# Sealed Baseline

> When the operating charter changes, freeze the displaced system at an exact revision and re-establish the live declaration — one recorded handoff instead of ad hoc realignment.

**Tier:** 1 · **Normative weight:** supports `TM-CUR-006`, `TM-CUR-009`
**Requires:** [Typed Current Projection](/docs/truth-machine/kit/current-projection/)

## Problem it removes

A repository's operating charter changes — a packet workflow is retired, a
declaration vocabulary is replaced, a responsibility moves — but the old
system's pinned claims remain, and the governed read keeps enforcing a
contract the charter already ended. Every reader failure is then argued
about individually: is this drift, or history? Without a named transition,
each repository resolves the question a different way, and "make the reader
green" quietly becomes the goal instead of truth.

## Mechanism

One accepted change performs the whole migration:

1. **Seal.** The current projection gains a `[[sealed]]` entry per frozen
   scope: the scope, the exact revision that froze it, and the reason —
   which charter change made the scope historical. The seal revision is the
   last revision at which the scope's claims were coherent, typically its
   final accepted transition.
2. **Verify against the seal.** The governed read holds sealed scopes
   byte-identical to their seal revisions — removal, modification, and
   addition are all mismatches — and verifies claims made by sealed
   material against the seal revision's tree, not the evolving worktree.
   A sealed-scope mismatch then means exactly one thing: frozen history was
   rewritten (`TM-CUR-006`). An unreadable seal revision is unknown, never
   a pass.
3. **Re-establish.** The live declaration carries forward only what is
   still operationally current. The sealing commit is the predecessor's
   half of an explicit handoff (`TM-CUR-009`): it names what stopped
   evolving, at what boundary, in one durable transition — and the
   predecessor never competes with the current account again. When
   authority moves to a receiving system, that system's own declaration
   completes the handoff; retirement in place is the degenerate case with
   no receiver.

The seal keeps declared and observed separate on both sides of the
transition: the old declarations stay verifiable against the world they
described, and the new ones against the world that is.

## Cost

Authoring: finding the correct seal revision is the real work — verify the
scope's claims actually hold there before sealing. Per change: none; a seal
is written once and never edited. Per session: none — the read gets
quieter, not noisier.

## Do not adopt when

The drift is in live state. A mismatch in something the repository still
operates is fixed or explicitly superseded, never sealed over — a seal is
for scopes whose *charter* ended, not for checks that are inconveniently
red. If nothing pins historical claims, there is nothing to seal.

## Evidence

Assessed in this repository's own reference instance: when the packet
workflow was retired as an editorial gate, the frozen packet directories
were sealed at their final accepted transition (`TMC-0005`), and
`truth_state.py` verifies the sealed records' document digests against that
revision — restoring a coherent read without rewriting a byte of history.
The divergent early packet vocabulary in kinra-corpus is the next intended
application.

## Template

The `[[sealed]]` block in
[`templates/current-projection/current.toml`](/docs/truth-machine/templates/current-projection/current.toml)
and the sealed-scope check in
[`templates/governed-read/state_reader.py`](/docs/truth-machine/templates/governed-read/state_reader.py).

## Related patterns

[Frozen Archive](/docs/truth-machine/kit/frozen-archive/) is the same
instinct by convention; a seal makes it machine-checked.
[Governed Read](/docs/truth-machine/kit/governed-read/) is where the seal
is enforced.