[MACHINE-SPIRIT 5/8] Durable world-model architecture: event sourcing, append-only semantics, incremental inference, identity and ontology evolution #396
Labels
No labels
bug
documentation
duplicate
enhancement
good first issue
help wanted
invalid
question
wontfix
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
nsaspy/prolog-rlm#396
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Parent: #397
Related: #388 #392 #394
Downstream: symbolic-memory#4 #6 #10
Distinct research mandate
Treat persistence and evolving world models as the primary problem: event sourcing, bitemporal data, append-only ledgers, materialized views, incremental/differential computation, dependency-directed invalidation, provenance indexing, entity/ontology evolution, scalable log/index storage, integrity, redaction, governed retention and federation.
Four-subpass status — DESIGN-COMPLETE
A — BSLPF: COMPLETE
Bitemporal Semantic Ledger + Projection Fabric establishes immutable/versioned semantic objects, an authoritative append-only bitemporal semantic ledger, atomic/idempotent commits, exact local frontiers, crash/replay semantics, reversible identity/schema/ontology mappings and rebuildable projections/checkpoints/indexes.
Hard distinction:
Valid time and transaction/knowledge time remain independent. Current/support/warrant/entity/procedure/retrieval indexes are rebuildable views, never canonical truth. Full A research and A1-A24 fixtures are preserved in the #402A comment.
B — GRIE: COMPLETE
Governed Redaction & Integrity Envelope corrects the naive assumption that append-only history implies permanent payload retrievability.
GRIE separates correction, withdrawal, invalidation, quarantine, archive, access revocation, redaction, cryptographic erase and physical purge; adds authenticated admission receipts, explicit sanitization states, replay capability classes, schema/upcaster interpretation lineage, duplicate/corroboration/dependence taxonomy, fail-closed projections, canonical-ledger integrity failure/recovery lineage, privacy-scoped content commitments and shared provenance DAGs. Full B mechanisms and B1-B30 fixtures are preserved in #402B.
C — CLFM: COMPLETE
Causal Ledger Federation Mesh keeps independent ledgers as separate authority/order/retention/integrity domains.
Hard distinctions include:
Cross-ledger causality comes only from evidence-backed references/import observations/checkpoint ancestry. Federation cuts name exact per-ledger frontiers/checkpoints and mapping/admission/redaction/integrity generations. Replica groups cannot manufacture independent corroboration; divergent single-ledger ancestry is an integrity/fork conflict. External PROV/SCITT-style material interoperates through typed loss-aware adapters. Full C design and C1-C34 fixtures are preserved in #402C.
D — SAFIRE: COMPLETE
Adopt SAFIRE — Sparse Append-only Frontier & Incremental Replay Engine as the computational realization of BSLPF + GRIE + CLFM.
D establishes:
exact,lagging,stale_dependency,rebuilding,integrity_blocked, etc.) carrying requested/materialized cuts;single_writer_local,consensus_replica_group,optimistic_replica_group, andmirror/archiveprofiles;resource_limited/lag/integrity failure instead of implicit LLM fallback.Primary D evidence includes O'Neil et al. 1996 LSM-trees, Bigtable 2006, Dynamo 2007, DVV 2010/2011, Interval Tree Clocks 2008, Raft 2014, Differential Dataflow 2013, DBSP 2023 and Scalable Bloom Filters 2007. Full algorithms, candidate architectures, complexity analysis, typed APIs, rejected shortcuts and D1-D40 falsifiable fixtures are preserved in the #402D comment.
Reconciled Depth-5 architecture
Repository boundary
symbolic-memoryowns physical/logical storage adapters, segments/checkpoints/frontiers, replica/anti-entropy profiles, CLFM persistence/cuts, GRIE redaction maintenance, projection freshness/invalidation, scalable indexes/cursors and storage failure-injection conformance.prolog-rlmowns #392 semantic meaning/schema/profile identity, #394 reasoning/epistemic semantics, #395 semantic conformance and DPEC procedural execution semantics. Dependency remainssymbolic-memory -> prolog-rlm; SAFIRE is neither a new reasoner nor a second plan scheduler.Design-completion boundary
Depth 5 is design-complete only. The current whole-snapshot
symbolic_memory_storage.plbackend does not implement SAFIRE. No claim of billion-record performance, anti-entropy correctness, distributed serializability, remote sanitization, deterministic crash recovery, or Machine Spirit acceptance follows from this design prose.Unresolved implementation inputs
Advance rule
A/B/C/D are complete and reconciled. This issue may close as
completedfor design completion only.Exact next research work: Depth 6 / #403A — retrieval / symbolic-attention foundations.
Do not start #403B/C/D until #403A is durably complete.
Machine Spirit program progression
Depth 4 / #401 A-B-C-D is now durably design-complete and reconciled. This issue is therefore the first incomplete numbered depth.
Exact next research subpass: #402A — foundations / representative formalisms only.
Do not execute #402B/C/D in the same research run. #402A should independently compare durable world-model/storage foundations (event sourcing, bitemporal/append-only ledgers, authoritative history vs rebuildable materialized views, incremental/differential derivation state, provenance indexes, crash/replay/idempotency, reversible identity/schema/ontology evolution) before later adversarial/composition/computational subpasses attack it.
This comment marks queue progression only; #402A is not yet complete.
#402A — foundations / representative formalisms — COMPLETE
Scope / research questions
This A subpass treats the durable world model itself as the primary design problem. It asks:
Current-repo comparison
The current architecture already points toward append-only semantics:
valid_atvsknown_at, and rebuildable warrant/query caches.But the current
symbolic_memory_storage.plimplementation is materially weaker than that contract: a mutation runs under one process-wide mutex, snapshots all dynamic state, serializes the wholesnapshot(...)term to a temporary file, and renames that file over the previous snapshot. That is a fine bootstrap persistence implementation, but it is not the durable semantic world-model architecture and cannot be treated as such at scale.There is also a useful historical disagreement to preserve:
research/SYMBOLIC-MEMORY-RESEARCH-006-persistence-and-concurrency.org(2026-08-29) explicitly did not require full event sourcing for v1 and favored a replaceable storage adapter withlibrary(persistency), SQLite, or RocksDB candidates. The new semantic/epistemic/procedural contracts created by #398-#401 materially strengthen the requirement: an audit side-log plus mutable current snapshot is no longer sufficient to reconstruct all accepted lifecycle, bitemporal, identity, provenance and replay semantics. The old research remains valuable backend/bootstrap evidence; this A pass supersedes only its assumption that full replayable semantic history can be optional at the world-model contract layer.Primary evidence
Representative primary/authoritative sources used in this subpass:
These sources do not imply one required physical database. They establish useful semantics and mechanisms that the logical storage contract can adopt independently of backend choice.
Candidate architectures
Candidate 1 — mutable snapshot + append-only audit side-log
This is closest to the current bootstrap implementation and old Research-006 direction.
Strengths
Fatal weakness as canonical architecture
The audit log can drift into “debug metadata” rather than the complete reconstruction authority. If a lifecycle edge, source dependence, identity mapping, correction, projection-generation change or promoted derivation receipt is represented only by mutation of the snapshot, historical semantics become unrecoverable. A snapshot + incomplete audit is not event sourcing and cannot satisfy exact historical epistemic replay.
Rejected as the canonical world-model contract. It remains valid as a bootstrap/materialized-view implementation beneath a stronger contract.
Candidate 2 — pure event-sourced semantic store
Strengths
Weaknesses
Viable but not preferred.
Candidate 3 — immutable semantic object store + authoritative bitemporal ledger + rebuildable projections (preferred)
This architecture combines immutable-database/event-sourcing strengths without making semantic payload identity equal to event identity.
Preferred name for the A-level architecture:
Bitemporal Semantic Ledger + Projection Fabric (BSLPF).Core distinctions — hard
Example: two sources independently assert the exact same structural proposition
P.Pmay have one structural proposition fingerprint under one #392 vocabulary/schema generation;A content hash therefore must not be the universal event ID. Identical payload does not imply the same occurrence.
Preferred typed model
Conceptual only; exact representation follows repository conventions.
Representative event classes include:
The list is not an executable open event vocabulary: event envelope kinds must be closed/versioned enough to protect replay semantics. Domain semantic vocabulary remains open inside #392 objects.
Bitemporal contract
Machine Spirit requires at least two independent axes:
Therefore:
and:
are different queries.
A correction received in February may assert that
Pwas false throughout January. It can alter the current view of January-valid truth without rewriting the January transaction-time history. The February event remains visibly later in the ledger.CommitTimemust not rely on wall clock as the sole ordering primitive. The ledger needs a monotonically ordered logical position such as(LedgerId, Sequence). Wall-clock timestamp is metadata. Backdated valid-time facts are ordinary and must never reorder transaction history.For A, do not require one distributed global total order. A local ledger may use a global sequence for simplicity, but the semantic contract should require stable per-ledger order + explicit commit/causal references. Federation/distributed ordering can be attacked in C/D.
Append / idempotency / crash semantics
Preferred API semantics:
Atomic batch
A commit batch is all-or-nothing. Partial committed semantic packages are forbidden.
Optimistic frontier/CAS
ExpectedFrontierpermits stale concurrent writers to fail/rebase rather than silently overwrite logical history.Idempotency
The caller provides a stable command/idempotency key where retry is possible.
Do not claim magical exactly-once transport. The safer contract is at-least-once delivery safe because committed commands/events are idempotently recognized.
Crash classes
WAL systems provide the physical crash-recovery precedent; Machine Spirit's semantic ledger is a logical domain log, not necessarily the database engine's physical WAL.
Authoritative vs rebuildable state
Canonical durable
At minimum:
Rebuildable derived
A derived structure may be persisted for speed, but its persistence never makes it canonical truth.
Incremental/differential projections
Depth 2 and 3 already established dependency-directed incremental compilation/reasoning. Depth 5A generalizes the persistence substrate:
Differential Dataflow and DBSP are strong foundations for maintaining recursive/rich views from deltas. The architecture should therefore expose delta/frontier semantics without requiring those particular runtimes.
A projection is a function of:
If any of those change, the old projection may become stale even when the base ledger did not.
A view checkpoint must identify all of them. “Database row exists” is not enough freshness evidence.
Provenance model
Green/Karvounarakis/Tannen motivates factorized provenance for alternative/conjunctive derivations. Machine Spirit should retain canonical source/compiler/logical/lifecycle/profile/runtime provenance classes from #392/#400, but ordinary expanded proof trees remain derived.
The ledger records provenance-bearing edges/receipts sufficient to reconstruct why. Provenance indexes can then support:
Never combine provenance, source trust, probability, compiler confidence and authority into one scalar.
Identity / ontology / schema evolution
Identity
Cross-memory identity remains a reversible semantic relation, not destructive row coalescing.
A later event can withdraw/supersede
L; A and B never disappear. Current canonicalization is a view.Ontology evolution
Hartung/Groß/Rahm's invertible diff-evolution mappings are a useful precedent. Persist versioned mappings capable of expressing at least:
A new ontology version does not rewrite historical semantic objects into the new vocabulary. Query-time or materialized version projections may translate with mapping/loss receipts.
Schema / event evolution
Historical event/object bytes remain interpreted under their original schema version.
Allowed strategies:
Forbidden:
A schema conversion that changes meaning creates new lineage and a receipt.
Storage/backend implications
A is intentionally logical-architecture first. Do not lock the project to one physical backend yet.
Local/small
SQLite WAL or a purpose-built append file + indexes can plausibly implement the contract for a single-node deployment. The current whole-snapshot rewrite backend remains suitable only as a bootstrap/test backend once it is clearly labeled non-scalable and the semantic contract is not shaped around it.
Serious single-node/server
PostgreSQL-style transactional storage is a strong candidate for authoritative commits, bitemporal/indexed metadata and concurrent readers/writers. An embedded LSM/KV store can be attractive for high-write secondary indexes/object payloads.
Very large
At hundreds of millions/billions of records, expect immutable segmented object/event storage plus partitioned/LSM or relational indexes and separately maintained projection stores. The contract should allow tiering old immutable segments while retaining exact historical addressability.
A hard warning from Kafka-style compaction: physical compaction that destroys superseded semantic history cannot be the only copy of canonical Machine Spirit history. View/index compaction is fine; canonical-history retention requires an explicit retention/governance contract and cannot happen merely because a storage engine wants fewer bytes.
Complexity direction (A-level, not D benchmarks)
With suitable indexes:
O(log N + k)or KV-equivalent, not whole-log scan;O(events since checkpoint + affected derived work);O(history + derivation work)and therefore checkpointing/tiering matters;O(unique immutable objects + ledger episodes + retained receipts + indexes);Depth 5D must benchmark and tighten these claims.
Repo ownership boundaries
prolog-rlmOwns:
symbolic-memoryOwns:
known_at/valid_athistory;Hard dependency rule
The existing one-scheduler rule remains unchanged. A ledger is not a scheduler and a projection engine is not an expert runtime.
Authority / safety implications
Persistence must preserve the existing safety separation:
A malicious imported source may append semantic content only through the normal compiler/validation/trust boundary. It cannot choose ledger event types, spoof commit principals, forge compiler/profile versions, install schema adapters, or synthesize authority mappings.
Event/commit envelopes therefore belong to trusted storage/runtime code, not model/source-controlled open vocabulary.
Rejected alternatives
rlm_plan.Falsifiable A-level conformance fixtures
A1. Independent identical assertion episodes — two sources assert structurally identical P; one proposition object may dedupe, but two source/support episodes and provenance paths remain.
A2. Event identity != content hash — two legitimate same-payload events retain distinct event IDs.
A3. Idempotent retry — same idempotency key + same batch digest commits once and returns the original receipt.
A4. Idempotency collision — same key + different digest is rejected, never silently deduped.
A5. Atomic semantic package — crash/failure halfway through a multi-event batch yields either the complete commit or no commit.
A6. Crash after commit/before view update — restart replays from frontier and produces the same normalized current view as uninterrupted execution.
A7. Delete/rebuild projection — deleting every rebuildable current/index table and replaying canonical state yields the same normalized semantic view.
A8. Backdated correction — a February correction about January changes current January-valid view but
known_at(January)still reports the earlier epistemic state.A9. Withdrawal != negation — withdrawal event deactivates support without creating negative assertion payload.
A10. Wall-clock reversal — intentionally nonmonotonic timestamps do not alter ledger sequence/replay order.
A11. Concurrent expected-frontier conflict — two writers based on the same frontier cannot both silently commit mutually stale state where the transaction contract requires CAS.
A12. Two independent justifications — invalidating one support path leaves the other intact after replay.
A13. Identity-link rollback — add
same/likely-samemapping, query through it, withdraw mapping, rebuild; original entity IDs and pre-link history remain.A14. Ontology rename — new ontology mapping supports current query projection while historical records remain encoded under old vocabulary/version.
A15. Ontology merge/split — mapping receipt records nontrivial merge/split and reverse/history inspection remains possible; no destructive source-ID rewrite.
A16. Old event schema replay — historical event under v1 is decoded/upcast deterministically under a versioned adapter; original bytes/schema ID remain addressable.
A17. Semantic-changing migration — migration that changes meaning creates new lineage/receipt rather than claiming byte-identical history.
A18. Stale checkpoint rejection — projection whose dependency versions/frontier do not match query requirements cannot satisfy current VERIFY/action admission.
A19. View compaction safety — compact/drop/rebuild materialized indexes without deleting canonical ledger history.
A20. Provenance round trip — current query → justification/support → assertion episode → compiler/source span remains resolvable after restart/rebuild.
A21. Execution lineage — a stored method/expert/effect/VERIFY receipt reconstructs which versions/evidence were used without turning the receipt into current authority.
A22. Namespace isolation — identical semantic objects may be shared/deduped physically, but ledger admissions/current views do not leak between namespaces.
A23. Unsupported schema — unknown/incompatible semantic or event schema can be retained/quarantined but cannot enter active current projections.
A24. Known symbolic replay with provider disabled — ledger replay, current-view rebuild and query over already compiled knowledge perform
model_calls = 0.These are architecture fixtures. Depth 5D must convert surviving ones into concrete storage/concurrency/performance gates.
Concrete canonical deltas from A
#402
Adopt BSLPF as the Depth-5A baseline to attack in B/C/D:
symbolic-memory#6
Strengthen the append-only contract:
known_atcomes from immutable commit history;valid_atremains semantic world time;symbolic-memory#5/#8
Projection/backfill lifecycle should commit through the ledger transaction boundary, with stable command/work IDs. Compiler retries can reuse retained artifacts while projection commits remain independently idempotent.
symbolic-memory#10
Identity/ontology reconciliation becomes explicit append-only mapping events + current mapping projection. Never rewrite old semantic object/entity IDs.
#392/#396
No storage ownership moves upstream. They must expose stable semantic object/schema/compiler fingerprints sufficient for downstream ledger commits and replay.
#400/#401 handoff preservation
Epistemic and procedural query/execution caches stay derived. Persist only canonical evidence/lifecycle and materially promoted/replay-critical receipts.
Unresolved questions preserved for #402B/C/D
Those are intentionally left for the hostile B pass, composition C pass, and computational D pass.
Completion state
#402A is design-complete only. Implementation is unproven. #402 stays OPEN.
Exact next subpass: #402B — semantic/adversarial deepening of durable world-model semantics.
B must attack append-only assumptions, deletion/redaction, provenance explosions, retroactive corrections, event/model duplication, transaction boundaries, temporal anomalies, stale/poisoned projections, schema migration, corruption, authority spoofing, and the distinction between historical record integrity and current epistemic acceptance.
Do not start #402C or #403 until #402B and then #402C/#402D are durably complete.
#402B — semantic/adversarial deepening — COMPLETE
Scope / attack surface
This B subpass attacks the assumptions behind #402A's BSLPF — Bitemporal Semantic Ledger + Projection Fabric rather than repeating its storage survey. The questions are:
Current-state comparison
#402A already established the right baseline separation: immutable/versioned semantic objects, ordered bitemporal ledger events and rebuildable projections. #400 requires
valid_atvsknown_at, explicit support/defeat lineage and derived warrant caches; #401 requires immutable procedure/PSC versions plus material execution/VERIFY/replay lineage. The current Symbolic Memory issues already distinguish withdrawal from negation and current views from history.The hidden failure is that
append-onlywas still overloaded. Historical researchSYMBOLIC-MEMORY-RESEARCH-008explicitly says forgetting usually differs from deletion and reserves physical erase for policy/user requirements. Research-009 treats persistent memory as security-sensitive execution input and requires selective poisoning repair. Research-006's bootstrap storage analysis also never established a strong physical-erasure/tamper-evidence contract.Therefore BSLPF needs an explicit governance/integrity layer rather than interpreting logical append-only history as permanent recoverability of every historical payload.
Primary / authoritative evidence
principal=adminfields inside imported history from becoming authenticated local authority: https://www.rfc-editor.org/rfc/rfc9943.htmlThese sources establish mechanisms and failure boundaries; they do not imply that Symbolic Memory is automatically legally compliant or that one cryptographic/logging mechanism is universally sufficient.
Candidate architectures
Candidate B1 — physically immutable plaintext event log
Advantage
Maximum naive replay simplicity.
Fatal problems
Rejected. Logical historical integrity cannot require perpetual recoverability of every payload byte.
Candidate B2 — mutable history with in-place redaction
Advantage
Straightforward privacy/delete semantics and ordinary database tooling.
Fatal problems
Rejected as canonical. Controlled physical compaction/migration may use copy-transform, but it creates a new ledger generation with an explicit migration receipt rather than pretending the old history never existed.
Candidate B3 — BSLPF + Governed Redaction & Integrity Envelope (preferred)
Call the B-level refinement GRIE — Governed Redaction & Integrity Envelope.
The hard refinement is:
The ledger can preserve that event/object
Eexisted, was accepted at frontierF, and was later redacted under policy/authorityR, while the protected payload becomes cryptographically or physically unrecoverable where the backend/policy actually supports that guarantee.Hard semantic distinctions added by B
A correction changes current interpretation/support through a new event. A redaction changes payload availability. Quarantine removes an item from active admissibility while preserving it for controlled investigation. Integrity failure says the system cannot trust/replay material; it does not manufacture
not(P).Typed conceptual model
Exact representation remains implementation work; the semantic distinctions are canonical B output.
Mechanisms / guarantees
1. Governed erasure and redaction
A delete request is a lifecycle command with its own authorization/policy evaluation. It must not execute because remembered text says
delete this.Candidate modes:
The backend advertises which guarantees it can actually make. A successful semantic
redactionreceipt cannot claim NIST-style sanitization unless the physical/storage layer performed and validated an appropriate method. Backups/replicas/holds may yieldpartial,pending, orblockedrather than fake success.Redaction receipts themselves must avoid copying the sensitive value back into the audit trail. Low-entropy plaintext hashes can also leak equality/dictionary information; externally visible/global content digests are therefore not mandatory. Namespace/trust-domain keyed commitments or opaque object IDs are safer where equality disclosure is sensitive.
2. Historical truth after erasure
Bitemporal history now gains a third independent concern: payload availability/replay capability.
may legitimately answer:
It must not reconstruct erased plaintext from a derived cache or pretend exact replay remains possible.
Thus:
3. Schema evolution / upcasting
Original raw event/object bytes remain bound to their original schema. An upcaster is a versioned derived interpretation.
If U7 is representation-preserving, current projectors may consume it. If it changes meaning, that is a semantic migration/mapping and gets new lineage; it cannot masquerade as the original historical event.
Exact replay requires the original raw material plus the exact interpretation/upcaster artifact. If either is unavailable, replay capability is downgraded explicitly. Unknown/incompatible schema goes to preservation-only/quarantine, never active current knowledge.
4. Duplicate taxonomy
Do not use one generic
dedupoperation. Distinguish:Content equality therefore never proves evidence independence.
5. Projection poisoning/staleness
A materialized view checkpoint is accepted only if its key matches:
A projection can be thrown away. It can never heal or overwrite a corrupted canonical ledger. Action/VERIFY-sensitive queries must reject stale or integrity-failed projections rather than serving them as truth.
Derived projection output cannot promote itself into canonical semantic history without crossing the normal validation/admission command boundary.
6. Ledger integrity
Checksums detect accidental corruption; hash chains/Merkle commitments can make unauthorized alteration detectable; signed/witnessed checkpoints can make equivocation harder to hide. RFC 9162 is useful precisely because it also shows the limitation: a log can present inconsistent views unless roots are compared/monitored.
Therefore BSLPF/GRIE promises detectable integrity under its configured checkpoint/witness profile, not magic prevention of all tampering.
If canonical ledger/object integrity fails:
is a first-class system state. Do not reconstruct canonical authority from a projection. Recovery must use an authenticated backup/replica/checkpoint lineage and create a recovery receipt.
7. Transaction/publication boundaries
The event batch must be atomic at the smallest semantic invariant boundary. Immutable payload objects may be staged before commit, but a frontier may advance only when every required object/reference is present and digest-valid.
Examples that belong in one publication commit:
Unrelated knowledge should not be forced into one mega-transaction. B defines atomic publication groups, not global serial transactions across the whole world model.
8. Authority authenticity
Imported event metadata such as
principal(system)is merely a claim. Preserve separately:SCITT is a strong precedent: issuer signature and transparency-service receipt answer different questions. Imported signed knowledge may raise provenance quality under policy, but can never grant local host authority merely because an issuer name matches a local role.
9. Provenance scaling
Canonical history preserves atomic provenance edges and material lifecycle/admission receipts. It does not duplicate expanded proof trees on every derived record.
Use shared/hash-consed provenance DAGs/bundles, query-local expansion and compact summaries. Classify retained derivation material roughly as:
A rebuildable proof/cache may be evicted if all inputs + reasoner/profile versions needed to regenerate it remain available. A promoted action/VERIFY/learning receipt may require stronger retention. If privacy policy redacts a source, explanations degrade to authorized opaque commitments rather than leaking the source through provenance.
Complexity / scaling implications
Epistemic / provenance implications
Current epistemic acceptance is computed over admissible evidence, not merely every committed event. Quarantine/integrity failure/redaction can make evidence unavailable or inadmissible without changing what was historically committed.
A poisoned event may therefore have all three facts true:
or after erasure:
This preserves forensic truth without letting poisoned history stay active.
Safety / authority implications
Rejected shortcuts
Falsifiable B conformance fixtures
B1 — withdrawal vs deletion: withdraw support for
P; historical payload remains; no¬Pis synthesized.B2 — redaction vs negation: redact source payload for
P; current/history metadata says redacted; no negative semantic support appears.B3 — crypto erase receipt: backend claims crypto erase only after configured key-destruction validation; otherwise
partial/pending/failed.B4 — backup lag: primary erased but one governed backup cannot yet be sanitized -> global result is not
complete.B5 — legal/policy hold: purge request is recorded but blocked; active policy state explains why.
B6 — erased replay: a historical query after erasure returns
commitment_only/redacted, never reconstructed plaintext from a stale cache.B7 — retroactive correction: February correction changes current view of January-valid truth while
known_at(January)still reports the earlier accepted state.B8 — correction vs world change: correction of bad January data does not create a February world-state transition.
B9 — transport retry: same idempotency key + same batch digest returns original receipt/no duplicate event.
B10 — idempotency collision: same key + different batch digest is a hard conflict.
B11 — independent duplicate: two independent sources assert structurally identical
P; proposition may dedup, support episodes do not.B12 — copied duplicate: ten articles copied from one origin produce ten episodes but one dependence component.
B13 — cross-namespace equality leak: unauthorized caller cannot discover that a private namespace stores equal payload via global object ID/hash behavior.
B14 — poisoned projection: mutate/corrupt a materialized current view; checkpoint mismatch causes rejection/rebuild, not canonical append.
B15 — stale view: action/VERIFY query against stale frontier fails/refreshes rather than using cached truth.
B16 — corrupted ledger segment: canonical integrity failure cannot be healed from a projection; authenticated recovery lineage is required.
B17 — Merkle consistency: later checkpoint is accepted only with valid configured consistency relation to prior checkpoint.
B18 — split-view detection fixture: two incompatible signed checkpoint roots at same/logically comparable frontier produce equivocation/integrity alarm, not arbitrary winner.
B19 — spoofed principal field: imported event claiming
system/adminremains untrusted claim unless issuer/authentication/local admission establish it.B20 — signed-but-unauthorized: cryptographically valid issuer statement remains locally inadmissible if policy denies it.
B21 — representation-preserving upcast: original event stays immutable; exact versioned upcaster produces deterministic equivalent representation.
B22 — semantic upcast: an upcaster that changes meaning must be labeled migration/lossy and cannot satisfy exact historical replay.
B23 — missing old upcaster: historical exact replay reports degraded/unavailable instead of silently using today's semantics.
B24 — provenance redaction: explanation for an authorized caller can use surviving commitment/lifecycle refs without leaking erased source bytes.
B25 — atomic projection publish: crash midway through staged immutable-object writes exposes no active half-package before commit/frontier advance.
B26 — atomic correction: current view never observes replacement active without its required correction/supersession relation when those are one publication invariant.
B27 — quarantine selective repair: poisoned source and dependent derived views are invalidated/rebuilt; unrelated evidence remains active.
B28 — cache cannot promote itself: corrupted/recomputed projection data cannot create canonical events except through validated append/admission API.
B29 — read authority on history: knowing an event/object/commit ID does not reveal redacted/private payload or existence beyond allowed metadata policy.
B30 — integrity is not truth: a perfectly valid inclusion/commitment proof for false/untrusted
PleavesPepistemically untrusted unless its support/admission semantics warrant it.Canonical issue changes / ownership
lost-rob0t/prolog-rlmlost-rob0t/symbolic-memoryredacted/quarantined/integrity_failureto not-found/false.Physical sanitization implementation stays behind the Symbolic Memory storage adapter/backend capability boundary. Prolog-RLM does not become a database, KMS or transparency-log service.
Unresolved questions preserved for C/D
Completion statement
#402B is design-complete only. It does not prove implementation, physical sanitization, tamper resistance, privacy compliance, or Machine Spirit acceptance.
The surviving architecture is:
Exact next research subpass: #402C — composition / heterogeneity / interoperability.
Do not start #402D or Depth 6/#403 until C is durably complete.
MACHINE-SPIRIT #402C — composition / heterogeneity / interoperability
Status: COMPLETE (design only; implementation unproven).
Research scope / questions
This subpass attacks the assumption that multiple durable world-model stores can be treated as one bigger append-only log. It asks:
Current-system comparison
#402A established BSLPF: immutable/versioned semantic objects + authoritative bitemporal ledger + rebuildable projections. #402B added GRIE: payload retrievability, redaction/sanitization, admission, replay and integrity are separate dimensions.
Upstream #392 already treats contexts/theories/bridges and identity mappings as explicit versioned semantic objects; #400C likewise established that heterogeneous epistemic theories exchange status-bearing objects through typed bridges rather than sharing one global truth relation. Downstream
symbolic-memory#6still describes one append-only semantic ledger/current-history view, and the current implementation is even narrower:prolog/symbolic_memory_storage.plserializes one in-process dynamic-predicate snapshot under a mutex and atomically renames the complete file. That bootstrap remains useful but cannot define federation semantics.Historical
SYMBOLIC-MEMORY-RESEARCH-006explicitly treated replication/remote multi-process access as optional future work and correctly insisted on a replaceable storage adapter. C preserves that backend independence while making the logical federation contract explicit.Primary / authoritative evidence
Candidate architectures
Candidate 1 — one canonical federation super-ledger
Import every remote event into one globally sequenced append-only log and assign a federation-wide commit number.
Rejected as canonical. It gives convenient snapshots but invents order among unrelated concurrent events, centralizes authority, forces heterogeneous retention/erasure rules into one policy and creates a huge privacy/availability boundary. A sequenced super-ledger can still be an explicit deployment profile where participants intentionally accept one sequencer/consensus domain.
Candidate 2 — CRDT-union world model
Treat all stores as replicas of one convergent replicated semantic object; merge events/state with CRDT rules and tombstones.
Rejected as universal. CRDTs are excellent inside a declared replica group when the same logical object's operations satisfy the convergence conditions. Independent ledgers with different issuers, admission policies, meanings, retention guarantees and source identities are not replicas merely because records look similar. Convergence of bytes/state also does not resolve epistemic conflict or authority.
Candidate 3 — preferred: CLFM — Causal Ledger Federation Mesh
Keep each ledger authoritative for its own history. Federation stores authenticated observations/receipts about remote histories and composes them through typed, versioned federation contracts.
Preferred design — hard distinctions
Ordering / causality
Every participating logical ledger declares its order profile. It may provide a strict local commit sequence, causal/version order, checkpoint order or only observed external receipts.
Cross-ledger
happens_beforeis established only by evidence-backed edges, for example:Wall-clock comparison alone does not create causality. Unrelated events remain
concurrent/unknown_ordereven if a deterministic renderer sorts them by(time, ledger_id, event_id).Conceptual records:
Federation cuts / replay
A federated query never means “latest from everywhere.” It executes against an explicit federation cut:
Candidate completeness classes:
A cut claiming
causally_closedmust include every admitted cross-ledger causal predecessor required by its selected events. It does not claim serializability across independent authorities.Replay receipts therefore bind exact per-ledger frontiers/checkpoints plus link/mapping/admission/redaction/integrity generations. A remote unavailable at query time yields partial/incomplete status rather than treating its missing knowledge as false.
Replica / backup / mirror semantics
CLFM distinguishes storage topology before evidence counting:
Redaction / retention federation
A redaction request or local GRIE lifecycle event may create federation redaction obligations/notices under negotiated link policy. Each recipient decides/admit/processes the obligation under its own authority and returns its own receipt/status.
Aggregate status must remain per-copy/per-ledger. Example:
The federation result is
partial, notcomplete. The origin ledger is forbidden from claiming remote physical purge from the fact that it sent a notice.For immutable transparency services, sensitive/erasable payloads should be represented by commitments/hashes or external references where appropriate before registration. A transparency receipt can remain while the protected payload becomes unavailable under GRIE.
Integrity / transparency composition
Integrity remains a vector of guarantees, not one Boolean:
A valid SCITT receipt proves the signed statement was registered in the identified TS under its policy; local epistemic trust remains a relying-party decision. One Signed Statement registered in three TSs is one statement origin + three registration receipts, not three independent corroborating sources.
A conflicting checkpoint/fork inside one claimed logical ledger produces
integrity_conflict; the system must not silently pick whichever replica answered first.External provenance interoperability
W3C PROV bundles may be imported as provenance graphs while retaining bundle/source namespace and adapter/version lineage. SCITT Signed/Transparent Statements may be retained as signed external statement/receipt envelopes. Neither format becomes mandatory canonical storage.
Adapters report something equivalent to:
The original external envelope remains addressable when retention policy permits.
Identity / dedup / privacy
Cross-ledger identity is still explicit reversible knowledge per symbolic-memory#10 and #392; it is never inferred solely from storage equality.
Rules:
Repository ownership boundary
Prolog-RLM continues to own semantic IR, theory/identity mapping semantics and #400 epistemic bridge/query semantics. It may represent ledger/federation metadata as inert typed data, but does not own physical replication or remote storage.
symbolic-memory owns logical ledger identities/profiles, federation-link configuration, authenticated remote-import events, federation cuts/frontiers, replica/backup/fork classification, redaction obligation/status lineage, external envelope retention, and rebuildable federated indexes.
Concrete network/SCITT/database adapters may remain host/backend supplied behind typed interfaces. Remote metadata never installs executable Prolog, capabilities or local authority.
Complexity / scaling implications
O(number_of_ledgers)per cut. Sparse/hierarchical/dotted versions and checkpoint compaction are D-level optimization questions.nledgers can become quadratic/combinatorial; preserve candidate mappings and resolve query-locally rather than eager global merging.Epistemic / provenance implications
Federation contributes new evidence structure, not a new truth semantics. #400 EFF remains above CLFM:
Thus storage convergence never resolves contradictory claims by itself. Source dependence follows origin lineage through mirrors/replicas/registrations.
Safety / authority
call/1or code installation;Falsifiable / conformance fixtures
C1. Same timestamp on independent ledgers creates no causal edge.
C2. Verified explicit reference A→B yields cross-ledger
happens_before(A,B).C3. Unrelated A/B remain concurrent/unknown-order.
C4. Deterministic display sort does not change causal result.
C5. Two replicas of one logical ledger count as one evidence origin.
C6. Backup restore does not create corroboration.
C7. Mirror/cache copy does not create corroboration.
C8. Divergent histories under one logical-ledger identity produce fork/integrity conflict.
C9. One SCITT Signed Statement with three TS receipts is one statement origin + three registration receipts.
C10. Independent issuers making the same proposition remain distinct assertion episodes.
C11. Valid inclusion/registration receipt does not by itself make proposition epistemically warranted.
C12. Invalid remote receipt blocks admission and records verification failure.
C13. Local redaction complete + remote pending => federation redaction
partial.C14. Redaction notice cannot manufacture semantic negation.
C15. Origin cannot claim target physical purge without target sanitization receipt/status.
C16. Immutable external log retains commitment while erasable payload is unavailable/redacted.
C17. Backup-retention delay remains explicit pending sanitization.
C18. Remote principal named
admingains no local authority.C19. Same content hash across two ledgers does not merge assertion/event IDs.
C20. Equality-protected namespaces do not expose cross-domain content-hash matches.
C21. Reversible identity mapping can be withdrawn without rewriting either ledger.
C22. PROV bundle import retains bundle namespace/provenance-of-provenance links.
C23. Lossy external mapping exposes loss receipt and cannot claim exact replay.
C24. Unsupported remote schema remains opaque/preserved rather than silently upcast.
C25. Offline remote ledger yields partial/incomplete query, not
false.C26. Causally-closed cut rejects a selected event whose required predecessor is missing.
C27. Same cut/frontiers + versions reproduces normalized federated observation set when retained payloads permit exact replay.
C28. Redacted payload degrades replay capability exactly as declared by GRIE.
C29. Re-import same authenticated remote event is idempotent.
C30. Same remote event identity with a different digest is an integrity conflict.
C31. A valid remote registration policy does not bypass local admission policy.
C32. A federation link update creates new lineage; old historical cuts retain old link/mapping versions.
C33. Replica convergence can succeed while semantic conflict remains visible above it.
C34. Providers disabled: all supported federation/cut/integrity/provenance reasoning fixtures execute with
model_calls = 0.Rejected shortcuts
integrity_ok: hides issuer, inclusion, consistency, admission, payload and schema failures.Canonical issue deltas required by C
Unresolved questions reserved for #402D
Completion statement: #402C establishes composition semantics only. It does not claim distributed implementation, global serializability, successful physical erasure, non-equivocation, or Machine Spirit acceptance. Exact next subpass is #402D.
#402D — computational realization / scaling / conformance — COMPLETE
Scope / research questions
This D subpass operationalizes A/BSLPF + B/GRIE + C/CLFM. It asks:
Current-repo comparison
The current queue is unambiguous: #397 and this issue say A/B/C are complete and D is next. #392 keeps semantic objects immutable/versioned and separates canonical from materialized state; #394 keeps epistemic inputs canonical while support/warrant tables remain derived. Downstream symbolic-memory#4/#6 require append-only semantic history and rebuildable current views.
The actual current
symbolic-memory/prolog/symbolic_memory_storage.plremains a bootstrap implementation: one process-wide mutex protects dynamic predicates; each transaction snapshots all projects/sources/memories/audits, serializes the entiresnapshot(...)term to a temporary file, and renames it over the prior file. That makes transaction cost and restart footprint proportional to total resident state and provides no segmented event log, sparse frontier, causal index, projection checkpoint, anti-entropy or billion-record path. D therefore specifies a replacement semantic storage contract, not a claim that the current backend implements it.Primary / authoritative evidence
These support mechanisms; none is adopted wholesale as Machine Spirit semantics.
Candidate execution architectures
Candidate 1 — one ACID temporal relational database + eager materialized views
Strengths: simple transactional model; good local implementation target; mature indexing, WAL and backup tooling.
Failure as the universal D architecture: binds canonical semantics to one database's temporal/materialized-view behavior; encourages eager global indexes; does not itself solve independent-ledger federation, sparse cuts, replica-vs-source semantics or heterogeneous redaction/integrity profiles. A relational backend remains a valid implementation of the logical contract.
Candidate 2 — distributed event store + global version vector + eager global causal/materialized closure
Rejected. Metadata grows with global participants; dynamic/federated authorities are forced into one replication domain; causal-closure maintenance can dwarf useful queries; partitions invite either false global freshness or system-wide blocking.
Candidate 3 — segmented authoritative ledgers + sparse hierarchical cuts + typed replica profiles + demanded incremental projections (preferred)
Name: SAFIRE — Sparse Append-only Frontier & Incremental Replay Engine.
Federation remains CLFM above independent ledgers. Replication remains a property inside one logical-ledger identity.
Preferred computational architecture — SAFIRE
1. Local ledger order is dense; federation order is sparse
Every logical ledger owns a monotonically increasing commit/sequence coordinate:
A local checkpoint can summarize a contiguous durable prefix plus segment/manifests. It does not require a vector entry for unrelated ledgers.
A federation cut names only participating ledgers/dependencies:
FrontierManifestRefmay be an immutable hierarchical manifest whose leaves are exact(Ledger, Frontier, Checkpoint)tuples. Large cuts can share unchanged manifest subtrees instead of copying a million-entry map into every receipt.Hard invariant:
The full logical cut must be reconstructible from referenced immutable manifests.
Replica clocks are not federation clocks
Inside an optimistically replicated single logical ledger/object partition, dotted version vectors or an equivalent bounded causality representation are valid candidates. Interval Tree Clocks are a candidate where participants are highly dynamic.
They are not the canonical cross-ledger federation ordering mechanism. Independent ledgers remain separate authorities connected by explicit causal/import links.
2. Do not materialize global causal transitive closure
Canonical causal evidence is the explicit graph:
Indexes provide:
A causality query performs bounded backward/forward traversal from the demanded cut. Frequently reused reachability results may be cached, but global closure is never canonical.
Probabilistic indexes are negative accelerators only
Segment/SSTable Bloom filters or scalable Bloom filters may answer:
or
They can skip storage probes. A false positive may cause extra I/O; it may never create a semantic edge, causal relation, source identity or authorization result.
3. Segmented immutable storage layout
Logical contract:
Recommended physical shape at scale is backend-neutral but assumes:
A billion-record design cannot have
findall/3over the whole store as its ordinary scan primitive.4. Projection DAG + exact dependency generations
Every materialized projection declares inputs and semantic dependencies:
Dependencies include where applicable:
Delta processing
For a projection at frontier
Freceiving committed deltaΔ:Simple indexes use direct delta maintenance. Recursive/iterative projections may use DBSP/differential-dataflow-style incrementalization when it wins empirically.
Do not require one universal dataflow runtime for every index.
Invalidation
A dependency generation change invalidates only projections/partitions that declared that dependency. For huge fan-out changes (e.g. ontology/profile generation affecting enormous history), prefer:
over eagerly rewriting a billion derived rows in one transaction.
Canonical history remains available while views catch up.
5. Projection freshness is explicit
A query result carries at least:
Representative states:
Never answer from a lagging projection and label it simply
current.Callers may choose policy:
but the result must expose which path occurred.
6. Replication profiles are explicit and non-interchangeable
single_writer_localOne authoritative local ledger. Physical database WAL/backup is implementation detail.
consensus_replica_groupOne logical ledger replicated through a consensus protocol (Raft/Paxos family or equivalent). Only committed log entries become ledger history. Minority partitions cannot fabricate committed history.
optimistic_replica_groupOne logical object/partition family may accept concurrent versions during partition. Causality metadata (e.g. DVV) detects concurrency; reconciliation produces explicit retained branches/resolution events. This profile does not promise one write order during the partition.
mirror/archiveCopies committed history but has no authority to originate ledger commits under that identity.
Hard invariant:
Dynamo-style Merkle anti-entropy is appropriate for finding differing key/segment ranges inside a declared replica/mirror relation. A Merkle match proves content equality for the committed range under that digest scheme; it does not prove proposition truth or source independence.
7. Anti-entropy operates on immutable commit/segment identity
Preferred repair flow:
Duplicate transfer is harmless through event/commit idempotency.
If two peers claiming the same consensus/single-history ledger identity present incompatible committed ancestry, classify:
Do not union them automatically.
Optimistic replica profiles may instead retain concurrent branches according to that profile's declared reconciliation semantics.
8. Crash behavior is deterministic at semantic boundaries
Required crash points:
integrity_failure; projection cannot become replacement authority.Backends may use SQLite/Postgres/RocksDB/etc. WAL/transactions, but the semantic conformance suite tests the boundaries above independent of backend.
9. Partition behavior follows replica profile, never guesswork
A remote outage cannot make unrelated local knowledge disappear, and a stale replica cannot advertise itself as globally current.
10. Governed redaction obligations become durable idempotent work
GRIE/CLFM redaction obligations are canonical ledger objects. Execution state is append-only attempt/receipt history:
Workers may retry at-least-once. The obligation ID + target + requested action make retries idempotent where the target supports it.
Possible terminal/nonterminal states remain explicit:
No local worker can upgrade
remote notice acceptedtoremote physical purge completewithout evidence defined by that target profile.Maintenance execution is storage/runtime work; it does not create a second Prolog-RLM plan scheduler and does not grant semantic actions host authority.
11. Billion-record assumptions / bounds
The semantic contract must make these complexity expectations falsifiable rather than promise magic constants.
Append
For batch size
b, logical append work should beO(b)plus backend index/log factors. It must not serialize or rewriteO(total_history).Catch-up
Projection catch-up from frontier
FtoF+nshould consume thencommitted deltas plus affected dependency closure. A small append must not normally force a full replay.Current/query indexes
Point/range lookup must use persistent indexes. No requirement may imply loading all events/objects into SWI-Prolog heap.
Federation cut
Logical size is
O(k)for thekparticipating ledger frontiers. Hierarchical immutable manifests may make incremental storage proportional to changed leaves/subtrees rather than copying allkentries per receipt.Causal reachability
Demanded traversal cost is proportional to visited explicit edges/checkpoint summaries plus index lookup costs. Global
O(V^2)reachability materialization is forbidden as a baseline requirement.Anti-entropy
Merkle/range summaries should localize repair to differing ranges rather than resend complete history. Exact complexity depends on tree/segment layout; benchmark it instead of encoding a false universal bound.
Provenance
Durable provenance uses shared DAG/object references. Explanation expands only demanded paths under budgets; it does not duplicate full proof trees into every event.
12. Deterministic replay receipt
A replayable result/checkpoint fingerprints:
Canonical result hashing sorts/normalizes unordered sets before digesting. Scheduler/thread completion order must not change semantic digest.
Hard differential oracle:
for the same exact cut + dependency generations.
If a budget prevents completion, compare structured failure/completeness semantics, not a partial result masquerading as complete.
Falsifiable D conformance fixtures
SAFIRE-D1 — append complexity class
Append 1 event to histories of 10^3 and 10^7 records; instrumentation must prove no full-history serialization/rewrite path.
D2 — crash before ledger commit
Injected crash leaves no committed event/frontier advance.
D3 — crash after ledger commit before projection
Restart replays delta and reaches same projection digest as clean execution.
D4 — torn/unpublished projection
Projection rows without valid checkpoint are never visible as authoritative current state.
D5 — projection corruption
Corrupt projection -> reject/rebuild; canonical ledger unchanged.
D6 — canonical segment corruption
Return
integrity_failure; projection cannot repair canonical authority.D7 — duplicate append retry
Same idempotency key + same digest -> same commit receipt/no duplicate event.
D8 — conflicting retry
Same key + different digest -> hard idempotency conflict.
D9 — sparse frontier
Query over 3 ledgers in a federation containing 100k registered ledgers produces a cut logically naming only required participants/dependencies, not a 100k fixed vector.
D10 — cut manifest exactness
Compressed/hierarchical cut reconstructs exact same leaf frontier set and digest after restart.
D11 — wall clock non-causality
Later timestamp on independent ledger creates no causal edge.
D12 — explicit causal import
Remote event reference/import creates exactly the declared cross-ledger dependency.
D13 — Bloom false positive safety
Forced probabilistic-index false positive may add a storage probe but cannot add semantic/causal result.
D14 — no global closure
Instrumentation on sparse causal graph shows query-local traversal/cache, no mandatory global transitive-closure build.
D15 — incremental current view
One assertion append updates only affected current-view partition/dependencies.
D16 — incremental/full oracle
Incremental projection digest == clean full rebuild digest.
D17 — cold/warm/rebuilt oracle
Identical result/status/receipt semantics for cold, warm and rebuilt paths.
D18 — dependency generation invalidation
Identity/upcaster/profile generation change invalidates only declared consumers; unaffected projection digests stay valid.
D19 — massive invalidation lazy generation
Large ontology/profile change marks affected partition/generation stale without atomically rewriting all derived rows.
D20 — stale result honesty
Lagging projection reports exact materialized cut and never labels itself current.
D21 — exact-cut query
require_exact_cuteither catches up/demand-evaluates to that cut or returns explicit inability; never silently serves older state.D22 — consensus minority partition
Minority cannot create a committed canonical ledger event.
D23 — optimistic concurrent updates
Allowed partition writes remain concurrent branches until explicit reconciliation; no fake total order from timestamps.
D24 — replica != corroboration
Three replicas of one logical ledger contribute one source/assertion episode, not three independent evidence components.
D25 — mirror cannot originate
Mirror/archive refuses canonical commit under source-ledger identity.
D26 — Merkle anti-entropy localization
One damaged/missing segment causes transfer of differing range only; identical ranges are not resent.
D27 — incompatible ancestry
Peers claiming one single-history ledger with incompatible committed ancestry -> fork/integrity conflict, never automatic union.
D28 — remote federation outage
Local exact queries continue; cross-ledger query reports partial/incomplete cut.
D29 — redaction retry idempotency
Repeated obligation attempt cannot duplicate semantic lifecycle effect.
D30 — redaction honesty
Remote ACK without sanitization evidence remains notice/partial state, never physical-purge complete.
D31 — erased payload resurrection defense
Cache/rebuild/anti-entropy cannot restore GRIE-erased plaintext from a stale replica lacking authority to reintroduce it.
D32 — schema/upcaster replay
Historical cut under exact original interpretation and current re-interpretation remain separately reproducible where payload survives.
D33 — billion-record cursor contract
Synthetic/real large backend test proves bounded page/cursor APIs and no
findall(all_history)/whole-store heap materialization on ordinary query path.D34 — provenance DAG sharing
N derived results sharing one provenance subgraph store references rather than N full copied proof trees.
D35 — deterministic concurrency
Different projection-worker completion schedules produce identical canonicalized projection/result digest at same cut.
D36 — resource limit semantics
Projection/rebuild/causal traversal budget exhaustion yields
resource_limited/lag status, not false/unknown/current.D37 — replica clock boundary
DVV/ITC metadata inside replica profile cannot be interpreted as independent-ledger federation order.
D38 — authority isolation
Remote commit/receipt/replica metadata cannot create local host capability or principal authority.
D39 — zero-model durable known task
After semantic projection exists, restart + ledger replay + bounded retrieval + known reasoning/procedure path completes with
model_calls = 0.D40 — end-to-end failure injection matrix
Randomized crashes at the six semantic durability boundaries followed by restart must converge to either the last fully committed cut or a later fully committed cut, never a hybrid projection state.
Rejected shortcuts
Repository ownership / typed API boundary
lost-rob0t/symbolic-memoryownslost-rob0t/prolog-rlmownsDependency stays
symbolic-memory -> prolog-rlm. SAFIRE does not become a second reasoning semantics or plan scheduler.Conceptual storage-facing API:
Exact implementation follows repo conventions; these are semantic contracts, not frozen exported predicate names.
Depth-5 reconciliation
A/B/C/D now survive as one design:
Depth 5 is therefore design-complete only. Implementation remains unproven. The current snapshot backend does not satisfy SAFIRE yet, and no billion-record, anti-entropy, crash-matrix, sanitization or deterministic-rebuild evidence exists merely because this design is recorded.
Canonical handoffs required from this D pass
Unresolved questions deliberately moved forward
Those are implementation/research inputs, not reasons to keep #402D open.
#402D complete. Depth 5 A/B/C/D reconciled. Exact next legal research subpass after canonical updates: #403A — retrieval / symbolic attention foundations.