Why each field exists

The schema is the merge of two drafts. This records what each side contributed and what the merge is defending against, so a future change does not quietly undo a deliberate constraint.

What the estate draft contributed

changes.ownership_delta is the strongest field in the receipt. It makes Net-Negative Ownership mechanically checkable per run rather than assessable in a quarterly audit. Nothing else in the estate does this.

work.existing_work_searched and work.duplicate_work_created enforce curate-before-create at the moment of work creation, which is the only moment it is cheap.

The factory block has no equivalent anywhere else. private_todo_remaining catches an agent keeping state in its head rather than in Beads. polling_used catches manual terminal polling that events and orders already replace. unsupported_internal_hack_used catches reaching into Gas City internals rather than composing on documented primitives. temporary_artifacts_remaining catches exhaust.

routing models the real handoff (mail, sling, return_condition, wait_state, next_bead) rather than a vague recommendation. wait_state matters because an event-driven city needs to know whether an agent is blocked on a dependency, an event, an order, mail, or genuinely has nothing to do.

terminal.durable_transition_established generalizes "work on disk is not done" into a single checkable assertion that covers every terminal state, not just completion.

verification.criteria[].falsification_condition is the best epistemic field in either draft. Expected versus observed is easy to write after the fact. Stating what would disprove the claim is not.

evidence as a top-level array with capture_method per claim, and classifications drawn from the BluCity-Docs vocabulary rather than a parallel scale.

What the second draft contributed

economics, without which a receipt cannot feed the recurring model. Cost per accepted outcome is the number the business rests on, and human review minutes is the number that answers the capacity question.

factory.secrets_referenced and human_gate.auth_blocked, without which the Authentication and Secrets Constitution had nowhere to live and was unenforceable.

authority.mode, granted_for and policy_decision, without which the earned-authority ladder could not be checked and an OBSERVE agent could report an applied change.

actions[], which makes the mechanism ladder visible. Without it there is no way to see a deterministic task being run on a strong model, which is the most common quiet cost defect.

customer_visible, so ContextControl renders customer language the agent wrote rather than deriving it from internal fields and leaking vocabulary.

run identity and timestamps, so receipts can be correlated and runs timed.

changes.artifacts, because a list of file paths is not a change record. Whether something is a merge request, whether it was applied, whether it was reviewable and whether rollback is proven are the questions an operator actually asks.

The four holes the merge closed

The first draft allowed verification.criteria: [] with overall: PASS, which is precisely the hole the three-word verdict vocabulary exists to close. INV-02 closes it.

It allowed result.status: PASS alongside requested_effect_achieved: false and alongside verification.overall: UNKNOWN, with four status fields and no precedence. INV-01 fixes the precedence and the skill states it once.

duplicate_work_created: true had no consequence, and the three anti-pattern booleans had no teeth. INV-08 and gate rules G-05 through G-07 give them consequences.

terminal.receipt_complete was the receipt certifying its own completeness. The validator now stamps it and agents emit false.

Naming

HISTORICAL became HISTORICAL_SUPERSEDED to match the Evidence State table already used by the product-definition skill. Two vocabularies for one concept is exactly the drift the context curation skill exists to find, and it is cheaper to align now than after receipts exist.

Migration

v1 to v2 is not backward compatible. Newly required: run, actions, economics, customer_visible, authority.mode, authority.granted_for, authority.policy_decision, work.acceptance_criteria, changes.artifacts, factory.secrets_referenced, human_gate.auth_blocked. For an estate this size that is cheaper before the first pilot receipts exist than after.

The rule for changing this schema

Every invariant proves it rejects a violation, in scripts/conformance_test.py. An invariant with no rejection test is a comment with extra syntax. A new field that nothing gates on is a field that will be filled in with whatever is convenient.