Sealed Baseline

Tier: 1 · Normative weight: supports TM-CUR-006, TM-CUR-009 Requires: Typed Current Projection

Problem it removes

A repository’s operating charter changes — a packet workflow is retired, a declaration vocabulary is replaced, a responsibility moves — but the old system’s pinned claims remain, and the governed read keeps enforcing a contract the charter already ended. Every reader failure is then argued about individually: is this drift, or history? Without a named transition, each repository resolves the question a different way, and “make the reader green” quietly becomes the goal instead of truth.

Mechanism

One accepted change performs the whole migration:

1. Seal. The current projection gains a [[sealed]] entry per frozen scope: the scope, the exact revision that froze it, and the reason — which charter change made the scope historical. The seal revision is the last revision at which the scope’s claims were coherent, typically its final accepted transition.
2. Verify against the seal. The governed read holds sealed scopes byte-identical to their seal revisions — removal, modification, and addition are all mismatches — and verifies claims made by sealed material against the seal revision’s tree, not the evolving worktree. A sealed-scope mismatch then means exactly one thing: frozen history was rewritten (TM-CUR-006). An unreadable seal revision is unknown, never a pass.
3. Re-establish. The live declaration carries forward only what is still operationally current. The sealing commit is the predecessor’s half of an explicit handoff (TM-CUR-009): it names what stopped evolving, at what boundary, in one durable transition — and the predecessor never competes with the current account again. When authority moves to a receiving system, that system’s own declaration completes the handoff; retirement in place is the degenerate case with no receiver.

The seal keeps declared and observed separate on both sides of the transition: the old declarations stay verifiable against the world they described, and the new ones against the world that is.

Cost

Authoring: finding the correct seal revision is the real work — verify the scope’s claims actually hold there before sealing. Per change: none; a seal is written once and never edited. Per session: none — the read gets quieter, not noisier.

Do not adopt when

The drift is in live state. A mismatch in something the repository still operates is fixed or explicitly superseded, never sealed over — a seal is for scopes whose charter ended, not for checks that are inconveniently red. If nothing pins historical claims, there is nothing to seal.

Evidence

Assessed in this repository’s own reference instance: when the packet workflow was retired as an editorial gate, the frozen packet directories were sealed at their final accepted transition (TMC-0005), and truth_state.py verifies the sealed records’ document digests against that revision — restoring a coherent read without rewriting a byte of history. The divergent early packet vocabulary in kinra-corpus is the next intended application.

Template

The [[sealed]] block in templates/current-projection/current.toml and the sealed-scope check in templates/governed-read/state_reader.py.

Related patterns

Frozen Archive is the same instinct by convention; a seal makes it machine-checked. Governed Read is where the seal is enforced.