Documentation

A row's observed outcome on the ledger.

How a completed row stands against the behavioral models. The chain outcome (Outcome) is a fact; the verdict compares it with what the models require. Q-002 (story 2, escalated to the user) decides which model is the behavioral authority where Singular's Lean and the consumer's theorems disagree; a row whose observation contradicts the consumer's theorem while Singular's Lean permits it is HeldQ002 — recorded, published, and never read as a pass: the run exits non-zero while any row is held.

Why a row stands unmet-by-ruling: the two meanings the operator's rulings give that one verdict, each with the issue that would close it.

The ruling that keeps each unmet row unmet. A row recorded unmet-by-ruling that is not listed has no stated meaning, and a reader surface refuses to render it.

An unmet ruling in plain words, naming the issue that would close it.

The refusal attribution for a refused row: the scripts that refused — one role, or several +-joined roles in ledger-reported order when a malformed transaction trips two validators at once — and the node's phase-2 reason verbatim.

One failing purpose's replay as a receipt carries it: the hash the node reported, the traced hash of the same parameters once the replay applied one, the reason it admitted or the cause it admits none — never both — and the capture it was replayed from.

The traced build a receipt's replay reasons rely on: its source, compiler and trace flags, and a digest of the untraced hashes it was held to.

A refused step's chain refusal with the replay of its failing purposes; unchanged when the replay recorded none.

The correspondence a story receipt carries: the session's, exactly when one of its steps carries a replay.

Per-constructor standing inside a partial row's receipt (E18 §3/§4, NOTE-052): every constructor the row names is accounted — exercised accepts with transaction evidence, named residuals with reason and limit, pre-existing gaps with their gap evidence. No general framework: the declared constructor set per row is fixed below and the loader requires it exactly. StandingRefused exists for E18's future refusal witnesses; this bounded schema admits none — any refused entry fails closed (NOTE-055).

Off-chain identity-derivation evidence (applied-validator-identity, E18 venue): the deployed address derived through the PRODUCTION path against the ACTUAL observed chain address, per validator by declared arity. This is explicitly NOT phase-2 ledger evidence — the venue string is fixed and loader-enforced so no later reader can mistake it.

One asset movement, named by its policy and asset name.

The registry's token identity is (policy, key) and nothing else, so a row about a keyed mint has to report both. A quantity alone cannot distinguish "one token at this key" from "one token at some other key".

The derivation decision (NOTE-067): compare the produced address against the reference and return both. Pure so the wiring is unit-testable and mutation-provable: replacing the comparison with True must make an observed-negative fail.

Evidence that a row executed. Accepted rows name the chain's transaction ids and carry measurements; refused rows carry the attribution and the submitted transaction's id under rejected (empty transactions: nothing was accepted). receiptVenue records where the refusal was observed: node-submit (a node ruling on a submitted transaction) or ledger-eval (local ledger evaluation only — never described as ledger execution). receiptDirty records whether the running tree had uncommitted changes: a receipt from a dirty tree is honest working evidence, but only a clean-tree receipt names a commit that reproduces it.

The complete declared constructor set per partial-capable row (constructor name, wire index). The loader requires EVERY receipt for these rows to carry exactly this accounting: a receipt written before the schema has no accounting and resolves unknown or incomplete — never covered. Silence must not mean success. Per-constructor data determines full/partial truth, not the caller's verdict: green requires every entry accepted-or-refused; any residual or gap forces partial.

The fixed venue string for derivation evidence. The loader rejects any other venue: an identity check must not be readable as ledger evidence.

Receipts stay readable: the insert-occupied-key refusal once embedded the whole compiled validator (~30KB of base64) because show on the evaluation context prints every script and cost model.

The bound is measured (#287): the largest live receipt, reject-and-retract-refund-controls's, is 12 563 bytes, and 15 214 with the traced replay of each of its nine failing purposes and the correspondence its reasons rely on; 18 432 leaves it a fifth of headroom.

Keep live node text readable inside each refusal step.

The size bound, purely: oversized receipts are an error naming the row and the byte count.

Load every receipt-*.json in a directory. A malformed receipt, an accepted row with no transactions or measurements, a refused row with no attribution, a partial verdict without its constructor accounting, a success verdict carrying partial constructors, or two receipts for one row is an error naming the file: evidence that does not parse is not evidence, and a guard that cannot fail is not a guard.

Write one receipt-ROW.json under the run's output directory. Receipts over maxReceiptBytes fail the run: a receipt nobody can open is weak evidence, and a size convention would quietly break on a later row.

The current tree's base commit. Nothing when git cannot say (no checkout, no git): receipts then match nothing and list prints the declared plan with a warning.