2.1 Records and statements

Let \mathcal{V} be a finite nonempty set of deployments. For each v\in\mathcal{V}, let D_v=(L_v,Q_v,I_v,A_v) contain four append-only sequences. An append-only sequence retains earlier entries when a later entry records a correction or withdrawal. Here L_v is the local institutional record, Q_v is the authority-and-policy history, I_v is the issuance record, and A_v is the acceptance record. The whole state is \Sigma=\left((D_v)_{v\in\mathcal{V}},\mathcal{G},\mathcal{R},\mathcal{K}\right). \mathcal{G} records transport and route derivations. Write \mathcal{R}=\bigsqcup_{v\in\mathcal{V}}R_v, \qquad \mathcal{K}=\bigsqcup_{v\in\mathcal{V}}K_v. The rights and cash records are constitutive local registers. Each R_v records creation, current holding, transfer, and extinguishment under the authority of v. Each K_v records an instruction and the evidence that a named provider completed or reversed it. A K_v entry records the institution’s determination. The provider’s rulebook and governing law determine cash movement and legal effect. No event in \mathcal{G} can write either register.

A delegation explains why a particular signer may act for an institution. Its starting point is a constitutive authority: power conferred by the institution’s governing basis, from which the recorded delegations descend. The model takes that basis as an institutional premise.

The root of this chain is local. A foreign statement can satisfy an evidence rule. It cannot create a constitutive authority at its destination.

The authority record distinguishes the competent institution, its delegated decision maker, and its technical operator. Infrastructure credentials identify the operator. The governing instrument determines the decision power. An instrument profile binds its retained bytes, applicable law, competent office, permitted acts, conditions, and adoption rule. Each profile records legal effective time separately from recording time. A policy amendment uses the authority fixed by its predecessor profile.

The statement must identify exactly what was asserted and for which use. A cryptographic digest identifies its encoded bytes. A digital signature authenticates that digest under a signing key. Canonical encoding gives those fields one specified byte representation.

South next needs a rule connecting the foreign statement to its own question. Approval of that rule belongs to South. Different destinations can give the same statement different treatment.

Evidence may reach South through an intermediate institution. South then needs the complete sequence of recognition rules, including the authority for each one. A route derivation retains that sequence.

2.2 Historical verification and present use

The later presentation in the registry example requires two checks: whether North made the earlier assertion, and whether South may rely on it now. Every assertion retains its original act identifier and signed validity interval. Each later receipt identifies that assertion and the receiving institution’s treatment. A receipt preserves the source interval. Reuse under delegation can run automatically while retaining the original act and its current-use conditions.

Write t_a for an act’s occurrence time and t for the proposed use time. Write k for the evidence cutoff. An authority or policy fact records its effective interval and recording time. The view at cutoff k uses only facts recorded by k. A later correction appends its authority, effective time, and predecessor. It preserves the evidence view used for the earlier decision.

For request q, a verifier returns four separate results: (\mathsf{Bytes}(m,k),\mathsf{History}(s,t_a,k), \mathsf{Reliance}(s,q,t,k),\mathsf{Act}(q,t,k)). The first result reports \mathsf{Available}, \mathsf{Missing}, or \mathsf{Corrupt} for the required retained bytes. Historical verification checks the original signature and authority under the recorded evidence view. Reliance applies the destination’s current purpose, policy, source-validity, and authority-use conditions. Operational authorization checks the distinct local act and its named execution stage.

A historical result distinguishes verified, refuted, and unresolved premises. Reliance and operational authorization distinguish admissible, refused, and pending results. Missing required bytes or an incomplete authority feed produces pending, with the exact unresolved dependency. A known expired-use interval produces refusal for that use. Neither result erases the authenticated earlier assertion.

A digest alone cannot supply the bytes required to verify it. A retained preimage is the original byte string whose digest is recorded. A retained-preimage manifest m names every required object’s digest, encoding, byte length, authorized retrieval locations, retention interval, and responsible custodian. It covers source statements, signatures, authority instruments, policies, status evidence, and derivation inputs. A verifier retrieves the permitted bytes and checks their digests. Content-addressed references locate evidence. They do not certify retrieval. A completeness witness binds the authority-source scope, status head, observation cutoff, and applicable currentness rule.

For example, an assertion issued at time 2 has a use interval [2,5]. At time 7, its retained signature can verify historically. That assertion cannot satisfy a current-use rule requiring membership in [2,5]. A later recognition receipt leaves the interval unchanged. Restoring missing bytes permits the suspended check to resume with its original request and dependencies.

2.3 Events

The preceding objects describe evidence and authority. We now specify the changes a deployment may make with them. An event constructor fixes one kind of change, its sole target record, and its admission conditions. Its guard is the collection of conditions that must hold before that change is admitted. The current head identifies the record’s latest committed state. A new event names that head as its predecessor, so it cannot silently replace an intervening change.

The event set \mathcal{E} is the disjoint union of the following classes: \begin{align*} \mathcal{E}_Q &={\{\mathsf{Grant},\mathsf{Revoke},\mathsf{Publish},\mathsf{Withdraw}\}},\\ \mathcal{E}_I &={\{\mathsf{Issue}\}},\\ \mathcal{E}_G &={\{\mathsf{Transport},\mathsf{RouteExtend}\}},\\ \mathcal{E}_A &={\{\mathsf{Accept},\mathsf{Reject}\}},\\ \mathcal{E}_L &={\{\mathsf{LocalCommit}\}},\\ \mathcal{E}_R &={\{\mathsf{RightCreate},\mathsf{RightTransfer},\mathsf{RightExtinguish}\}},\\ \mathcal{E}_K &={\{\mathsf{CashInstruct},\mathsf{CashConfirm},\mathsf{CashReverse}\}}. \end{align*} Every event carries a unique identifier, time, predecessor head, scope, subject, purpose, payload, authority chain, digest, and signature. Its constructor fixes the sole target record. A successful event appends one immutable entry.

South can check a recognition rule immediately before another authorized event withdraws it. Protecting the branch record alone would miss that change. The signed guard witness therefore binds every mutable input to the constructor. These inputs include authority, policy, route, acceptance, revocation, and resource records. Absence and range queries bind collection or index heads. The witness also binds rule versions and the records that determine dependency owners and participants. Instrumented guard reads enforce this dependency set.

An operation can be authorized locally before it is dispatched or accepted by a provider. The governing rule determines when the relevant authority must hold. An authority-use contract names the act and the stage at which authority is required. It distinguishes three obligations. Historical validity establishes authority for a recorded earlier act. Consumed authorization establishes a specific effect at its named consumption stage under the governing instrument. Continuing authority must hold through a named later stage, such as dispatch or provider acceptance. Each contract binds its legal basis, scope, subject, purpose, interval, and exact command. A software status alone cannot make authorization irrevocable.

The transition relation is the following guarded construction. These clauses define the permitted changes. For cash events, an occurrence is the provider event recorded by the evidence. An allocation attributes an amount from that occurrence to an instruction. The unpaid amount is the part still due. A reservation retains the capacity that an unresolved command can still use.

\mathsf{Grant}

Append to Q_v. Create one delegated authority whose scopes, subjects, purposes, and validity interval are contained in its active parent grant.

\mathsf{Revoke}

Append to Q_v. End one active non-constitutive grant prospectively. Preserve the grant and every earlier use.

\mathsf{Publish}

Append to Q_v. Create one policy version under the predecessor’s adoption authority. A directed version binds source, subject relation, purpose, predicate, required questions, treatment, and interval. A governance version binds its instrument profile, permitted transition, exact predecessor, conditions, and institutional authority. Its adoption follows the rule already in force.

\mathsf{Withdraw}

Append to Q_v. End future use of one active policy version signed by v. Preserve earlier uses.

\mathsf{Issue}

Append to I_v. Create the statement digest and signature after checking the issuer’s scope, subject, purpose, predicate, and interval.

\mathsf{Transport}

Append to \mathcal{G}. Start a route for the exact issued-statement digest. Change no institutional, rights, or cash record.

\mathsf{RouteExtend}

Append to \mathcal{G}. Extend only the current route by one active directed-policy digest that matches the same statement, subject, purpose, and predicate.

\mathsf{Accept}

Append to A_v. Bind the statement digest, original act, complete route, active destination policy, request, required answers, treatment, and decision authority. Bind the retained-preimage manifest, evidence cutoff, historical result, and current reliance result.

\mathsf{Reject}

Append to A_v. Bind the same objects as acceptance and add the destination’s signed reason for refusal.

\mathsf{LocalCommit}

Append to L_v. Every local rule lists its required evidence predicates. The event must cite exactly one current acceptance for each required predicate, with the same subject and purpose, and must carry a separate local authority witness.

\mathsf{RightCreate}

Append to R_v. Require an absent right identifier, an initial holder, a legal basis, and an authority for that right and purpose.

\mathsf{RightTransfer}

Append to R_v. Require an active right, the recorded current holder as transferor, a distinct transferee, and matching authority.

\mathsf{RightExtinguish}

Append to R_v. Require an active right, its recorded current holder, and matching extinguishment authority. Mark that right extinguished.

\mathsf{CashInstruct}

Append to K_v. Require a new instruction identifier, payer, payee, positive amount, currency, provider reference, and matching authority. Mark the instruction open.

\mathsf{CashConfirm}

Append to K_v. Record an authenticated provider occurrence for the instruction’s payer, payee, and currency. Bind its positive amount, canonical occurrence identity, and admitted allocation. A correction form binds that occurrence, its predecessor assertion, and correction authority. It can revise the asserted amount to zero without a new occurrence. Update supported performance, unpaid amount, and reservation together. Partial performance leaves the remainder explicit.

\mathsf{CashReverse}

Append to K_v. Record an authenticated return or reversal occurrence linked to the earlier payment. Bind its amount, reason, and attribution to prior performance. A correction form revises that occurrence’s assertion under correction authority and binds its predecessor assertion. Correction does not require another physical reversal. Update net support, unpaid amount, and reservation together. Preserve the earlier occurrence and its history.

The decisive separation is now explicit. Acceptance can change only A_v. A local rule can require that acceptance, but \mathsf{LocalCommit} remains a new authorized event. Rights and cash have their own constructors, current-state guards, and authorities. No type conversion crosses these records.

A cash occurrence uses the provider namespace, record kind, and stable reference. Assertion and allocation identities remain separate. Repeated evidence for one occurrence adds no performance. The allocation authority bounds each attributed amount by the instruction’s unpaid amount and the occurrence’s available support. Its complete guard spans every competing allocation.

For instruction amount z, let p be supported allocated performance and u=z-p its unpaid amount. Funding status is open, partial, or complete according as p=0, 0<p<z, or p=z. A reversal’s attributed amount cannot exceed the unreversed prior allocation. Excess observed payment or debit remains recorded for reconciliation. It supplies no unsupported discharge.

Command closure remains separate from funding status. Partial performance does not prove that the original command cannot perform its remainder. Uncertain command capacity retains its reservation. Release requires terminal remainder evidence or a provider-enforced transfer of that capacity. A reversal supplies no new dispatch authority.

An authoritative correction changes the assertion about its existing occurrence. The cash record retains the assertion history and resulting support deficit. A correction is distinct from a physical return or reversal. Current cash and claim projections use the same corrected allocation state.

2.4 Validity conditions

The event clauses specify individual changes. The following conditions require every admitted step to respect its target, authority, current dependencies, and retained history. A transaction applies its changes together or leaves them unapplied. Strict serializability gives concurrent transactions the effect of one order consistent with completed real-time precedence. A finite history h=e_1\cdots e_n is valid when every prefix satisfies six conditions.

N1.

Complete partition. Every state change has one of the sixteen constructors and the unique target fixed by that constructor.

N2.

Effect locality. An event changes only its declared target record. No evidence event changes L_v, \mathcal{R}, or \mathcal{K}.

N3.

Witnessed authority and bytes. The authority chain begins at a constitutive root and ends at the signer. Every delegation covers the event’s scope, subject, purpose, and time. The canonical digest covers every event field, and the signature verifies that digest.

N4.

Constructor guard and current reliance. Every constructor satisfies its clause above. Acceptance verifies the exact statement digest, issuance, subject, purpose, predicate, route, active policy, required answers, and applicable revocation information. A local commit cites every required acceptance and checks each authority-use contract at its named stage. Historical issuance validity remains distinct from current permission to rely on the statement. A rights event names the current holder. A cash event matches the instruction fields and its required external witness. Revocation and withdrawal bar subsequent uses that require the affected current authority. A lawfully consumed authorization retains only the effect and scope fixed by its governing instrument.

N5.

Dependency-complete guarded append. One strictly serializable transaction validates the target predecessor and every declared mutable dependency version. It supplies one consistent dependency state and event time to the applicable semantic checks. N4 determines constructor admissibility. N5 protects the observed versions until the entry and new head become durable together. A conflicting version change causes reevaluation or rejection.

N6.

Ordered immutable history. Event times do not decrease within a record. Recorded identifiers, payloads, digests, signatures, and policy versions never change.

These conditions constrain admissible transitions. They do not assume the conclusions below. In particular, replay and attribution quantify over whole histories, while the conditions govern one transition at a time.

Condition N5 protects the complete guard read set while changing one target record. A local transaction covers locally owned dependencies. Current dependencies owned elsewhere require their owners’ participation under Section 5.1. A signed snapshot proves its recorded contents. Its continued current-use validity follows the authority-use contract. Atomic institutional records retain the distinct completion and finality rules of external providers.

3.1 Four independent necessity witnesses

Each construction removes one condition and retains the other five. The prefix may contain several events. The violating extension is one transition.

1. Without N1, allow a right transfer outside the event partition. The right changes while every projection remains unchanged, so replay fails.

2. Without N2, let one acceptance event append to both A_v and L_u. An event foreign to L_u changes it, so local replay fails.

3. Without N3, record an otherwise admissible issuance with a corrupted source signature. Transport and acceptance use its exact recorded digest, active route, and destination rule. N1, N2, N4, N5, and N6 hold, but source attribution fails.

4. Without N4, correctly issue, transport, and route a statement. Withdraw the destination policy, then present a separately signed acceptance at a later time. Bind the current acceptance head and complete dependency versions, including the withdrawn policy record. Serialize observation and append under N5. With N4 removed, semantic rejection of the withdrawn policy is absent. N1, N2, N3, N5, and N6 hold, while time safety and prospective revocation fail.

These histories establish necessity for N1–N4 relative to the stated conclusions. We do not supply necessity witnesses for N5 or N6. They are sufficient conditions used by the theorem, not claimed minimal assumptions.

A finite sequential two-deployment event model exercises all sixteen constructors in one valid trace. It also enumerates all 1{,}120 interleavings of independent rights, cash, withdrawal, and revocation tails that preserve their internal orders. It rejects 37 mutations covering the constructor partition, target locality, authority scope and chain, subject-purpose binding, canonical digest, signature, predecessor, time, required evidence, current holder, and cash-state guards. These finite calculations corroborate the definitions. They do not prove Theorem 3.1 for unbounded histories.

4.1 A complete interface for recognition

An identity file can answer an evidence question while the receiving authority retains a current licensing decision. Both can concern one domain. A complete interface carries the file, the local question, and every duty that its use creates. The carrying set alone determines none of those duties.

A source cell is one attributed source observation with its scope and evidence. An obligation body records what must be done, by whom, and under which trigger. An effect plan identifies the acts that a permission allows. Their occurrence, and the duties they activate, require the corresponding events.

The common corridor record retains the independent carrying and fresh fields. The fresh mask is the domain projection of its local-evaluation obligations. Import prerequisites determine when evidence may enter. Other questions can remain pending while imported evidence supplies their inputs. Their owning destination decides them under its own rule. An obligation reaches completion only through its named completion rule. Higher grades leave reporting and payment duties intact. Admission checks the prerequisites of its named stage. A later reporting duty can remain outstanding after the authorized act that creates it. Traversal identity is separate from policy identity. An exact traversal retry retains its result. A new traversal can reuse the same policy.

An evidence grade and a judgment about applicability answer different questions. The product of an applicable grade and an applicability-marker set records the two axes. In increasing order, the applicable grades are NonCompliant, Pending, and Compliant, with an additional empty-fold top. This top is the identity for aggregation when no applicable grade has been supplied. It does not assert a compliant observation. The markers are NotApplicable and Exempt. Each family aggregates applicable grades by minimum and markers by union. Thus NonCompliant from one authority and NotApplicable from another retain both observations. The receiver admits the source cells before calculating this summary. A local five-label display alone cannot reconstruct their separate scope judgments.

This normalization concerns admitted records. The receiving instrument supplies the legal basis for their use. A transport summary is a projection of the record, with the corresponding restricted meaning.

4.2 Replacing a running route

An institution may replace an existing route while requests or duties remain outstanding. Equal final grades can conceal different reports, deadlines, or permitted disclosures. Route substitution therefore uses the observation contract of the relying institution. Each observation contains its verdict, authority attribution, evidence treatment, effect plan, outstanding obligations, deadlines, disclosure, and continuation status.

For a bounded model, represent a route by a finite deterministic total machine over admitted evidence, local-answer, policy, and time events. An event produces an observation and a successor state. The observation contract specifies everything the relying institution treats as relevant. A finite input word is a finite sequence of these events. Refused and unresolved events have explicit outcomes. To compare two machines, explore their reachable state-pair graph. At every pair, compare the observations for every input and retain any distinguishing input word.

Two machines can pass despite different internal cache states. Two Allow outcomes fail when they impose different reports or deadlines. Omitting those fields would change the observation contract and its conclusion. The finite comparison proves the behavior of the encoded machines. Instrument adoption, actual evaluator refinement, and unbounded or nondeterministic environments retain their separate proof obligations.

4.3 Route cost

Behavioral equivalence does not estimate delay or the chance that a route encounters an impediment. The following expression addresses a separate probabilistic question for a declared use. Corridors are directed. \mathcal P_{uv} and \mathcal P_{vu} may differ in carrying sets, fresh questions, maps, authority, and interval. A path u=v_0,\ldots,v_k=v has route friction \Phi(u\leadsto v)=1-\prod_{i=1}^{k}(1-\rho_i). Here \rho_i\in[0,1] is the independently estimated friction of edge i for this use. To interpret the expression as the probability of at least one impediment, each estimate must refer to its specified edge event. The product assumes independent edge risks. Correlated edges require a joint model. The maximum is not equivalent.

4.4 The compliance passport

A compliance passport is a portable package of statements, derivations, and the retained evidence needed to check them. Its recognition receipts retain the complete carried contents and duties. The passport carries this evidence to a destination whose own policy governs its use. The genesis record is the initial trusted record from which the presented chain begins. Before using the passport, a destination performs six checks:

1. Validate the passport schema and every content digest.

2. Verify the chain from the declared genesis record to the presented head.

3. Verify each source signature and issuance-authority witness at issuance time.

4. Verify every corridor edge, immutable policy version, and destination authority in the route.

5. Check the retained manifest, source intervals, evidence cutoff, status completeness, and named authority-use stage.

6. Apply the local domain mapping, reserved-domain rule, evidentiary treatment, and decision authority.

These checks return the separate historical, reliance, and operational results from Section 2.2. Retained packages support offline historical verification at their recorded cutoff. Current use requires the applicable authority-source contract. Selective presentation proves the disclosed relation while leaving omitted required premises pending. The source and destination remain accountable for their respective assertions and decisions.

4.5 Corridor receipts

A recognition receipt describes what a route carries. An acceptance receipt records the destination’s signed decision to admit a statement from that package. Its digests identify the statement, route policies, and retained manifest used for that decision. An acceptance receipt contains \begin{split} (&\mathsf{issuer},\mathsf{destination},\mathsf{subject}, \mathsf{statementDigest},\mathsf{route},\\ &\mathsf{originalAct},\mathsf{originalValidity}, \mathsf{policyDigests},\mathsf{sourceAuthorityDigest},\\ &\mathsf{destinationDecisionAuthority},\mathsf{manifestDigest}, \mathsf{evidenceCutoff},\mathsf{useStage},\\ &\mathsf{localTreatment},\mathsf{acceptedAt}, \mathsf{priorReceiptDigest},\mathsf{signature}). \end{split} The signature covers canonical bytes of every preceding field, including the predecessor link. A mismatched link rejects extension. JSON Canonicalization Scheme fixes JSON bytes, not institutional meaning (Reference [8]).

4.6 What a sequence of disclosures reveals

Recognition can authorize selective disclosure instead of transfer of the complete source record. The destination must then account for what its earlier disclosures already revealed. A permitted answer changes what its recipient can infer from later answers. Suppose three records contain values A,B,C. Releasing their pairwise sums gives r_1=A+B,\qquad r_2=B+C,\qquad r_3=A+C, \qquad A=\frac{r_1+r_3-r_2}{2}. Each answer combines two records. Together, the answers determine every record. A valid signature authenticates this disclosure without limiting the recipient’s subsequent calculation.

The exact linear case admits a complete test. Fix one source snapshot x\in\mathbb Q^n, where n>0. Public row vectors describe the permitted queries. A matrix H records every row already observed by one recipient coalition, together with its declared linear auxiliary knowledge. The coalition includes recipients whose observations can be combined. Purpose labels remain permission conditions within this common history. Let q_1,\ldots,q_m be protected rows, whose values q_jx must remain undetermined. Assume each q_j lies outside the row span of H.

For the three-record example, the first two rows leave direction (1,-1,1) unobserved. All three protected coordinates remain undetermined. A second release of 2(A+B) preserves this property. The third pairwise sum removes that direction and fails the criterion. The admissible query set therefore includes useful aggregates and exact linear combinations of previously admitted answers.

The condition is exact for this observation model. Its source domain is the unrestricted rational space. For nonnegative A,B, the observation A+B=0 already determines both values. That inference uses the domain constraint, which a row-span test alone omits. Nonlinear constraints, approximate inference, and statistical privacy require their own models. The public query choices must also be independent of private values. A privately chosen query can disclose information through its identity, even when its numeric answer passes the test.

4.7 Durable admission for concurrent requests

Two requests can each pass against one history and fail when combined. After releasing A+B, both B+C and A+C pass separately. Admitting both would disclose A,B,C. Each coalition therefore uses one authoritative disclosure store for the fixed snapshot and protection profile. Every admitted release participates in its serial order.

A local disclosure-store implementation uses an immediate SQLite transaction. SQLite provides the local transactional database for this construction. It reads the committed history, checks current grants, composes the new rows, and performs exact rational elimination. On success, it records the command, query, result, source lineage, grant digests, and predecessor. Only the committed transaction can return numeric results. A retry binds the same command to the same artifact, purpose, audience, and retention deadline. It checks current release permission before returning the recorded result.

A crash before commitment releases nothing through this interface. A crash after commitment preserves the disclosure in the history even when delivery remains uncertain. Retrying then returns its recorded value. This conservative treatment prevents a failed acknowledgment from restoring permission to disclose an incompatible query. Deleting an output under its retention rule also preserves the rows needed to account for what a recipient may remember.

The store protects its stated coalition and snapshot. Separate stores need a common admission authority before their outputs can compose under this result. Later auxiliary knowledge and changed protection rules require a new comparison against all existing observations. Trusted storage, complete mediation, authenticated coalition membership, and current authority evidence remain explicit implementation premises.

4.8 Permissions of derived artifacts

The cumulative disclosure test answers whether a release reconstructs a protected value. The right to perform the computation is a separate question. Computation, disclosure, model training, and commercial use are distinct acts. A source grant names its instrument, source, act, purpose, audience, validity interval, and retention bounds. The host admits the instrument and its authority evidence. The construction preserves that evidence without deciding its legal adequacy.

An immutable operation plan binds the exact input artifacts, public transformation, operation class, and classification authority. Execution accepts that plan identifier and obtains the operation class from the admitted record. The caller cannot relabel a training plan as computation. The competent authority still determines the licensed meaning of an act. An identical matrix can implement different purposes, so its coefficients alone cannot establish that classification.

Represent an artifact by (T,L), where its values are Tx and L contains all source obligations inherited from its parents. For a public linear transformation U, derivation produces (UT,L). Several parents contribute their stacked rows and the union of their source obligations. A zero coefficient preserves the obligation of a source used in that derivation. A different, independently authorized computation can use a smaller set of inputs.

Grant composition takes an intersection across source obligations. A separately issued training grant changes the training decision only within its own scope. Disclosure and commercial use retain their own grants. Effective revocations govern each subsequent use while the earlier grant and its historical use remain recorded.

An aggregate can consequently support local research while its training request remains refused. With separately admitted training grants, a public full-column-rank design X yields the least-squares coefficient map (X^{\mathsf T}X)^{-1}X^{\mathsf T}. This map acts on the admitted response artifacts and preserves their source obligations. Releasing its coefficients passes through the same cumulative disclosure test. An intercept-only fit releases a mean when its history permits it. A saturated fit can determine the original responses and is refused by the exact reconstruction rule.

The local disclosure-store implementation checks these mechanisms with exact fractions, real process races, and process termination on both sides of commitment. It retains grant evidence and deadlines in trusted local storage. Enforced deletion, undisclosed recipient knowledge, general statistical learning, and actual instrument authority have separate evidence requirements. In particular, permission to compute a result leaves its disclosure decision dependent on both source rights and accumulated observations.

5.1 Realizing complete guard transactions

The main implementation difficulty is discovering everything the decision reads. A direct lookup can depend on an ownership rule, which identifies a different authority and another required participant. Those determining records must also remain fixed. An authority-resolution root identifies the admitted record from which authority lookup starts. A participant-selection root similarly determines whose agreement the transaction requires.

For event e with target X_e, let \mathcal{D}_e contain every mutable input to its guard. Its witness contains \rho_e=\{(Y,\operatorname{head}(Y)):Y\in\mathcal{D}_e\cup\{X_e\}\}. The set includes indirect reads through rules, accepted evidence, and authority chains. It also includes corridor, authority-resolution, membership, and participant-selection roots. Collection heads protect absence and range queries. Instrumented reads enforce completeness. A conservative implementation can bind the complete protected-state head.

A reservation prevents a conflicting change while the decision is unresolved. Read mode protects a required value. Write mode also reserves the record to be changed. The witness fixes every resource and its reservation mode before acquisition. The constructor’s known target has write mode. Every other dependency has read mode. Repeated resource identifiers coalesce at the strongest required mode. The target therefore acquires write mode on its first reservation.

Within one deployment, a commit mutex and one durable transaction suffice. Every protected-state writer uses that mutex, including administrative and revocation paths. The boundary validates \rho_e, evaluates the guard, and appends before releasing it. It reads the admitted clock at the actual durable event. Clock-error bounds must make interval acceptance conservative. A proposal timestamp cannot establish authority at a later commit. Immutable signature checks can run beforehand when the boundary binds their exact input bytes.

Strict read and write reservations can replace the mutex. They must protect the complete dependency set through durable append. Separate validation followed by an unprotected append permits revocation between the two operations. Checking only the target head also permits that history.

5.2 Capacity with local dependencies

Complete dependencies also identify which decisions can proceed independently. A service domain is a unit with an exclusion or capacity constraint, such as a record owner or provider. Service domains differ from the compliance domains used to classify evidence. A network can add execution capacity through additional independently served domains. The complete dependency set determines whether those domains can work concurrently. A command’s service footprint includes its storage, decision journal, authority checks, communication, workers, and required provider stages. Shared services count even when their names are absent from the business request.

Fix a batch of m\geq1 ready commands using N active service domains. Every command has a nonempty footprint. Each domain represents an exclusion or capacity constraint. Two commands conflict when their footprints intersect. This conservative rule can serialize compatible reads. It gives a sufficient schedule without assuming free service capacity.

Readiness includes exact requests, valid authority-use contracts, and separately available funding or resource allocations. Every remaining command must remain feasible after each admitted batch prefix. Fresh attempts rebind current heads and check their guards. Commands that need another command’s output belong to a later readiness phase.

The bound scales with active domains when k,h,\tau, and S remain bounded. Idle deployments contribute no throughput floor. A repeated schedule can amortize its construction cost. Each reuse still checks the current authority, dependencies, and reserved capacity. A central scheduler whose work grows with the entire batch must include that cost in S.

The bounded service premise is stronger than eventual communication and recovery. A partition can retain safe reservations while suspending completion. A shared decision journal, universal provider, authority-resolution service, or resource owner can increase h or \tau. A larger network alone does not remove those constraints.

Dependent workflows retain their required order. For L successive ready phases with uniform k,h,S,\tau, a sufficient completion bound is L\{S+[k(h-1)+1]\tau\}. A chain of independently funded commands requiring predecessor completion receipts can require L=m. Each command changes its own hosted token and appends its receipt. The next command checks that immutable receipt. Each command then touches at most two local services. Funding conflicts can likewise defeat persistent feasibility. The runtime must construct feasible phases, rather than infer them from small footprints.

A positive construction partitions N=kg domains into g independent corridor groups. Give each group h funded commands with stable authority and disjoint allocations. One command per group executes in each of h waves. The gh commands finish in service time at most h\tau. Their service rate is at least N/(k\tau). Both endpoints and any required provider services belong to their group’s counted footprint.

6.1 Partitions and healing

After communication returns, the endpoints compare signed records.

1. An endpoint can decline preparation when its deadline passes. Local absence of a second lock or certificate proves no global absence. A prepared transaction requests abort through the unique durable terminal decision. It retains its reservations while the outcome remains unknown.

2. With two matching locks, either endpoint can assemble the authorization certificate during the validity interval. It submits that certificate to the agreed terminal-decision protocol.

3. With a certificate at one endpoint, the other verifies the certificate and the durable terminal decision before applying the outcome.

4. Competing signed digests satisfy no commit rule. Their signed conflict attributes the disagreement and supplies a blame witness for the dispute route.

The construction guarantees attributable agreement evidence. Partition availability, certificate replication, and common-terminal recovery remain communication and honest-recovery assumptions.

7.1 Lifecycle

A typestate records which stage of this lifecycle a corridor version has reached. A corridor version follows the typestate \begin{split} \mathsf{Draft}&\rightarrow\mathsf{PendingEndpointRatification} \rightarrow\mathsf{PendingRouteNotice}\\ &\rightarrow\mathsf{RatifiedPendingWindow}\rightarrow\mathsf{Active}. \end{split} The \mathsf{Active} state has six outgoing branches. The stopping states are \mathsf{Halted}, \mathsf{Suspended}, and \mathsf{Revoked}. The record states are \mathsf{SupersededDraining}, \mathsf{Retired}, and \mathsf{DisputedOverlay}. The pending states retain the ratifications, notices, or activation window still required. SupersededDraining retains unresolved work under a replaced version. Retired records the end of that version’s use. Every transition names its authority, scope, effective time, predecessor, and notices. \mathsf{DisputedOverlay} records a commenced proceeding over the base state without replacing it.

A watcher observes a deployment’s signed records and reports what it has checked. Its observation can supply evidence for an authorized decision. Four rules preserve the authority boundary.

1. Watchers observe, sign observations, and attribute disagreement. They do not amend law or corridor policy.

2. A registration change uses the named registration authority and its instrument-defined conditions. A bond draw uses a separate custodian mandate, liability decision, and funded bond record. A blame certificate supplies evidence for those decisions.

3. A destination authority may tighten its recognition treatment prospectively under its local rule.

4. Loosening recognition requires endpoint ratification, route notice, and passport checks. Shared sanctions reliance also requires a current shared-authority certificate and revocation check.

The accession of new participants is a separate construction, developed in Accession Networks (Reference [4]). Disputes about terminal disagreement, emergency relief, and the \mathsf{DisputedOverlay} proceeding belong to the dispute layer (Reference [5]).

7.2 Watcher evidence

Several signatures can come from keys under one controller. The receiver therefore needs evidence about who signed and which signers can fail together. An epoch is the fixed configuration under which those signatures are compared. A watcher epoch binds the principal registry, control graph, graph policy, certificate policy, and authenticated time anchor. The registry maps each signing key to one stable watcher principal. Multiple keys for that principal count once. A key cannot name two principals.

The control graph records ownership, decision power, operating authority, and signing-key administration. Each relationship binds its source, effective interval, evidence date, and responsible attestor. The graph policy selects relationships representing common compromise under its threat model. It includes indirect control. Connected components of selected relationships form the admitted control blocs. Each bloc groups principals connected by the common-control relationships selected in that policy.

Separate policies can describe observation integrity and service availability. Shared hosting can create an availability dependency without granting signing authority. The graph records these different relationships. An unresolved control record contributes no certified diversity. Its principal can still supply an observation. Unknown controllers cannot form a separately countable bloc.

For epoch e and certificate c, let S_e(c) contain its distinct eligible signing principals. Let \mathcal B_e partition the principals covered by admitted control evidence. The certificate requires |S_e(c)|\geq\theta_e,\qquad \bigl|\{B\in\mathcal B_e:B\cap S_e(c)\neq\varnothing\}\bigr| \geq K_e. The first threshold counts principals. The second counts covered control blocs. Every signature binds the same corridor, observation digest, slot, epoch, registry, graph, policy, purpose, and time anchor. Its signer wrapper binds the principal identity. Versions from different epochs cannot form one certificate.

The signing predicate requires receipt of the complete named observation, its deployment signature, and its contextual bindings. An honest watcher signs only after those checks.

The second bound counts every bloc containing a dishonest signer, including partial compromise. It requires coverage of all dishonest signing principals by the admitted graph. Graph components are a deterministic property of the evidence. Their institutional meaning depends on accurate and complete control evidence. They establish neither statistical independence nor the truth of each observed institutional assertion.

A fault configuration such as n_e\geq3f_e+1 selects a budget. Here the first count is the number of eligible principals in the epoch. Actual deployment evidence must support that budget. For weighted counting, the signing weight must exceed the assumed dishonest weight. Bonded weight supplies no organizational diversity. Consensus and availability require their separate protocol premises.

A controller change publishes a successor graph epoch. Current-use admission rechecks the applicable graph and registry versions under N5. The old certificate retains its historical signatures but loses current eligibility where the classification changed. Discovery of concealed historical control corrects the historical diversity assessment. It preserves signature authenticity rather than preserving an incorrect control assumption.

Key rotation retains principal identity and both counts. A signer-supplied earlier timestamp cannot revive a revoked key. A successor certificate can qualify automatically when its eligible signers satisfy the current policies. Evidentiary ineligibility remains separate from registration sanctions and bond liability.

For example, with \theta_e=K_e=3, three covered principals in distinct blocs can certify one observation. Three keys for one principal count once. Three principals sharing a selected signing controller count as one bloc. A common hosting dependency can affect their availability assessment independently.

Two valid deployment-signed observations at the same corridor, epoch, and height form a fork witness when their digests differ. Different heights ordinarily show record growth.

7.3 Institutional instruments

An instrument profile connects a machine transition to the institution empowered to give it effect. Its common fields are \begin{split} (&\mathsf{instrumentDigest},\mathsf{jurisdiction}, \mathsf{competentOffice},\mathsf{delegatedRole},\\ &\mathsf{technicalOperator},\mathsf{acts},\mathsf{scope}, \mathsf{conditions},\mathsf{effectiveInterval},\\ &\mathsf{recordedAt},\mathsf{adoptionRule},\mathsf{noticeRule}, \mathsf{challengeRule},\mathsf{terminationRule}). \end{split} The instrument’s retained text and authentic adoption evidence support these fields. A profile states the operative clauses for each transition. A mapping determination has its own competent issuer, scope, effective interval, and retained basis. Reusable determinations can support repeated automatic checks under their use contracts.

Three typed extensions supply the required governance acts.

Emergency mandate.

Name the trigger predicate, evidentiary threshold, affected acts, start rule, duration, countermand office, resumption office, notice channel, and challenge route. Each timing rule derives from the instrument.

Succession instrument.

Name predecessor and successor offices, surviving competence, effective time, adoption authority, record custodian, and explicit dispositions of rights and duties. Bind the prepared-transaction inventory, retained manifest, continuation rules, and authority-feed endpoints. A split allocates each competence explicitly. Joint competence names its joint decision rule.

Bond mandate.

Name the obligor, beneficiary, custodian, funded account, currency, pledged amount, permitted liability decisions, draw conditions, amount limit, notice, challenge, and release rule. Bind the provider’s payment and reversal contract. A liability assessment and available bond funding have separate fields.

Admission checks the predecessor authority profile, exact act, operative clause, conditions, use stage, and required signatures. Every required preimage must be available. A missing mandate yields a pending transition with the exact missing authority dependency. An authorized standing mandate lets subsequent conforming acts proceed automatically.

Governance versions enter Q_v through \mathsf{Publish} under the existing adoption rule. Their immutable payloads bind the instrument profile and transition conditions. \mathsf{Grant}, \mathsf{Revoke}, and \mathsf{Withdraw} retain their scoped effects. Constitutive change requires the independently effective institutional instrument specified by the predecessor authority structure. A technical operator cannot create that basis through publication.

7.4 Emergency power and countermand

Each destination’s emergency mandate determines its available halt and countermand powers. A halt identifies the affected acts, effective interval, trigger evidence, and governing clause. An immediate halt uses the mandate’s immediate-effect rule. A notice or countermand window applies only where the instrument requires it. The directive binds a single-use identifier and the exact scope. New reliance follows the halt state. Existing acceptances and unresolved obligations remain recorded.

Countermand checks the relationship between the named offices under the same mandate. Resumption checks its designated authority and release conditions. The runtime can perform a delegated automatic halt when authenticated evidence satisfies a preauthorized trigger. A discretionary trigger requires its authorized determination. Joint action uses the corresponding participant decision protocol. Delivery, key custody, and clock premises remain explicit.

An emergency-relief order directs parties only within its jurisdiction and authority. It displaces a sovereign halt only under a rule adopted by the halting authority (Reference [5]).

7.5 Jurisdiction continuity

The jurisdiction lifecycle map records creation, active competence, termination, merger, split, and scope amendment. The succession instrument supplies the lawful relation between those states. The runtime first validates that instrument and binds the affected authority-resolution roots.

A continuation package contains the old record heads, retained-preimage manifest, effective authority map, outstanding obligations, and every unresolved prepared transaction. The successor acknowledges custody and reconstructs those reservations before conflicting writes. Existing terminal decisions retain their exact event and command identities. A changed configuration supplies no abort or second dispatch.

Activation uses the existing adoption rule and the applicable guard transaction. It changes future authority resolution only for the instrument’s assigned scope. Dependent destinations apply their own recognition policies to the continuation package. Historical source acts keep their original issuers. An express adoption can authorize continued use without forging a replacement source act.

A valid split can route two disjoint competences to different successors and let both continue their permitted operations. Shared obligations retain their named common decision authority. A missing continuity instrument leaves the affected use pending while unrelated authority scopes continue.

7.6 Bond enforcement

A bond decision names its governing clause, liability basis, claimant, liable party, amount, currency, and decision authority. A watcher observation or fork witness can satisfy an evidentiary condition. The bond instrument determines the liability and draw power.

For a funded bond balance B, let r be prior reservations and e prior encumbrances. Define f=\max(B-r-e,0),\qquad d=\max(r+e-B,0). Then B+d=f+r+e. A new draw x requires 0<x\leq f and the mandate’s amount limit. Admission reserves x under the guard transaction before dispatch. An assessed receivable remains separate from B. A decrease in B records the resulting deficit without erasing prior reservations or liability.

The custodian executes the exact admitted command under its named authority-use contract. Confirmation requires its occurrence evidence. A paid debit reduces the funded balance and the command’s funded reservation in the same accounting update. Each debit applies once. Partial performance preserves the unpaid amount and remaining execution reservation. A return or reversal has its own occurrence and correction transition. Authorized release requires the instrument’s release conditions and resolution of outstanding command capacity.

7.7 Entrenched floor

Ordinary policy amendment must respect any clauses whose amendment authority was fixed outside that policy. We call those protected clauses an entrenched floor. The following result concerns enforcement of the existing signature requirement. It assumes that the requirement has the stated institutional basis.

Let F be a fixed set of floor clauses and E_F their required signature set. The validator changes F only when E_F signs the exact replacement.

Hart, Ross, and Suber study the distinction between ordinary rules and amendment authority (References [30]–[32]). The proposition states only the cryptographic consequence of fixing E_F externally.

7.8 Cryptographic continuity and trust boundary

Retained evidence may need to remain verifiable after a signing scheme is retired. An archival profile specifies the signatures required for acceptance and how successor evidence preserves the old record. One such profile can require an AND envelope of Ed25519, ML-DSA-65, and SLH-DSA-SHA2-128s. Each component signs the same canonical bytes and suite tag. Verification requires all three. Its signature field is 64+3{,}309+7{,}856=11{,}229\ \text{bytes}. The count excludes keys, tags, and encoding. RFC 8032 and NIST FIPS 204 and 205 give the component sizes (References [26]–[28]). Accepted forgery requires every verification relation to pass. This claim assumes component unforgeability, secure key binding, and correct verification.

Before retirement, the archive appends a successor-scheme witness over the prior digest while the old profile remains trusted. Re-anchoring preserves the historical entry. Later verification follows the witness chain specified by RFC 4998 (Reference [29]).

Cryptography proves neither evaluator fidelity nor policy correctness. Colluding evaluators can sign false statements. A defective authorized policy can return a wrong conclusion. Seniority and independence therefore require evidence beyond signatures. The control-evidence policy states which controllers must differ and which correlated failures remain in its threat model.

9.1 Allocation under a current execution grant

The cash-event model already separates a physical payment occurrence from its evidence and allocations. We now construct one local allocation operation under a current execution grant. Its authority check uses a logical point within a transaction. The stronger requirement of authority at actual durable commitment remains separate. Consider a narrower operation than payment execution. Physical credit has already been admitted, and a payable obligation already exists. The operation allocates specified slices of that credit to specified portions of the obligation. Its difficulty is to preserve the authority for that allocation while the records used to identify it can change. A route can acquire a different owner; a credit alias can resolve differently; an indirect rule can cease to permit the act.

Fix a finite allocation grammar. A request q names an immutable command, an obligation route, a credit route, an exact amount, an evidence package, and its original request time. Evaluation resolves the routes and records the exact payable portions and physical slices to be used. It also retains the historical recognition context at evaluation time t_0. That context includes the original request, local decisions, source evidence, obligations, and their admitted resolutions. Imported evidence must still satisfy the separately authorized local decision.

Conditional claims.

The one-writer realization requires T1–T4. Route-friction multiplication requires independent edge risks. Watcher, hybrid-signature, countermand, and post-partition conclusions require the assumptions stated in their sections.

Heuristic claims.

The control graph records specified common causes rather than statistical independence. Route-friction estimates require identified edge probabilities and dependence. Diminishing marginal evidence value remains a qualitative account.

Open questions.

N5 or N6 is minimal only if removing it yields a history that preserves the other conditions and breaks a named conclusion. Byzantine progress requires its communication, quorum, and recovery premises. Composable privacy requires an adversary and release mechanism. Instrument profiles require authentic adoption evidence from the competent institutions. Concrete deployments must supply those profiles, current control evidence, retained bytes, and provider mandates.