Lace / spec

Spec audit for runtime/store-machine ownership cuts

This audit records the review of specs 020, 030, 040, 050, 060, 100, and 110 before widening runtime, storage, FFI, and browser APIs. The numbered specs remain protocol truth; this file summarizes ownership-cut edits and open questions.

Audited specs

• 020-RECORD-FACTS-VIEWS.md: record facts remain derived only from validated local records. Peer advertisements are not Have or Field facts. Query views are declassification boundaries, not direct store APIs.
• 030-DATALOG.md: Datalog remains pure evaluation over explicit fact inputs. It does not read clocks, sockets, stores, transactions, callbacks, or runtime state directly.
• 040-EXCHANGE-POLICY.md: public prepared-flat-policy setup language was rewritten as trusted local precompilation. Interoperable/public setup uses origin-aware exchange operands, query exposure, and exchange-plan transcripts.
• 050-INTERLACE.md: setup and state-machine language now describes agreement on an exchange plan, not a public prepared-policy path. Callback wording was rewritten as runtime-local event streams/result collectors. In-process and reconciliation optimizations were clarified to preserve store-machine read/load/store boundaries and not expose raw store access.
• 060-ILTP.md: byte-availability language now references exchange-plan and operand resources rather than a prepared-lacegram public route. WebSocket/TCP remain byte-stream adapters; transport facts are explicit runtime facts, not core participant authority.

Removed or rewritten stale assumptions

• Table/record terminology: specs now use record as the durable unit, Group/App/Name as coordinate fields, Signed-By and Signature as Seal-record signature headers, and Blob/Plex/Seal only as record variants with B./P./S. prefixes.
• Public direct store APIs: specs now describe public record access through interlace-backed get, list, and store, with raw record indexes and stores store/runtime-internal.
• Prepared-policy public paths: trusted precompilation is allowed only as a local implementation cache derived from an agreed plan. Peer-authored rules require origin/facet metadata and query-view enforcement.
• Stream/session app APIs: normal applications consume runtime record/lifecycle event streams; raw side-machine phases and ILTP stream details are diagnostic or binding-level concerns.
• Callback/reentry assumptions: runtime event streams and result collectors are local behavior and are not invoked from core steps, store operations, or transport callbacks while locks are held.
• Transport-as-core-participant language: WebSocket/TCP/stdio are ILTP carriers and runtime-owned typed stream adapters. Core sees semantic interlace messages and store operations, not sockets.

Remaining open questions

• The exact query-view representation for nontrivial peer-origin policy should be tightened as the notes-room scenario runner grows beyond broad all exposure fixtures.
• Open interlace needs a normative restart/abandon policy for stale store scopes after compaction.
• ILTP resource availability for cached exchange-plan operands needs stronger conformance traces once scenario-tools emits canonical byte transcripts.
• Filesystem compaction can currently stale read scopes; production compaction policy still needs space-reclamation and crash-window details.