regulators, enforced by courts – must remain verifiable under the framework that produced them.

The version chain is the mechanism by which a rule system maintains institutional continuity across change. It answers the question: “the rules have changed – can you still prove that what we did under the old rules was legitimate?” If the answer is no, the change has retroactively undermined every decision made under the prior regime. If the answer is yes – because old versions are retained, records are bound to their governing versions, and the record is tamper-evident – the change is additive. It changes the future without destroying the past.

The limits of the machinery are part of its statement. It assumes a single lineage of versions; branching amendment histories await the graph generalization. It replays only what was committed, so oracle answers and human judgments reproduce without their sources. Erasure obligations can demote a record from replayable to verifiable. Fail-closed changes displace the completion default and must be declared with the change that carries them. Retroactive invalidation is absorbed by appending, never by rewriting. The entrenched floor stands on unforgeable signatures and on custody of the founding keys: keys leaked to the threshold dissolve it through valid steps, keys lost below it freeze it. And entrenchment holds only inside the system; against wholesale abandonment, the preserved record is what remains.

That is the goal of meta-evolution: a system that can change any of its rules – the rules of change included, above their entrenched floor – while preserving the integrity of everything ever done under any rule it has had. The mechanism is version chains, records bound by hash to the versions that produced them, declared transition provisions, dual operation during replacements, and a floor under the amendment process held by signatures the process cannot mint.

References

Hart, H. L. A. (1961). The Concept of Law. Oxford University Press.

Kuhn, T. S. (1962). The Structure of Scientific Revolutions. University of Chicago Press.

Ross, A. (1969). “On Self-Reference and a Puzzle in Constitutional Law.” Mind, 78(309), 1–24.

Snodgrass, R. T. and Ahn, I. (1985). “A Taxonomy of Time in Databases.” Proceedings of the ACM SIGMOD International Conference on Management of Data, 236–246.

Suber, P. (1990). The Paradox of Self-Amendment: A Study of Law, Logic, Omnipotence, and Change. Peter Lang.