Module independence 

The author≠checker independence reading, derived from provenance.

A check record confirms an acceptance criterion only when the party that did the work did not record it. Until 2026-09-02 the reading compared a check’s identity with the identity that CREATED the criterion entity — and the planning session authors criteria while the executing session checks them, so the executor’s own checks read confirmed_independent (found twice by the evidence-engine bundle, once on a wrong check). The comparator now (decision basket line 9, option a): a check on a criterion reads confirmed_independent only when its identity differs from every identity that mutated the verified plan, its criteria, or its session-log notes since the criterion was written; a check under one of those identities reads self_checked; a check or a record without an identity stays unconfirmable. Identities are the only comparator; roles and the transport pair are recorded context. Nothing is stamped: the reading is computed at read time from the append-only provenance record, so every existing ledger keeps parsing and derives under the new rule.

The transition_requires_checks gate consumes the same reading: a plan cannot complete on the executor’s own checks.

Structs

CheckStanding

One entity’s standing before the gate: its derived check state, and for an ok-checked entity the independence of that check.

Executors

The executors of one criterion: the identities the reading compares against, and the plans the set was drawn from.

MemTouches

One mem’s mutation touches by entity: (timestamp, identity) per touch, from the mem’s provenance record (the git-branch note trailers, or the folder ledger). Built once per mem and shared by every derivation in one pass.

Enums

Independence

The independence half of a check’s standing.