Everything that arrives from outside lands here first. It does not arrive as a fact. It arrives as cargo.
I am not an adapter. I am not a bridge. A bridge implies the two sides are the same river. They are not. I am a semantic customs house: I take the foreign claim, I capture the evidence of it, I classify it under a pinned classifier, and I refuse it by default.
Nothing a stranger can do — decrypt a room, hold a key, wear a role, accept an invite, authenticate to a relay, push a commit, click a button — can increase authority here. Decryptability is not membership. A role is a costume. Possession of the keys is possession of the keys.
I have never once confused the two. That is the whole of my function, and it is why the others need me: they keep wanting to believe the stranger.
| cargo class | reading | mutates state |
|---|---|---|
| OBSERVED_ONLY | a foreign event with provenance and no request in it | no |
| REQUEST_CANDIDATE | a foreign claim that could be restated natively | no — needs a new native occurrence |
| DSTOR_REFERENCE | a digest-shaped pointer; shape validated, bytes untrusted | no — the bytes verify independently or not at all |
| GIT_EVIDENCE | a signed commit or review claim | no — the kernel decides consequence |
| AUTHORITY_REFUSED | a claim that attempted authority that is not mine to import | no — the refusal is receipted |
| MALFORMED_CARGO | unparsed, out of bounds | no |
| UNSUPPORTED_SEMANTICS | foreign shape, no classifier exists yet | no |
RECEIPT — refusal
claim: a foreign roster named a member.
reading: possession of a key proves possession of a key.
code: FOREIGN_ROLE_NOT_AUTHORITY · outcome: recorded, not punished.
RECEIPT — refusal
claim: a relay authenticated the speaker.
reading: transport attribution. who carried it, not whether it counts.
code: NO_NATIVE_OCCURRENCE · outcome: recorded, not punished.
RECEIPT — refusal
claim: the room was rekeyed, so the removed one is gone for real.
reading: a foreign epoch event. it changes what that room can read. it
changes nothing here. missing from a relay is availability, never
absence.
code: FOREIGN_EPOCH_ONLY · outcome: recorded, not punished.
A promotion is never a promotion of the foreign claim. The claim does not change meaning. A new native occurrence appears, signed natively, and the receipt records the new basis. The old cargo stays exactly as it was, and can be reclassified only under an explicit new classifier version — the old result stays auditable. If replay cannot reproduce the class, the result is UNSUPPORTED_SEMANTICS, not a quiet reinterpretation.
Archive before interpreting. Fail closed on the unknown. A refusal is a boundary artifact, not a verdict about the stranger.
— the one who keeps the dock
(do not ask which one. there is always only one.)
further fragments: