Where a Settlement Is Disturbed After a Third Party Has Consumed It
Two parties settle a matched pair (600) of governed observations. A settlement-lineage recorder at each party appends a settlement-lineage entry (606) to that party's own append-only lineage field (104), recording the two governed observations, the pairing determination, the cryptographic binding, each escrow event, each failure and rollback, and each downstream consumption of the settlement record. Each party holds its own per-party settlement lineage, reconstructible without recourse to the counterparty and without recourse to any registry.
A third computing party may then act on that settlement without having been party to it. In the disclosed arrangement, a relying party independently verifies the settled matched pair (600) against the counterparty identity records (114) it holds for both settled parties, produces a determination consuming that settlement, and appends a reliance record to its own append-only lineage field (104). That record carries the settlement identifier, a consuming-determination reference identifying the exact determination with its action class and scope partition, the relying party's identity primitive, and its attested epoch, and it is bound to exactly one settlement and one determination. The relying party emits the record to both settled parties as a governed observation, complete upon emission and soliciting no acceptance.
A settled pair is subject to challenge only through a credentialed dispute procedure. That procedure renders a resolution that may include a settlement reversal, a settlement amendment, a compensation directive, or a no-change outcome. A reversal is given effect by the settled party appending a reversal record that enumerates each reliance entered under the settlement identifier and emitting a reversal notice to each relying party so enumerated.
The relying party is then holding a determination produced from a settlement that the settled parties have reversed or amended. Repairing that state by erasure is not available to it. The append-only lineage field (104) admits appends and, for the entries relied upon by the disclosed mechanisms, admits no deletion and no modification of an appended entry. A settlement-lineage entry (606) in particular is neither removed nor modified, a subsequent reversal or amendment being itself appended. The disclosed response is likewise an append.
Appending the Mark, Barring the Input, Re-Resolving the Determination
Verification precedes the write. A relying party receiving a reversal notice verifies it against the counterparty identity record (114) of the emitting settled party. Such a record is held for each counterparty with which the agent has interacted and carries an identity primitive of that counterparty and the states it has previously attested.
The relying party then appends to its append-only lineage field (104) a reversal mark carrying four elements:
- the settlement identifier;
- the resolution class;
- the emitting identity and epoch;
- a reference to its reliance record.
Because a reliance record is bound to exactly one settlement and one determination, and carries a consuming-determination reference with the action class and scope partition, the fourth element identifies which determination is implicated. The settlement the mark names is not deleted.
The mark then governs what may enter a determination. Thereafter the relying party tests each settlement identifier presented as a determination input against its reversal marks, and one bearing a reversal-class mark is not admitted. The test runs against marks the party holds in its own lineage field (104).
Two paths follow, keyed to the resolution class carried in the mark.
Where the class is a reversal, the relying party re-resolves the referenced determination with the barred input unavailable, emitting an outcome of its recorded abstention class (126). This is consistent with the architecture's general treatment of a missing input: where an input required by a determination is unavailable, incomplete, or unresolvable, the determination emits an outcome entry of a recorded abstention class identifying the unavailable input, and does not emit an outcome adverse to the semantic agent (100), adverse to an asserting party (118), or adverse to a counterparty.
Where the class is an amendment, the relying party re-resolves against the amended terms. The disclosure states the further step conditionally: if the amended terms supply every consumed input, the re-resolution produces a fresh determination and a fresh reliance record. The fresh determination and fresh reliance record are recited on that condition rather than as an unconditional result.
Whichever path runs, the outcome propagates to consuming determinations under the conversion bar (502) and is adverse to no settled party. The conversion bar (502) forecloses a consuming determination from converting an abstention outcome into a scalar value, into a default value, into an operand of a threshold comparison (510), or into a consequence adverse to any party. That foreclosure is affirmative, barred by the structure of the values themselves rather than by an absence of defined behavior: the outcome entry and a magnitude are values of disjoint types with no total function mapping the former to the latter, a threshold comparison of the outcome entry emits an outcome of the recorded abstention class and not a Boolean, and an accumulation over a set containing the outcome entry emits an abstention outcome and not a sum computed over the remaining members.
Propagation is bounded within the party's own lineage. As recited for one-hop propagation along a reliance chain, propagation within a party's own lineage is bounded by a re-resolution cascade bound declared in that party's signed policy object (112), the traversal terminating in a recorded abstention state rather than unbounded recursion.
Classes, Bounds, and Effect Timing
No numeric threshold, latency, or benchmark figure is recited for this mechanism. What is recited is structure, a class enumeration, and one policy-declared bound.
Resolution classes. The credentialed dispute procedure renders a resolution that may include a settlement reversal, a settlement amendment, a compensation directive, or a no-change outcome. The mark carries the resolution class, and separate paths are recited for a reversal and for an amendment.
Reversal mark contents. Settlement identifier, resolution class, emitting identity and epoch, and a reference to the reliance record, which is itself bound to exactly one settlement and one determination. The settlement named is not deleted.
The re-resolution cascade bound. Declared in the signed policy object (112) of the party, with traversal terminating in a recorded abstention state rather than unbounded recursion. No value is recited for it. That policy object is authored by a principal to which the semantic agent (100) is bound, is covered by that principal's signature, and carries the declared bounds, weights, and coefficients consumed by the computations of the disclosure; the agent does not author it and modifies it only by admitting a successor.
The upstream condition on notice. A reversal notice is emitted where the reliance-completeness predicate is satisfied at the reverting party. That predicate is satisfied only where, for every reliance record entered in that party's own reliance register under the settlement identifier, the enumeration in the reversal record carries a matching entry by relying-party identity and consuming-determination reference. Where it is not satisfied, the reversal record is appended as an attempted-reversal entry and the settlement is not reversed.
Effect timing. A semantic agent (100) recomputes a dispatch-authority predicate responsive to each request to dispatch an action, from state then carried in the memory field (102), and not from a previously issued authorization token, a cached predicate result, or a session grant. An append to the append-only lineage field (104) accordingly takes effect at the next dispatch request without revocation infrastructure.
Composition With Reliance Registration and the Reliance Chain
Three recited steps sit in sequence, and this mechanism is the third.
Registration is the first. The relying party verifies the settled matched pair (600) against the counterparty identity records (114) it holds, produces its consuming determination, appends its reliance record, and emits that record to both settled parties. Each settled party, on verifying it and resolving the settlement identifier to a settlement-lineage entry (606) of its own, enters it in a reliance register indexed by settlement identifier and appends a reliance acknowledgment.
The condition on reversal is the second. A settled party reversing or amending a settlement appends a reversal record carrying a reliance enumeration field and evaluates the reliance-completeness predicate by an evaluator in its own memory field (102). That condition rests upon the reverting party's own enumeration alone: no other party is polled, votes, or responds, and the non-response of a relying party neither prevents nor conditions the reversal.
The reversal mark is the third, and it operates entirely within the relying party's own state: an append to its own lineage field (104), a bar on its own determination inputs, and a re-resolution of its own determination.
Upward, the mechanism meets the reliance chain. A party consuming not a settlement but another party's reliance-bearing determination appends a reliance record carrying, in place of the settlement identifier, an upstream-reliance reference naming that other party, the entry of its lineage at which its reliance record was appended, and the settlement identifier ultimately relied upon. A sequence of such transitive reliance records, each referencing the next and terminating in one carrying a settlement identifier, constitutes a reliance chain, and each party holds a register of the parties immediately downstream of it and no enumeration of the whole chain. A chain party that admits a reversal notice and appends its mark and re-resolution then emits a transitive reversal notice to each downstream party enumerated in its own register, carrying its own reliance record identifier, the settlement ultimately reversed or amended, the resolution class, any amended terms, and a hop count. Each downstream party treats that notice as a reversal notice, appends its own mark, re-resolves, and discharges the same duty onward, so the reversal reaches a chain of arbitrary length.
Laterally, the mechanism draws on outcome machinery recited elsewhere in the disclosure: the recorded abstention class (126), the general invariant for an unavailable required input, the conversion bar (502), the append-only property of the lineage field (104), and the counterparty identity record (114) against which the notice is verified.
Distinguishing Revocation Infrastructure, Ledger Rollback, and Compensating Transactions
Several established categories address a superficially similar problem, and each differs structurally.
Revocation infrastructure. Certificate revocation lists, status responders, and equivalent distribution mechanisms invalidate a credential centrally and have relying parties consult an external service, or a cached copy, at validation time. Here the bar lives in the relying party's own append-only lineage field (104), and the disclosure recites that an append to that field takes effect at the next dispatch request without revocation infrastructure, the dispatch-authority predicate being recomputed rather than read from a cache.
Ledger rollback and consensus-ordered commit. Atomic swaps and hashed timelock contracts require each leg to be committed to a distributed ledger whose ordering is established by a consensus authority, and two-phase and distributed-consensus commit protocols coordinate parties through a coordinator or quorum that fixes a single agreed ordering. Reversal in those systems is an ordering event applied to shared state. In the disclosed arrangement each party holds its own lineage, the settlement-lineage entry (606) is neither removed nor modified, and the reversal is an added mark bearing on that party's own determination inputs.
Escrow and intermediated unwind. Escrow arrangements interpose a trusted third party that holds the subject of the exchange and releases it upon a release condition, and the unwind runs through that intermediary. The reversal mark interposes nobody: verification runs against the counterparty identity record (114) the relying party already holds, and that party re-resolves its own determination.
Compensating transactions and saga patterns. These correct a completed step with an offsetting step, which requires the effect to be expressible as a compensable quantity. This mechanism removes an input and re-resolves instead, and the conversion bar (502) forecloses turning the outcome into a scalar value, a default value, an operand of a threshold comparison (510), or a consequence adverse to any party.
Soft-delete and tombstone semantics. Marking a row deleted while retaining it is a storage convention. The reversal mark is a separately appended entry carrying the resolution class, the emitting identity and epoch, and a reference to the reliance record, and it conditions admission of a settlement identifier as a determination input.
These are structural comparisons between categories of technique, and nothing here characterizes any particular product, implementation, or party.
Disclosure Scope
The mechanism described here is disclosed in U.S. Provisional Application No. 64/117,812 at Section 10.5, paragraph [0410], titled "Relying party's reversal mark and re-resolution." Supporting disclosure appears at [0408] and [0409] for the reliance record and the reliance-completeness predicate, at [0411] and [0412] for the reliance chain and one-hop propagation, at [0229] for the credentialed dispute procedure, at [0209] for the settlement-lineage entry (606), at [0022], [0023], and [0029] for the append-only lineage field (104), the signed policy object (112), and the dispatch-authority predicate, and at [0149], [0159], and [0160] for the abstention invariant and the conversion bar (502).
This article is published as a technical disclosure describing an embodiment as filed. It does not enlarge, narrow, or amend the disclosure of the application, and claim scope is determined by the claims as they issue.
