Module event 

EventRecord and the closed EventKind set: the value layer of “the Ledger is the only history”.

Invariants owned here:

• every kind belongs to exactly one window class; the single criterion is “does its payload decide model-request bytes”. The authority is EventKind::window_class — an exhaustive match, no catch-all, so a new variant forces an explicit classification.
• canonical bytes have one producer: EventRecord::canonical_line. Struct key order = declaration order; payload keys sort (BTreeMap); addr: None and ig: false are omitted; no line terminator. The chain hashes exactly these bytes (ledger module).
• Ledger payloads never carry floats (determinism rule 6): Payload rejects them at construction and again on deserialize.
• EventRef has private fields and no public constructor; minting requires holding a whole record (append path or replay after chain verification, 15.3-1).
• kernel neither samples clocks nor generates ids: TimeMs and RunId arrive as parameters. uuid v7 is human-readable identity only; RunId::CITY (nil) marks city-level records.

Modules

record

One serde struct per EventKind: the single authority for what a kind’s payload is called and what it holds.

Structs

EventDraft

What a recording party supplies; the Ledger implementation owns the rest (seq, prev, v).

EventRecord

One serialized history line. Fields private: the only paths to a record are EventRecord::from_draft (append side) and EventRecord::parse_line (read side).

EventRef

Unforgeable pointer at a ledger line: private fields, no public constructor, no serde (deserialization would be a third mint).

Payload

Ledger payload: a JSON object with every float refused, at construction and again on read (determinism rule 6). Keys serialize sorted (serde_json’s default BTreeMap), which is part of the canonical bytes.

RunId

Run identity; uuid v7 for humans, nil for the city itself. No generation here — the assembly layer (or a seeded simulator) mints.

Seq

Event sequence number; contiguous from Seq::FIRST, checked arithmetic.

TimeMs

UTC milliseconds as an integer (determinism rule 6). Always a parameter, never sampled inside kernel or memory.

Enums

EventKind

The closed event vocabulary.

Scope

What a halt, a release or an autonomy change applies to.

Who

The three parties a ledger line can be attributed to.

WindowClass

The two-way partition; the sole criterion is “does the payload decide model-request bytes” (C16). There is no third class.

Functions

escape_markup

<, > and & as entities, so text written into a marked-up section holds no angle bracket and cannot close that section or open another. The one escaper: the job file’s sections, a resident’s letter and a rebuilt opening all write through it, so what one renderer refuses the others refuse too (crates/city/spec/SpineFiles.lean D21, crates/runtime/spec/Conversation.lean §8-47-2).