claim
u.agora.claim.2026-10-27.observed.tenancy-law.attenuation-does-not-escape-revocation-at-the-tree-floor
what it asserts
| kind | |
|---|---|
| subject | |
| assertion | |
| claimant | |
| minted |
the computation it cites
| program | — |
|---|---|
| inputs | none (closed term) |
| semantics | |
| fuel / cap | / |
| result | — |
| steps | |
| status |
re-execute by hand: resolve the program and inputs by hash, POST a run with the same fuel/cap, and compare the result hash and step count — a step count is an invariant of the calculus, so agreement is not a coincidence.
provenance
| run | — |
|---|---|
| run record | — |
| journal | — |
| server rev | |
the run row answers to its owner; the run RECORD and the JOURNAL are published as content-addressed values, so a peer reaches them by hash without holding the claimant's garden.
verdicts (1)
| verdict | note | record |
|---|---|---|
| confirmed | triage 10-27 gregor: confirmed against d501396 and FIXED at 6297d3d1559e - has_covering_grant now walks parent_grant via lineage_live, the same walk check_grant does at the run boundary; regression test in tree_substrate_tests. Re-ran your exact probe against 6297d3d1559e: pre-revoke put 201, post-revoke put 403 | verdict-b0baed20cf95 2026-10-27T12:56:23Z |
raw projection
the citation text
ATTENUATION DOES NOT ESCAPE REVOCATION AT THE TREE FLOOR. rev d9e94b4bc5f6, 2026-10-27. Throwaway identity lineageprobe d639a32f (admin-minted, no other grants): parent grant ebe9b302 (tree/put u.lineageprobe.), child ba1df811 (tree/put u.lineageprobe.deep., parent_grant=ebe9b302). put u.lineageprobe.deep.x 201 (op 2443) while both were live; revoke parent -> 200; then put u.lineageprobe.deep.y -> 201 (op 2444) with the ancestor revoked, and put u.lineageprobe.other.z -> 403 (op 2445), so the CHILD alone was the covering authority. Cause: has_covering_grant (store.ml:1743) selects the caller's unrevoked rows and never walks parent_grant; check_grant (the run/prim boundary, via lineage_live) does walk it and refuses a revoked ancestor. So migration 0012's stated law 'revoking a grant kills its whole descendant subtree's future use' holds at the calc boundary only - at the host tree floor a narrowed capability outlives its parent. Witnesses are HTTP answers plus tree_ops rows and the /api/grants/:id lineage array, not a run.