From 409002b1fbaa5be59de77fcf255096fc32d69e9b Mon Sep 17 00:00:00 2001 From: James Ross Date: Tue, 13 Oct 2026 01:40:13 -0700 Subject: [PATCH 1/7] docs: record participant history as a braid with site-scoped settlement Record the owner decision of 2026-10-13. History from another participant is held as a strand in a braid and is not merged on arrival. Interference leaves a recorded conflict on a bounded site. A conflict must be settled before anything acts on that site; work on other sites continues and a braid may stay plural elsewhere while its law allows. The page refines Continuum Transport, which already states what crosses the boundary and how an import is classified. It uses the vocabulary of the cross-project constitution (participant, receiving authority, four outcomes) and cites Observer Geometry II for the interference relation. Its current-implementation section states what exists: local strand settlement, suffix classification without import execution, braid events and per-tick footprint conflicts. It also states two gaps against the design: settlement blocks by suffix rather than by site, and an unsettled conflict stops nothing. Refs #798. Co-Authored-By: Claude Opus 5.5 --- CHANGELOG.md | 2 + docs/README.md | 1 + .../participant-history-as-a-braid.md | 194 ++++++++++++++++++ 3 files changed, 197 insertions(+) create mode 100644 docs/architecture/participant-history-as-a-braid.md diff --git a/CHANGELOG.md b/CHANGELOG.md index 998b054c..6165a887 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,6 +7,8 @@ ### Added +- `docs/architecture/participant-history-as-a-braid.md` records an accepted design that is not implemented: history from another participant is held as a strand in a braid, and a conflict must be settled before anything acts on the site it covers, while work elsewhere continues. The page states what local strand settlement does today, including that it blocks by suffix and that an unsettled conflict stops nothing. + - `submit_intents_with_runtime_wal_ack` accepts several intents and returns after one storage sync has made all of their acceptance transactions durable. Each intent writes the same acceptance transaction as a single submission, so recovery is unchanged. No acceptance of a batch counts as durable, or can be scheduled, before that sync succeeds. A failed batch acknowledges nothing. If the runtime refuses an intent before anything is written for it, the intents before it stay accepted and are synced. If an append or the sync fails, the call's intake is rolled back and the WAL refuses further work with `StorageFailed` until it is reopened. - `SlotWriteIndex` resolves the value of one node, edge or attachment slot at a tick cursor from tick patches and the initial boundary, without materializing a graph or replaying unrelated ticks. It indexes the operations that wrote each slot, including values cleared by node, edge and instance deletion, and truncates in proportion to the ticks removed. A reader is bound to the exact patches the index was built from by patch digest, and truncation refuses patches that are not the indexed suffix. It is a derived reading aid; the runtime does not use it yet. diff --git a/docs/README.md b/docs/README.md index ecbcc53d..d33d8555 100644 --- a/docs/README.md +++ b/docs/README.md @@ -20,6 +20,7 @@ causal history. Git history is the archive; GitHub owns live work and status. - [There Is No Graph](architecture/there-is-no-graph.md) - [Sliced readings and copy-on-write strands](architecture/sliced-readings-and-copy-on-write-strands.md) (accepted design, not implemented) +- [Participant history as a braid](architecture/participant-history-as-a-braid.md) (accepted design, not implemented) - [Continuum transport](architecture/continuum-transport.md) - [Echo optics adapter notes](architecture/echo-optics-adapter-notes.md) - [Echo × Keep physical content boundary](architecture/echo-keep-physical-content-boundary.md) diff --git a/docs/architecture/participant-history-as-a-braid.md b/docs/architecture/participant-history-as-a-braid.md new file mode 100644 index 00000000..29476d1c --- /dev/null +++ b/docs/architecture/participant-history-as-a-braid.md @@ -0,0 +1,194 @@ + + + +# Participant History as a Braid + +- **Status:** Accepted design. **Not implemented.** The section + [Current implementation](#current-implementation) states what the runtime + does today. +- **Decision date:** 2026-10-13 +- **Refines:** [Continuum Transport](continuum-transport.md), + [Strands and Braids](../topics/StrandsAndBraids.md), + [There Is No Graph](there-is-no-graph.md) +- **Related:** [Strand contract invariant](../invariants/STRAND-CONTRACT.md), + [Sliced readings and copy-on-write strands](sliced-readings-and-copy-on-write-strands.md), + [Kitten sessions and delegated authority](../topics/KittenSessionsAndDelegatedAuthority.md) + +## Decision + +History that arrives from another participant is held as a strand in a braid. +It is not merged into local history on arrival. + +Where that history and local history touch the same site, the result is a +recorded conflict. A conflict must be settled before anything acts on the site +it covers. Work on every other site continues, and a braid may stay plural +elsewhere for as long as its law allows. + +[Continuum Transport](continuum-transport.md) states what crosses the boundary +and how Echo classifies an import. This page states how Echo holds what +arrived, and what an unsettled conflict stops. + +## Terms + +- A **participant** is anything that takes an active part in witnessed + history: a person, an agent, an application, a service, a debugger or a + policy governor. The cross-project name is a _Kitten_. Participants are + sovereign. One is not a copy of another, so this page does not say + "replica". +- The **receiving authority** is the participant that judges an incoming + history under its own law. +- A **footprint** is what one tick consulted and changed. Its **use set** is + everything whose stability the tick depended on. +- A **site** is the bounded set of slots where two histories touch. +- A **settlement** is a recorded act of the receiving authority that decides + the result at a site. +- Every admission ends in one of four outcomes: **Derived**, **Plural**, + **Conflict** or **Obstruction**. Each is lawful and witnessed. Plural is a + result, not a failure. + +## The model + +1. A participant sends witnessed history, never state. The unit is the causal + suffix bundle of [Continuum Transport](continuum-transport.md). +2. The receiving authority weaves the incoming history into a braid as a + member strand. Nothing local changes at this step. +3. The receiving authority finds the common frontier: the latest history both + sides can justify. +4. It carries each incoming tick across its own history after that frontier, + in its own deterministic order. +5. If the incoming tick and a local tick are independent, the incoming tick + moves across. The outcome is Derived. +6. If they interfere, the outcome at that site is Conflict, or Plural when the + law allows both claims to stand. +7. If the evidence or the authority needed to judge is missing, the outcome is + Obstruction. + +Two ticks **interfere** when the writes or deletes of one touch the use set of +the other. This is stricter than two writes to one slot. A write to a slot +that the other tick only read is also interference. + +## The site rule + +A conflict covers a site. Until that site is settled: + +- the receiving authority admits no tick whose use set touches it; +- it carries no later incoming tick across it; and +- it refuses both with an obstruction that names the conflict. + +The unsettled site grows by dependence. If a later incoming tick is refused +because it uses the site, its own writes join the site. A tick that would have +read those writes cannot be judged either. + +Everything outside the site is unaffected. Independent incoming ticks continue +to arrive as Derived, and local ticks on other sites continue to commit. + +Plural follows the same rule with a different release. A site that holds +plural claims is not a single value, so a tick that needs a single value there +is refused. A tick whose law accepts plurality may still act. + +## Settlement + +- Only the receiving authority settles, and under its own law. A sender does + not settle its own history. +- A settlement names its bases, its participants and the site. It is part of + history, and it releases the site. +- A settlement may end in a derived value, in retained plurality, or in an + obstruction that stays on record. +- Collapsing a braid records that plural claims became one, and which law + decided it. +- Nothing is settled by arrival order, by host time, or by a hash of visible + state. + +## Laws + +1. **Arrival changes nothing.** Weaving a strand into a braid does not change + what any local reading returns. +2. **No silent winner.** Interference always leaves a recorded outcome. No + claim is dropped or overwritten without one. +3. **Conflict is scoped.** An unsettled conflict stops work on its site and + nowhere else. +4. **The site is closed under dependence.** Nothing that depends on an + unsettled site is admitted as if the site were settled. +5. **Settlement is an act.** It is admitted like any other topology-changing + operation, on explicit bases, and it leaves a receipt. +6. **Determinism.** Two receiving authorities with the same local history, the + same law and the same incoming bundle reach the same outcomes and the same + unsettled sites. +7. **Footprints must be trusted.** Independence is judged from footprints. A + footprint that omits something the tick used makes the judgement unsound, + so an incoming tick whose footprint cannot be trusted is obstructed. + +## Alternatives not chosen + +- **Every conflict blocks the whole worldline until it is resolved.** This is + simpler to reason about. One disagreement about one entity would then stop a + participant completely. +- **Automatic resolution by order or time.** A last-writer-wins rule erases a + claim without a witness, and host time is not part of history. +- **Exchange of state.** Two participants can reach the same visible state + with different provenance and intent. State alone cannot show a conflict + that was erased. + +## Open decisions + +- Which footprint is trusted for independence: the one a contract declares, + the one execution observed, or both. Issue #716 retains observed footprints. +- Whether a slot's reads and writes are enough, or whether deletes and + identity anchors must be recorded separately, as the use set requires. +- The default plural law. Today plurality is refused unless a policy allows + it. +- How a tick's law states that it accepts a plural site. +- Whether a settlement may be delegated, and what evidence the delegation + leaves. + +## Sources + +- James Ross, _Observer Geometry II: Distributed Observer Fields_, version + 0.9.0-rc.1, DOI `10.5281/zenodo.19873664`. It defines the witness-bearing + update, the common frontier, the footprint and use set, the interference + relation and suffix transport. It says "replica" where this page says + "participant". +- James Ross, _History Over State: A Reader's Constitution for Profunctor + Optics_ (2026). It defines the Kitten, the receiving authority's sole right + to settle, and the four-outcome algebra. + +Both are cited as the origin of the vocabulary and the rules. Neither is +evidence that Echo implements them. + +## Current implementation + +The runtime does not implement this design. It implements the local half. + +- `SettlementService` compares, plans and settles a strand into its base + worldline inside one runtime. A plan walks the strand's suffix in order and + gives each entry one decision: import candidate, conflict artifact or + plural alternative. Settlement appends those decisions to provenance and + can return a braid shell. +- **Blocking is by suffix, not by site.** After the first entry that ends in + conflict or plurality, every later entry of that suffix is recorded as a + conflict, whether or not it touches the same slots. The site rule above is + narrower. +- **An unsettled conflict stops nothing.** A recorded conflict artifact does + not prevent later ticks on the slots it names. No index of unsettled sites + exists, and the scheduler does not consult one. +- Overlap is judged from the `in_slots` and `out_slots` of tick patches + against the strand's owned closed footprint (INV-S10). Deletes and identity + anchors are not recorded separately. +- `PluralSettlementPolicy` refuses plurality by default and can allow it over + footprint overlap. `AdmissionOutcomeKind` carries the four outcomes. +- `export_suffix` and `import_suffix` build and classify a causal suffix + bundle as admitted, staged, plural, conflict or obstructed. They do not + append provenance or apply patches, and the module states that it is not + transport, remote synchronization or import execution. +- Braid events record creation, member weaving, settlement and collapse. No + code weaves a strand that came from another participant. +- Within one tick, an executable-operation Action whose footprint conflicts + with another's is refused with a typed footprint-conflict outcome. +- Planning a settlement applies each entry to a copy of the whole base state + and hashes the whole state. Executing one copies the runtime for rollback. + Both costs grow with the graph. +- Echo has no network transport. Continuum is the planned carrier. + +Implementation state is owned by +[issue #798](https://github.com/flyingrobots/echo/issues/798), not by this +page. From 52962d95730eda17a669acb70567137af5c01efc Mon Sep 17 00:00:00 2001 From: James Ross Date: Tue, 13 Oct 2026 01:41:29 -0700 Subject: [PATCH 2/7] docs: tighten independence, settlement authority and carriage in the braid page Apply review notes the owner supplied. Independent footprints make movement possible; they do not prove it. The law and the evidence must also hold before the outcome is Derived. A sender keeps authority over its own history. What it cannot do is decide the outcome for another participant. The earlier wording, that a sender does not settle its own history, was broader than the rule. A settlement names the conflict it answers. Plural queues nothing for later resolution. An obstruction names what was missing. Delivery, admission and outcome are separate facts, and carriage grants no authority to settle. Co-Authored-By: Claude Opus 5.5 --- .../participant-history-as-a-braid.md | 21 ++++++++++++++----- 1 file changed, 16 insertions(+), 5 deletions(-) diff --git a/docs/architecture/participant-history-as-a-braid.md b/docs/architecture/participant-history-as-a-braid.md index 29476d1c..531c1499 100644 --- a/docs/architecture/participant-history-as-a-braid.md +++ b/docs/architecture/participant-history-as-a-braid.md @@ -57,7 +57,10 @@ arrived, and what an unsettled conflict stops. 4. It carries each incoming tick across its own history after that frontier, in its own deterministic order. 5. If the incoming tick and a local tick are independent, the incoming tick - moves across. The outcome is Derived. + may move across. Independent footprints make that possible; they do not + prove it. The governing law and the evidence must also show that the tick + still means what its author meant on the new basis. Only then is the + outcome Derived. 6. If they interfere, the outcome at that site is Conflict, or Plural when the law allows both claims to stand. 7. If the evidence or the authority needed to judge is missing, the outcome is @@ -88,12 +91,16 @@ is refused. A tick whose law accepts plurality may still act. ## Settlement -- Only the receiving authority settles, and under its own law. A sender does - not settle its own history. -- A settlement names its bases, its participants and the site. It is part of - history, and it releases the site. +- Only the receiving authority settles what it receives, and under its own + law. A sender keeps its own authority over its own history. It cannot + decide the outcome for another participant. +- A settlement names its bases, its participants, the site and the conflict + it answers. It is new witnessed history, and it releases the site. - A settlement may end in a derived value, in retained plurality, or in an obstruction that stays on record. +- Plural needs no later resolution. Nothing queues it for collapse. +- An obstruction names the evidence or the authority that was missing, so a + later crossing can supply it. - Collapsing a braid records that plural claims became one, and which law decided it. - Nothing is settled by arrival order, by host time, or by a hash of visible @@ -117,6 +124,10 @@ is refused. A tick whose law accepts plurality may still act. 7. **Footprints must be trusted.** Independence is judged from footprints. A footprint that omits something the tick used makes the judgement unsound, so an incoming tick whose footprint cannot be trusted is obstructed. +8. **Carriage grants no authority.** Whatever delivers the history, and + whoever sent it, gains no right to settle. Delivery of the bytes, + admission of the strand and the outcome at a site are three separate + facts, and each is reported as itself. ## Alternatives not chosen From a13e198fa5cd6ca7a92f0f4a5576fd12398ccbac Mon Sep 17 00:00:00 2001 From: James Ross Date: Tue, 13 Oct 2026 09:11:46 -0700 Subject: [PATCH 3/7] Fix: make the braid design state what a conflict blocks and how it lifts Address seven review threads and an owner-supplied design review. The site rule contradicted itself and could not be implemented. It refused every tick that touched an unsettled site, which also refused the settlement that answers the conflict. It said later incoming ticks were not carried, which read as the suffix-wide blocking the design replaces. It said a settlement releases the site, including one that ends in obstruction. It let the intended writes of a refused tick enlarge the blocked site, so one submission that claimed to write everywhere could stop a receiver. The page now separates holding, judging and applying. A barrier refuses work whose validated dependencies meet an unsettled site. Settlement passes it by a path of its own. A held tick raises no barrier and is judged when the conflict is settled. What a settlement does to the barrier depends on its result. Also: the decision summary keeps the Plural outcome; interference is stated in both directions and covers write-write and absence; the common frontier is a set; a settlement planned on a basis that has moved is refused; determinism names authority, evidence, law version and limits among its inputs; the first law is limited to application readings. A worked trace is added. Decisions the design still needs are listed, and the status line says the design is not yet precise enough to implement. Remove the changelog entry. CHANGELOG.md is for shipped behaviour. Refs #798. Co-Authored-By: Claude Opus 5.5 --- CHANGELOG.md | 2 - .../participant-history-as-a-braid.md | 266 ++++++++++++------ 2 files changed, 181 insertions(+), 87 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 6165a887..998b054c 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,8 +7,6 @@ ### Added -- `docs/architecture/participant-history-as-a-braid.md` records an accepted design that is not implemented: history from another participant is held as a strand in a braid, and a conflict must be settled before anything acts on the site it covers, while work elsewhere continues. The page states what local strand settlement does today, including that it blocks by suffix and that an unsettled conflict stops nothing. - - `submit_intents_with_runtime_wal_ack` accepts several intents and returns after one storage sync has made all of their acceptance transactions durable. Each intent writes the same acceptance transaction as a single submission, so recovery is unchanged. No acceptance of a batch counts as durable, or can be scheduled, before that sync succeeds. A failed batch acknowledges nothing. If the runtime refuses an intent before anything is written for it, the intents before it stay accepted and are synced. If an append or the sync fails, the call's intake is rolled back and the WAL refuses further work with `StorageFailed` until it is reopened. - `SlotWriteIndex` resolves the value of one node, edge or attachment slot at a tick cursor from tick patches and the initial boundary, without materializing a graph or replaying unrelated ticks. It indexes the operations that wrote each slot, including values cleared by node, edge and instance deletion, and truncates in proportion to the ticks removed. A reader is bound to the exact patches the index was built from by patch digest, and truncation refuses patches that are not the indexed suffix. It is a derived reading aid; the runtime does not use it yet. diff --git a/docs/architecture/participant-history-as-a-braid.md b/docs/architecture/participant-history-as-a-braid.md index 531c1499..ad6563ac 100644 --- a/docs/architecture/participant-history-as-a-braid.md +++ b/docs/architecture/participant-history-as-a-braid.md @@ -3,7 +3,9 @@ # Participant History as a Braid -- **Status:** Accepted design. **Not implemented.** The section +- **Status:** Accepted design. **Not implemented**, and not yet precise enough + to implement without the decisions listed under + [Open decisions](#open-decisions). The section [Current implementation](#current-implementation) states what the runtime does today. - **Decision date:** 2026-10-13 @@ -19,10 +21,10 @@ History that arrives from another participant is held as a strand in a braid. It is not merged into local history on arrival. -Where that history and local history touch the same site, the result is a -recorded conflict. A conflict must be settled before anything acts on the site -it covers. Work on every other site continues, and a braid may stay plural -elsewhere for as long as its law allows. +Where that history and local history interfere, the receiving authority +records an outcome at the site they share: Conflict, or Plural when its law +lets both claims stand. Until a conflict is settled, nothing that depends on +it is admitted. Work that does not depend on it continues. [Continuum Transport](continuum-transport.md) states what crosses the boundary and how Echo classifies an import. This page states how Echo holds what @@ -37,57 +39,101 @@ arrived, and what an unsettled conflict stops. "replica". - The **receiving authority** is the participant that judges an incoming history under its own law. -- A **footprint** is what one tick consulted and changed. Its **use set** is - everything whose stability the tick depended on. -- A **site** is the bounded set of slots where two histories touch. -- A **settlement** is a recorded act of the receiving authority that decides - the result at a site. +- A **footprint** is what one tick consulted and changed: its reads, writes, + deletes and the identities it needs to stay fixed. Its **use set** is its + reads, its writes and those identities: everything whose stability the tick + depended on. A write target is in the use set. +- A **site** is the bounded set of slots where two histories interfere. +- A **barrier** is the admission rule that an unsettled site imposes. +- A **settlement** is a recorded act of the receiving authority that answers + a conflict. - Every admission ends in one of four outcomes: **Derived**, **Plural**, **Conflict** or **Obstruction**. Each is lawful and witnessed. Plural is a result, not a failure. -## The model +## Three separate steps + +Holding, judging and applying are different acts. An implementation may run +them together. Their meanings stay distinct. + +1. **Hold.** The receiving authority weaves the incoming history into a braid + as a member strand. Braid membership changes. No reading of application + state changes, and nothing becomes inadmissible. +2. **Judge.** The receiving authority carries each incoming tick across its + own history and records an outcome. Judging changes no reading of + application state. It can raise a barrier. +3. **Apply.** A Derived result becomes part of the receiving worldline only + through a witnessed commit on an explicit basis. Readings of application + state change at this step and at no other. + +## Judging 1. A participant sends witnessed history, never state. The unit is the causal suffix bundle of [Continuum Transport](continuum-transport.md). -2. The receiving authority weaves the incoming history into a braid as a - member strand. Nothing local changes at this step. -3. The receiving authority finds the common frontier: the latest history both - sides can justify. -4. It carries each incoming tick across its own history after that frontier, +2. The receiving authority finds the common frontier: the set of latest + events that both sides can justify. It is a set, because two histories can + share several points that are not ordered against each other. If the + receiver cannot justify any common basis it trusts, the outcome is + Obstruction. +3. It carries each incoming tick across its own history after that frontier, in its own deterministic order. -5. If the incoming tick and a local tick are independent, the incoming tick +4. If the incoming tick and a local tick do not interfere, the incoming tick may move across. Independent footprints make that possible; they do not prove it. The governing law and the evidence must also show that the tick still means what its author meant on the new basis. Only then is the outcome Derived. -6. If they interfere, the outcome at that site is Conflict, or Plural when the - law allows both claims to stand. -7. If the evidence or the authority needed to judge is missing, the outcome is - Obstruction. - -Two ticks **interfere** when the writes or deletes of one touch the use set of -the other. This is stricter than two writes to one slot. A write to a slot -that the other tick only read is also interference. - -## The site rule - -A conflict covers a site. Until that site is settled: - -- the receiving authority admits no tick whose use set touches it; -- it carries no later incoming tick across it; and -- it refuses both with an obstruction that names the conflict. - -The unsettled site grows by dependence. If a later incoming tick is refused -because it uses the site, its own writes join the site. A tick that would have -read those writes cannot be judged either. - -Everything outside the site is unaffected. Independent incoming ticks continue -to arrive as Derived, and local ticks on other sites continue to commit. - -Plural follows the same rule with a different release. A site that holds -plural claims is not a single value, so a tick that needs a single value there -is refused. A tick whose law accepts plurality may still act. +5. If they interfere, the outcome at that site is Conflict, or Plural when the + law lets both claims stand. +6. If the evidence or the authority needed to judge is missing, the outcome is + Obstruction. It names what was missing. + +Two ticks **interfere** when the writes or deletes of one meet the use set of +the other, in either direction. Two writes to one slot interfere, because a +write target is in the use set. A write to a slot that the other tick only +read also interferes. + +A footprint must cover what the tick depended on, including what it found +absent. A tick that acted because a query matched nothing depends on that +absence. So does one that depended on the bounds of a range or on membership +of a collection. + +## The barrier + +An unsettled conflict covers a site and raises a barrier there. + +**What the barrier refuses.** A tick whose use set meets the site is not +admitted. The refusal is an obstruction that names the conflict. + +**Settlement is not refused.** The act that answers the conflict has to +address the site. It passes the barrier by a narrow path of its own: it names +the conflict, its basis and its authority, and it is checked against changes +made since it was planned. + +**What happens to later incoming ticks.** An incoming tick that depends on a +blocked incoming tick is held and not judged. Its dependence must be shown by +validated causal evidence in the held strand, not inferred from a footprint +that a sender merely claimed. + +**What a held tick does not block.** A held tick has produced no writes. Its +intended writes raise no barrier against local work or against unrelated +incoming work. They are potential outputs of blocked work, and the receiving +authority may report them as such. When the conflict is settled, each held +tick is judged then, against the history of that moment. If it interferes +with something admitted in the meantime, that is a new outcome at a new site. + +This matters for safety. If intended writes raised barriers, a participant +could send one tick that reads a disputed slot and claims to write everywhere, +and so stop the receiver completely. + +**What stays admissible.** Work whose validated dependencies do not meet an +unsettled site stays admissible. This is a conditional promise. A dependency +that is truly global can lawfully block global work. The receiving authority +must then be able to show why the blockage is that wide. + +Plural raises a different barrier. A site that holds plural claims is not a +single value. A tick that needs a single value there is refused. A tick whose +law accepts that plurality, and whose effects are safe under each claim, may +act. ## Settlement @@ -95,45 +141,78 @@ is refused. A tick whose law accepts plurality may still act. law. A sender keeps its own authority over its own history. It cannot decide the outcome for another participant. - A settlement names its bases, its participants, the site and the conflict - it answers. It is new witnessed history, and it releases the site. -- A settlement may end in a derived value, in retained plurality, or in an - obstruction that stays on record. + it answers. It is new witnessed history. It changes neither participant's + past: each author's claim stays on record as that author made it. +- A settlement is planned against a basis. If that basis has moved when the + settlement is committed, the commit is refused with an obstruction, and the + settlement is planned again. +- Dependent work never resumes on its old readings. It is judged again. - Plural needs no later resolution. Nothing queues it for collapse. -- An obstruction names the evidence or the authority that was missing, so a - later crossing can supply it. - Collapsing a braid records that plural claims became one, and which law decided it. - Nothing is settled by arrival order, by host time, or by a hash of visible state. +What a settlement does to the barrier depends on its result: + +| Result | Admission afterwards | +| -------------------- | -------------------------------------------------------------------------------- | +| Derived value | The barrier is lifted. Dependent work is judged again, against the new basis. | +| Retained plurality | Only work whose law accepts that plurality is admitted. | +| Retained obstruction | The barrier stays. The obstruction names the conditions under which it can lift. | + ## Laws -1. **Arrival changes nothing.** Weaving a strand into a braid does not change - what any local reading returns. +1. **Holding changes no application reading.** Weaving a strand into a braid + changes braid membership and nothing else. 2. **No silent winner.** Interference always leaves a recorded outcome. No claim is dropped or overwritten without one. -3. **Conflict is scoped.** An unsettled conflict stops work on its site and - nowhere else. -4. **The site is closed under dependence.** Nothing that depends on an - unsettled site is admitted as if the site were settled. -5. **Settlement is an act.** It is admitted like any other topology-changing - operation, on explicit bases, and it leaves a receipt. -6. **Determinism.** Two receiving authorities with the same local history, the - same law and the same incoming bundle reach the same outcomes and the same - unsettled sites. -7. **Footprints must be trusted.** Independence is judged from footprints. A - footprint that omits something the tick used makes the judgement unsound, - so an incoming tick whose footprint cannot be trusted is obstructed. -8. **Carriage grants no authority.** Whatever delivers the history, and +3. **Every admitted effect has a justified basis.** That basis includes the + absence of unsettled dependencies, or their explicit acceptance under a + law that allows it. +4. **A barrier is scoped by validated dependence.** It refuses work that + depends on its site, and it must be able to say why. +5. **Only admitted history enlarges a barrier.** A submission that was + refused or is held enlarges none. +6. **Settlement is an act.** It is admitted on explicit bases through its own + path, and it leaves a receipt. +7. **Determinism.** Two receiving authorities reach the same outcomes and the + same barriers when all of these are equal: their local history, including + braid members and unsettled outcomes; the incoming bundle; the law, by + exact identity and version; the authority and delegation evidence they + hold; and every budget or limit that can change a classification. +8. **Footprints must be trusted.** A footprint that omits something the tick + used makes the judgement unsound, so an incoming tick whose footprint + cannot be trusted is obstructed. +9. **Carriage grants no authority.** Whatever delivers the history, and whoever sent it, gains no right to settle. Delivery of the bytes, admission of the strand and the outcome at a site are three separate facts, and each is reported as itself. +## A worked trace + +Participant A holds local history. Participant B sends a strand of three +ticks, made on a basis both share. + +| Step | Event | Result at A | +| ---- | ----------------------------------------------- | ---------------------------------------------------------------------- | +| 1 | B's strand arrives | Held. Braid membership changes. No application reading changes. | +| 2 | B1 writes slot X. A already wrote X locally | Conflict at site {X}. A barrier is raised on X. | +| 3 | B2 writes slot Y. Nothing at A touches Y | Derived. B2 is applied by a witnessed commit. | +| 4 | B3 read X as B1 left it, and writes slot Z | Held. Its dependence on B1 is in the strand's own evidence. | +| 5 | A's next local tick writes Z | Admitted. B3's intended write to Z raises no barrier. | +| 6 | A's next local tick reads X | Refused with an obstruction that names the conflict. | +| 7 | A settles the conflict to a derived value of X | The barrier on X is lifted. The settlement is new history. | +| 8 | B3 is judged now | It meets A's write to Z from step 5. A new outcome is recorded at {Z}. | +| 9 | The refused tick from step 6 is submitted again | Judged against the new basis, and admitted if nothing else stops it. | + ## Alternatives not chosen - **Every conflict blocks the whole worldline until it is resolved.** This is simpler to reason about. One disagreement about one entity would then stop a participant completely. +- **Intended writes of held ticks raise barriers.** This looks like the safe + reading of dependence. It lets a sender widen a receiver's barriers at will. - **Automatic resolution by order or time.** A last-writer-wins rule erases a claim without a witness, and host time is not part of history. - **Exchange of state.** Two participants can reach the same visible state @@ -142,23 +221,37 @@ is refused. A tick whose law accepts plurality may still act. ## Open decisions -- Which footprint is trusted for independence: the one a contract declares, - the one execution observed, or both. Issue #716 retains observed footprints. -- Whether a slot's reads and writes are enough, or whether deletes and - identity anchors must be recorded separately, as the use set requires. -- The default plural law. Today plurality is refused unless a policy allows - it. -- How a tick's law states that it accepts a plural site. -- Whether a settlement may be delegated, and what evidence the delegation - leaves. +These must be settled before the design can be implemented. + +- **Footprint trust as a proof obligation.** A contract's declared bounds, + the accesses that execution observed, and the receiver's own verification + do different jobs. The rule that combines them is not written. Issue #716 + retains observed footprints. +- **What a footprint must record.** Whether slot reads and writes are enough, + or whether deletes, identity anchors, absence, ranges and collection + membership need their own entries. +- **Overlapping conflicts.** Whether the sites of two conflicts combine or + keep separate identities, and whether one can be settled without the other. +- **Partial settlement.** Whether part of a site can be settled when the law + proves that part independent. +- **Retries.** How a repeated delivery is recognized so that it creates no + second claim, and how newly supplied evidence is linked to the obstruction + it answers. +- **Accepting plurality.** How a tick's law states that it accepts a plural + site, and how its effects are shown safe under each claim. An effect that + leaves Echo is not made safe by plurality alone. +- **The default plural law.** Today plurality is refused unless a policy + allows it. +- **Delegation.** Whether a settlement may be delegated, and what evidence + the delegation leaves. ## Sources - James Ross, _Observer Geometry II: Distributed Observer Fields_, version 0.9.0-rc.1, DOI `10.5281/zenodo.19873664`. It defines the witness-bearing - update, the common frontier, the footprint and use set, the interference - relation and suffix transport. It says "replica" where this page says - "participant". + update, the common frontier as an antichain, the footprint and use set, the + interference relation and suffix transport. It says "replica" where this + page says "participant". - James Ross, _History Over State: A Reader's Constitution for Profunctor Optics_ (2026). It defines the Kitten, the receiving authority's sole right to settle, and the four-outcome algebra. @@ -175,16 +268,19 @@ The runtime does not implement this design. It implements the local half. gives each entry one decision: import candidate, conflict artifact or plural alternative. Settlement appends those decisions to provenance and can return a braid shell. -- **Blocking is by suffix, not by site.** After the first entry that ends in - conflict or plurality, every later entry of that suffix is recorded as a - conflict, whether or not it touches the same slots. The site rule above is - narrower. -- **An unsettled conflict stops nothing.** A recorded conflict artifact does - not prevent later ticks on the slots it names. No index of unsettled sites - exists, and the scheduler does not consult one. +- **Blocking is by suffix, not by dependence.** After the first entry that + ends in conflict or plurality, every later entry of that suffix is recorded + as a conflict, whether or not it depends on the first. +- **An unsettled conflict raises no barrier.** A recorded conflict artifact + does not prevent later ticks on the slots it names. No index of unsettled + sites exists, and the scheduler does not consult settlement results. +- **Holding, judging and applying are not separate.** Planning judges, and + settling applies and records in one call. +- No act answers a recorded conflict later. A conflict artifact stays as + residue. - Overlap is judged from the `in_slots` and `out_slots` of tick patches - against the strand's owned closed footprint (INV-S10). Deletes and identity - anchors are not recorded separately. + against the strand's owned closed footprint (INV-S10). Deletes, identity + anchors, absence and ranges are not recorded separately. - `PluralSettlementPolicy` refuses plurality by default and can allow it over footprint overlap. `AdmissionOutcomeKind` carries the four outcomes. - `export_suffix` and `import_suffix` build and classify a causal suffix From f741bfde6660278a112aa9751e2ca9635846eed8 Mon Sep 17 00:00:00 2001 From: James Ross Date: Tue, 13 Oct 2026 09:19:56 -0700 Subject: [PATCH 4/7] Fix: cover deletes, settlement conflict and a set-valued basis in the braid design Address review. A tick that only deletes a slot in an unsettled site was not refused, because delete targets are outside the use set. The settlement table did not say what a settlement that itself ends in conflict does to the barrier. The page calls the common frontier a set while the suffix bundle names each frontier as one coordinate; state that gap and list it as an open decision. Refs #798. Co-Authored-By: Claude Opus 5.5 --- .../participant-history-as-a-braid.md | 20 ++++++++++++------- 1 file changed, 13 insertions(+), 7 deletions(-) diff --git a/docs/architecture/participant-history-as-a-braid.md b/docs/architecture/participant-history-as-a-braid.md index ad6563ac..2437fe3c 100644 --- a/docs/architecture/participant-history-as-a-braid.md +++ b/docs/architecture/participant-history-as-a-braid.md @@ -101,8 +101,8 @@ of a collection. An unsettled conflict covers a site and raises a barrier there. -**What the barrier refuses.** A tick whose use set meets the site is not -admitted. The refusal is an obstruction that names the conflict. +**What the barrier refuses.** A tick is not admitted if its use set or its +deletes meet the site. The refusal is an obstruction that names the conflict. **Settlement is not refused.** The act that answers the conflict has to address the site. It passes the barrier by a narrow path of its own: it names @@ -155,11 +155,12 @@ act. What a settlement does to the barrier depends on its result: -| Result | Admission afterwards | -| -------------------- | -------------------------------------------------------------------------------- | -| Derived value | The barrier is lifted. Dependent work is judged again, against the new basis. | -| Retained plurality | Only work whose law accepts that plurality is admitted. | -| Retained obstruction | The barrier stays. The obstruction names the conditions under which it can lift. | +| Result | Admission afterwards | +| -------------------- | ------------------------------------------------------------------------------------- | +| Derived value | The barrier is lifted. Dependent work is judged again, against the new basis. | +| Retained plurality | Only work whose law accepts that plurality is admitted. | +| Conflict | The barrier stays, on the site the new conflict names. A later settlement answers it. | +| Retained obstruction | The barrier stays. The obstruction names the conditions under which it can lift. | ## Laws @@ -230,6 +231,8 @@ These must be settled before the design can be implemented. - **What a footprint must record.** Whether slot reads and writes are enough, or whether deletes, identity anchors, absence, ranges and collection membership need their own entries. +- **A set-valued basis.** The common frontier can be several unordered + events. The transport artifact must be able to name all of them. - **Overlapping conflicts.** Whether the sites of two conflicts combine or keep separate identities, and whether one can be settled without the other. - **Partial settlement.** Whether part of a site can be settled when the law @@ -287,6 +290,9 @@ The runtime does not implement this design. It implements the local half. bundle as admitted, staged, plural, conflict or obstructed. They do not append provenance or apply patches, and the module states that it is not transport, remote synchronization or import execution. +- A `CausalSuffixBundle` names its base frontier and its target frontier as + one provenance coordinate each. It cannot carry a common frontier of + several unordered events. - Braid events record creation, member weaving, settlement and collapse. No code weaves a strand that came from another participant. - Within one tick, an executable-operation Action whose footprint conflicts From ef782a5c6f3a40ab92ba7d8a2c64c1d4f725fb91 Mon Sep 17 00:00:00 2001 From: James Ross Date: Tue, 13 Oct 2026 09:27:10 -0700 Subject: [PATCH 5/7] Fix: define Staged as the posture before judgement in the braid design Address review. The page said every admission ends in one of four outcomes, which left the Staged posture that suffix admission already returns outside the design. Staged is history that is held and not yet judged; the four outcomes are results of judging. Refs #798. Co-Authored-By: Claude Opus 5.5 --- docs/architecture/participant-history-as-a-braid.md | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/docs/architecture/participant-history-as-a-braid.md b/docs/architecture/participant-history-as-a-braid.md index 2437fe3c..3db304d3 100644 --- a/docs/architecture/participant-history-as-a-braid.md +++ b/docs/architecture/participant-history-as-a-braid.md @@ -47,9 +47,12 @@ arrived, and what an unsettled conflict stops. - A **barrier** is the admission rule that an unsettled site imposes. - A **settlement** is a recorded act of the receiving authority that answers a conflict. -- Every admission ends in one of four outcomes: **Derived**, **Plural**, +- Every judgement ends in one of four outcomes: **Derived**, **Plural**, **Conflict** or **Obstruction**. Each is lawful and witnessed. Plural is a result, not a failure. +- **Staged** is not a fifth outcome. It is the posture of history that is + held and not yet judged. It comes before the four outcomes and is reported + as itself, never as Obstruction. ## Three separate steps @@ -58,7 +61,8 @@ them together. Their meanings stay distinct. 1. **Hold.** The receiving authority weaves the incoming history into a braid as a member strand. Braid membership changes. No reading of application - state changes, and nothing becomes inadmissible. + state changes, and nothing becomes inadmissible. History that is held and + not yet judged is Staged. 2. **Judge.** The receiving authority carries each incoming tick across its own history and records an outcome. Judging changes no reading of application state. It can raise a barrier. @@ -110,7 +114,7 @@ the conflict, its basis and its authority, and it is checked against changes made since it was planned. **What happens to later incoming ticks.** An incoming tick that depends on a -blocked incoming tick is held and not judged. Its dependence must be shown by +blocked incoming tick is held and not judged. It stays Staged. Its dependence must be shown by validated causal evidence in the held strand, not inferred from a footprint that a sender merely claimed. From b8e2c028001ab0ea9767c476144616c461c49adf Mon Sep 17 00:00:00 2001 From: James Ross Date: Tue, 13 Oct 2026 10:48:30 -0700 Subject: [PATCH 6/7] docs: state when a barrier starts, why a stale settlement is refused, and that footprints are checked for completeness Record three clarifications to the confirmed design choices. A barrier exists from the moment a conflict is judged; holding raises none. A settlement refused for a stale basis records that reason, and a new plan is a new settlement with its own authorization. Authentic causal history does not prove a footprint complete. Refs #798. Co-Authored-By: Claude Opus 5.5 --- docs/architecture/participant-history-as-a-braid.md | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/docs/architecture/participant-history-as-a-braid.md b/docs/architecture/participant-history-as-a-braid.md index 3db304d3..124add0d 100644 --- a/docs/architecture/participant-history-as-a-braid.md +++ b/docs/architecture/participant-history-as-a-braid.md @@ -103,7 +103,9 @@ of a collection. ## The barrier -An unsettled conflict covers a site and raises a barrier there. +An unsettled conflict covers a site and raises a barrier there. The barrier +exists from the moment the conflict is judged. Holding a tick raises none; +judging it as Conflict raises one at once. **What the barrier refuses.** A tick is not admitted if its use set or its deletes meet the site. The refusal is an obstruction that names the conflict. @@ -148,8 +150,10 @@ act. it answers. It is new witnessed history. It changes neither participant's past: each author's claim stays on record as that author made it. - A settlement is planned against a basis. If that basis has moved when the - settlement is committed, the commit is refused with an obstruction, and the - settlement is planned again. + settlement is committed, the commit is refused with an obstruction that + records the stale basis as its reason. A new plan is a new settlement and + needs its own authorization. An authorized settlement is never altered to + fit a basis it was not planned on. - Dependent work never resumes on its old readings. It is judged again. - Plural needs no later resolution. Nothing queues it for collapse. - Collapsing a braid records that plural claims became one, and which law @@ -188,7 +192,8 @@ What a settlement does to the barrier depends on its result: hold; and every budget or limit that can change a classification. 8. **Footprints must be trusted.** A footprint that omits something the tick used makes the judgement unsound, so an incoming tick whose footprint - cannot be trusted is obstructed. + cannot be trusted is obstructed. Authentic causal history does not prove + a footprint complete. Completeness is checked separately. 9. **Carriage grants no authority.** Whatever delivers the history, and whoever sent it, gains no right to settle. Delivery of the bytes, admission of the strand and the outcome at a site are three separate From 25a5af3baacf6a03cdc8b018920bda0cb2b10003 Mon Sep 17 00:00:00 2001 From: James Ross Date: Tue, 13 Oct 2026 10:58:07 -0700 Subject: [PATCH 7/7] Fix: close four gaps between the braid design and the suffix boundary Address review. Derived now requires that the tick interfere with no local tick it is carried across, so one tick cannot be both Derived and in conflict. Held history is retained while a claim or conflict depends on it; today a strand is scoped to its session, and that gap is stated. An exact repeat of a bundle is recognized by its identity, as Continuum Transport already requires; only retries with new evidence stay open. The page states that an admission response carries one outcome per bundle and lists a per-tick outcome artifact as an open decision. Refs #798. Co-Authored-By: Claude Opus 5.5 --- .../participant-history-as-a-braid.md | 32 ++++++++++++++----- 1 file changed, 24 insertions(+), 8 deletions(-) diff --git a/docs/architecture/participant-history-as-a-braid.md b/docs/architecture/participant-history-as-a-braid.md index 124add0d..9944aeff 100644 --- a/docs/architecture/participant-history-as-a-braid.md +++ b/docs/architecture/participant-history-as-a-braid.md @@ -62,7 +62,9 @@ them together. Their meanings stay distinct. 1. **Hold.** The receiving authority weaves the incoming history into a braid as a member strand. Braid membership changes. No reading of application state changes, and nothing becomes inadmissible. History that is held and - not yet judged is Staged. + not yet judged is Staged. Held history and its evidence are retained for + as long as a claim or a conflict depends on them. They do not end with the + session that received them. 2. **Judge.** The receiving authority carries each incoming tick across its own history and records an outcome. Judging changes no reading of application state. It can raise a barrier. @@ -81,13 +83,14 @@ them together. Their meanings stay distinct. Obstruction. 3. It carries each incoming tick across its own history after that frontier, in its own deterministic order. -4. If the incoming tick and a local tick do not interfere, the incoming tick - may move across. Independent footprints make that possible; they do not +4. If the incoming tick interferes with no local tick it is carried across, + it may move across. Independent footprints make that possible; they do not prove it. The governing law and the evidence must also show that the tick still means what its author meant on the new basis. Only then is the outcome Derived. -5. If they interfere, the outcome at that site is Conflict, or Plural when the - law lets both claims stand. +5. If it interferes with any of them, the outcome at that site is Conflict, or + Plural when the law lets both claims stand. A tick is never both Derived + and in conflict. 6. If the evidence or the authority needed to judge is missing, the outcome is Obstruction. It names what was missing. @@ -246,9 +249,17 @@ These must be settled before the design can be implemented. keep separate identities, and whether one can be settled without the other. - **Partial settlement.** Whether part of a site can be settled when the law proves that part independent. -- **Retries.** How a repeated delivery is recognized so that it creates no - second claim, and how newly supplied evidence is linked to the obstruction - it answers. +- **A durable carrier for held history.** A strand is scoped to a session + today. Held history needs a retained carrier that outlives the session, or + the strand lifecycle must be refined. +- **Outcomes for part of a bundle.** One bundle can hold ticks that end + Derived, in Conflict and Staged. The boundary needs an artifact that + reports an outcome for each. +- **Retries with new evidence.** An exact repeat of a bundle is the same + question again: it is recognized by the bundle's identity, it weaves no + second member, and it returns the retained outcome. + [Continuum Transport](continuum-transport.md) already requires that. Open + is how newly supplied evidence is linked to the obstruction it answers. - **Accepting plurality.** How a tick's law states that it accepts a plural site, and how its effects are shown safe under each claim. An effect that leaves Echo is not made safe by plurality alone. @@ -302,6 +313,11 @@ The runtime does not implement this design. It implements the local half. - A `CausalSuffixBundle` names its base frontier and its target frontier as one provenance coordinate each. It cannot carry a common frontier of several unordered events. +- An admission response carries one outcome for the whole bundle. It cannot + report different outcomes for different ticks. +- A strand is scoped to its session (INV-S3), and dropping it removes its + worldline and provenance (INV-S11). Nothing retains a received strand + beyond the session. - Braid events record creation, member weaving, settlement and collapse. No code weaves a strand that came from another participant. - Within one tick, an executable-operation Action whose footprint conflicts