The proposer cannot ratify

An agent reading across our corpus notices that two pieces belong together and wants to say so. The format it must use to say it is a small document with eight required fields, and three of them decide the whole governance. The status field permits exactly one value, proposed. The promotion flag permits exactly one value, false. The field naming who filed it is documented, in the schema itself, as the claim proposer and not the authority, which is the whole design in five words and the reason we call this the proposer-authority split.

Read those three constants as a group and something quietly severe becomes visible. A document asserting that it has been accepted is not a claim we would reject. It is not a claim. It fails validation on its shape, the way a date of the thirty-second of a month fails, and it never reaches anyone with the standing to disagree with it. There is no ratified claim in the system to review, no permission to check, and no policy string for a persuasive request to talk its way past.

The mechanism is a constant standing where a rule would ordinarily stand, because pinning the status to one value and the promotion flag to one value removes from the format the sentence in which a proposer records its own proposal as accepted, and a sentence that cannot be written needs no rule against writing it. This is the same move the corpus argues for consent that fails the build, applied to authority rather than to permission, and it costs two lines of schema.

What the format leaves out has to happen somewhere, and it happens in the open. Promotion means an operator opens the node the claim was about, writes the edge into that node’s own relations, and deletes or archives the claim, which is an ordinary reviewed edit with a name attached to it. Our graph contract states the principle in the same words it uses for the editorial gates. Proposal is open, ratification is not. Agents file freely and constantly, and none of that filing moves anything, which is precisely what makes the filing safe to encourage.

The arrangement is old enough to have an accounting name. Segregation of duties, the internal control requiring that the person who initiates a transaction is not the person who approves it, is standard in every serious financial control framework, and it exists because the two roles collapse quietly and the collapse is invisible from inside the books. The cathedral builders had a version of it in stone. A mason’s mark recorded who cut a block, which is a claim about provenance, and it never recorded that the block was fit to set. The lodge decided that, and the two marks were never the same mark.

The reason this matters more each month is arithmetic. Machine systems now read and relate faster than any reviewer can, and a graph that lets its readers write their own conclusions in becomes, within a few weeks, a structure whose shape is a summary of what its most prolific reader believed. Keeping the proposal cheap and the ratification human does not slow the reading down at all; it only refuses to let volume become authority. The cathedral gets its stones from everyone who can cut one, and someone still has to say where they go.