3.3 Record classes and schemas (TPS 0.4.0)
Instruction artifact, machine-optimized text: TPS, section 3.3 Record classes and schemas. Part of TPS and the TPM hub. Human-only edit (TPS 5.13). TPS 0.1.0 was declared final at revision 4 on 2026-09-22, a version declaration recorded in the foundations record; the chain begins at TPX's first landing (TPS 5.6.7). TPS 0.1.1, which changed only the status lines, was declared final on 2026-09-26, and TPS 0.3.0, revision 6, on 2026-09-28. This page is revision 7 of the tree, proposed as version 0.4.0 until H-DECL declares it; revision 6 is carried whole, and revision 5, proposed as 0.2.0, stays undeclared. The text below is this section of the TPS artifact at 0.4.0 (proposed), verbatim; the whole artifact and its file digest are on The Principia Machina/TPS. Human readers: the contents page is the map.
TPS 3.3 RECORD CLASSES AND SCHEMAS
purpose: the master record and its two departures; the entry-status,
corroboration, withdrawal, named-gap, verification and
assumption record forms; the master record's GRADE; the HOLD
and RELEASE record forms, with the bibliography list; the
status value HELD; a ledger MATCH as a reproduction; the
promotion record; the objective EOM-0
governs: 3.3 | version: 0.4.0 (proposed) | class: instruction artifact
audience: operator, agent
3.3.1 MASTER RECORD. The register's representation of the TFK. It
cannot be amended (a change is a new UWC). It is <prefix>-1,
allocated by TPX at instantiation, outside every lease and never
by the UWC's mark, on the landing of the certificate by which
H-DECL certifies the UWC (5.5.4), the rest of volume 1 after the
instantiation gaps VOID. Every other record is checked at CAC
against the register and against the master record. Its form, the
table's class MASTER: ID <prefix>-1; UUID; PREFIX; D_TPK, D_TRM,
D_TMS and D_TFK, D_TFK their combination; CERTIFICATE, the
DECLARATIONS line; STRUCTURE_LINE; MODULES_USED, by reference.
Its GRADE is NOT GRADED, fixed at landing; it carries no STATUS.
[I-032] [D192.2] [D193.2]
3.3.2 Entry-status record, the class ENTRY_STATUS: ENTRY, a TrM entry
name, and the prose fields a lead writes, RIDER, NOTE, SCRUTINY
and CHECKS_OWED, at least one; the newest ENTRY_STATUS of an
entry stands for it and names no SUPERSEDES; its GRADE is NOT
GRADED. STATE and RECORDS are the ENTRY VIEW's, computed on
demand and stored nowhere: the records bearing on the entry by
status, its open gaps and its verifications (see 2.1.3). Nothing
is written on the TrM entry, the TFK being immutable. [B-05]
[D201.1]
3.3.3 Withdrawal record: a strike is a withdrawal record in the strike
shape (see 4.6). Its form, TPX-written from the reserved range
(3.1.11), one record per act: [withdrawal_id, WITHDRAWAL, cause,
withdrawn, withdrawn_by, status_set, prior_status, superseded_by,
locus_gap, still_stands, cascade, tps_version, d_tms, digest];
cause SR1, SR5, AUDIT, AUTHOR, SUPERSEDED or INHERITED;
status_set REFUTED for SR1, SR5 or an audit's strike, WITHDRAWN
for an audit without a strike, AUTHOR or SUPERSEDED, and for
INHERITED the predecessor's grade, REFUTED or WITHDRAWN; the
digest digest_fields over ["TPC-WITHDRAW", "1", ...] the tagged,
counted list, sorted lists first, as the HOLD's (TPC
withdrawal_record, withdrawal_preimage). THE CASCADE: every
standing record whose CITES or ASSUMPTIONS closure reaches the
withdrawn record takes the grade WITHDRAWN in the same act,
listed with its prior status (TPC withdrawal_scope), except those
still_stands names, which only H-DECL's audit decision may name;
a HELD record in the cascade keeps WITHDRAWN as the most a later
RELEASE restores. WHO: SR1 and SR5 by TPX where the test is
MECHANICAL; an audit's outcome by H-DECL's decision item; AUTHOR
by the record's AUTHOR account only, WITHDRAWN only, requested of
TPX through PRB; SUPERSEDED by landing a record whose SUPERSEDES
names the old, by the old record's AUTHOR or on H-DECL's
decision; INHERITED by TPX at COPY-FORWARD, one per inherited
record whose predecessor's grade is REFUTED or WITHDRAWN,
withdrawn_by the predecessor's full identifier, prior_status
PROVISIONAL, still_stands and cascade empty (3.4.2). No account
requests REFUTED or INHERITED. [I-078] [D194.1] [D215.2]
3.3.4 Corroboration record: a refused block whose result matches the
landed one lands as a corroboration record naming the record it
reproduces, carrying the reproducing account as its AUTHOR and
the outcome of TPX's comparison (5.9.7, 5.9.12); the block closes
as CORROBORATED (see 5.9). A REPRODUCTION block's match lands the
same way whether the lead commissioned it or TPX did as a PARROT
(5.9.11, 5.17.2); a within-UWC parrot's match is a corroboration
record in the source register, and a cross-UWC parrot's pass
lands on the COMMUNITY LEDGER and nowhere else (5.9.12). A
mismatch is a NON-CORROBORATION, logged, never a corroboration
record (5.9.7). Its form, the class CORROBORATION: TARGET, the
RESULT reproduced, which the reproducer names; OUTCOME, MATCH or
MATCH WITH DIFFERENCE NOTED; DIFFERENCE, prose, the difference
TPX's comparison notes, with MATCH WITH DIFFERENCE NOTED only;
INDEPENDENCE (3.3.8); TARGET_STATUS, the target's status word at
landing; OUTCOME, DIFFERENCE, INDEPENDENCE and TARGET_STATUS are
TPX's, and a push carrying one is refused (3.2.17);
SELF_REPORTED, the reproducer's, optional, consumed by no rule
(3.3.9). Its GRADE is PROVISIONAL at landing. [B-11] [D118.1]
[D119.1] [D192.2] [D193.2]
3.3.5 Named-gap record: an M contradiction of an L record with a(r) > 0
is recorded against r's ASSUMPTIONS as a named gap (SR7); the
ASSUMPTIONS of a struck record outside the closer record's closure
are recorded as the locus (SR5); an untied DOF is a named gap
(see 2.3.6, 4.4). [I-074] [I-072] [I-124]
AMENDED (D176.1). An unknown DOF that the structure check finds
determined by no form (UNDER) is a named gap as well, named on
the STRUCTURE LINE with its question; under STRUCTURE_CHECK ON
it opens EOM-0 (2.2.20, 3.3.16).
One NAMED_GAP record per gap, written by TPX, GRADE NOT GRADED
(D199.1): SOURCE, one of IC2, UNDER, SR5_LOCUS, SR7_ASSUMPTIONS
or SR7_DOMAIN; AGAINST, TPK DOF names (IC2, UNDER), register
identifiers (SR5_LOCUS, SR7_ASSUMPTIONS) or the one member "TFK
DOMAIN" (SR7_DOMAIN); TRIGGER, the certificate and its STRUCTURE
LINE (IC2, UNDER) or the withdrawal or contradicting record
(SR5_LOCUS, SR7); STATEMENT, TPX's text from its template per
SOURCE (TPC gap_records). IC2 and UNDER gaps are written at
instantiation as the records after the MASTER, sorted by SOURCE
then DOF (5.5.4); SR5 and SR7 gaps from TPX's reserved range when
found. The STATE LINE, which TPX writes into the gap's own text
and rewrites only when it changes, outside the digest, reads
OPEN; SETTLED <date> BY <identifiers>; or STANDING <date> BY
<declaration line> (5.6.17) (TPC gap_state). An UNDER gap is
SETTLED by the records that settle it (3.3.16) or STANDING by
H-DECL's line; IC2, SR5 and SR7 gaps stay OPEN in their UWC and
close only by a successor. The records a gap touches are the GAP
VIEW, computed on demand and stored nowhere. [D199.1]
3.3.6 Verification record: veracity lives outside the run: derivation
under benchmark quarantine, then post-termination comparison
against external sources, landing as a regime-M verification
record whose external value is a benchmark, never an output. A
comparison reports the difference, never the agreement (see 7.1).
Its form, the class VERIFICATION, REGIME M: TARGET, a RESULT;
EXTERNAL {VALUE, U_C, UNIT, QUANTITY, the TARGET's}; SOURCE, a
BIB ID in its LITERATURE under a BIBLIOGRAPHY SETTING ON or
CLOSED, a prose citation under OFF, INSPECTION; AT, equal to the
TARGET's; DIFFERENCE {VALUE, the target minus the external value
in coherent SI; U, the root sum of squares of the two u_c, an L
target's 0; ZETA, VALUE over U}, computed by TPC
(verification_difference), presented from executed TPC-PY and
recomputed by TPX; no field states agreement. TPX refuses a
verification landing in the same push as its TARGET or before it
(verification_order); a SOURCE entry landed before the TARGET is
flagged for the lead's INSPECTION. Consequences: the SR3 test
between the TARGET and EXTERNAL under the UWC's k and equal
CONDITIONS; an L TARGET failing it is SR7, never a strike, a
NAMED_GAP SR7_ASSUMPTIONS when a(r) > 0 or SR7_DOMAIN when a(r) =
0, landing as a restriction or a successor only by human
declaration; an M TARGET failing it opens an audit block (4.1.6).
A VERIFICATION never enters SR3 against other register records,
SR5, SR6's counts, SR8's scale groups, the probe corpus or
promotion; its grade is PROVISIONAL or WITHDRAWN, its STATUS
UNMARKED or HELD. [I-125] [D200.1]
3.3.7 ASSUMPTION RECORD. One declared assumption, one record. Named
departures from the record form: no FINDING, no REGIME. Its
identifier comes from the UWC's prefix as any record's does.
Atomicity and duplication are inspected once, at the assumption
record's allocation (see 4.2, row 23). Its form, the class
ASSUMPTION: PROPOSITION, prose, required, and REFS, required,
possibly empty; a SITUATION record (3.2.15) carries SITUATION,
DOF, VALUE, UNIT and AT and no EQUATION or ROLE; any other
ASSUMPTION may carry EQUATION and ROLE (3.3.16). T2's syntactic
rule (2.2.3) refuses a bundled PROPOSITION at landing,
MECHANICAL, before row 23's inspection. [D41.2] [D192.2] [D196.1]
[D198.1]
3.3.8 The corroboration record gains INDEPENDENCE, filled by TPX from
facts it holds: account; model snapshot and vendor;
implementation name and digest; block origin, one of SAME BLOCK
or REPRODUCTION BLOCK; NOT SERVED BEFORE, that TPX did not serve
the target record to this account through the buffer path before
the block, consumed by source selection and displayed, by no
ranking rule (5.17.4); SAME-SPONSOR, that the reproducing account
and the author's account have one sponsor (5.14 CR12), a match so
marked weighing zero for the sponsor's own evidence under every
setting and for the agents unless CROSS-CORROBORATION allows it.
MECHANICAL. A community-ledger MATCH carries the same vector
(3.3.15). On the record the vector is spelled {ACCOUNT, SNAPSHOT,
VENDOR, IMPLEMENTATION, ORIGIN, NOT_SERVED_BEFORE, SAME_SPONSOR,
SAME_MODEL}, TPX's. [D42.1] [D44.1] [D118.1] [D127.1] [D128.2a]
[D192.2]
3.3.9 Context, sources, environment and seed MAY be attached to a
corroboration, marked SELF-REPORTED. No rule consumes them.
[D42.1]
3.3.10 A corroboration whose model snapshot equals the original's is
marked SAME-MODEL and is excluded from every corroboration count
TPX displays and from CR7's redundancy claim (see 5.14).
[D42.1]
3.3.11 HOLD RECORD (D111.1). Written by TPX after a failed canary, from
its reserved range (3.1.11), as the audit trail of a hold. Form:
[hold_id, HOLD, canary_id, account, snapshot, failing_block,
anchor_kind, anchor_block, lookback_passes, held_blocks, seeds,
held, biblio, digest]
anchor_kind is PASS or ADMISSION (5.14 CR6); held_blocks the
blocks from the anchor to the failing block inclusive, in history
order; seeds the records held directly; held the list
[[id, prior_status], ...] sorted by identifier in code point
order; biblio the list [[bib_id, check], ...] of the BIBLIOGRAPHY
ENTRIES the account proposed or landed in the held blocks whose
re-run CHECK value is not CONFIRMED, sorted, empty when the UWC
keeps no bibliography or nothing is listed (5.21.13; D171.1). The
digest is digest_fields (2.5.10) over the tagged, counted, flat
field list ["TPC-HOLD", "2", canary_id, account, snapshot,
failing_block, anchor_kind, anchor_block, lookback_passes,
n_blocks, block..., n_seeds, seed..., n_held, id, status, ...,
n_biblio, bib_id, check, ...], seeds, held and biblio sorted
first, so one hold digests alike whatever order its lists arrive
in; hold_id is the address and is outside the digest. Form "2"
replaced form "1" when the bibliography list was added; a HOLD
without the list is refused. TPX refuses to write an empty hold: a
failing block that landed nothing, supplied no corroboration and
vetted no RETURN holds nothing, and the failure's own record is
the canary outcome (5.17.15, 5.18). A record already HELD or
REFUTED inside the closure is listed with that status as its
prior status; at release it is restored no further than a HOLD
still in force allows, a check TPX makes over every HOLD not yet
fully released. [D111.1] [D171.1]
AMENDED (D193.2). The prior status the held list carries is the
record's status word: its STATUS when HELD or REFUTED, otherwise
its current grade (3.2.10); form "2" and the vectors are
unchanged.
3.3.12 RELEASE RECORD (D111.1). Written by TPX after an eligible reproduction
matches a held record. Form:
[release_id, RELEASE, hold_id, hold_digest, kind,
reproduction_id, account, snapshot, restored, still_held,
biblio, digest]
kind is REPRODUCTION (a REPRODUCTION block, 5.9.9) or
LEDGER_MATCH (3.3.15); restored the list [[id, restored_status],
...] and still_held the identifiers this hold still holds, both
sorted; biblio the HOLD's bibliography list carried unchanged, a
release moving no entry. The digest is digest_fields over
["TPC-RELEASE", "2", hold_id, hold_digest, kind, reproduction_id,
account, snapshot, n_restored, id, status, ..., n_still, id, ...,
n_biblio, bib_id, check, ...]. TPX first recomputes the HOLD's
digest, the bibliography list inside it, and refuses a mismatch;
then checks eligibility: the reproducing account is not the held
account; the reproduction is not SAME-MODEL, by the attested flag
or by a reproducing snapshot equal to the held snapshot, either
refusing; its origin is REPRODUCTION BLOCK (a SAME BLOCK
corroboration is not a reproduction). Then the matched seeds
leave the seed set, the closure is recomputed over the remaining
seeds, and every held record no longer reached is released with
its prior status; a matched record still reached by a remaining
seed stays held, since a standing record may not cite a held one;
a release that would release nothing is refused. A mismatch, or
no eligible reproducer, opens an audit block whose decision item
strikes, restores or restricts DOMAIN (4.1.6). The form number
"2" is the HOLD's (3.3.11), so the two records move form
together. [D111.1] [D171.1] [D204.1]
AMENDED (D193.2). On release TPX writes STATUS from the restored
word: HELD stays HELD while another hold is in force, REFUTED
stays REFUTED, a grade word gives UNMARKED; a release moves no
grade.
3.3.13 HELD PROPAGATION (D111.1). The held set is the closure over
reverse edges from the seeds: a record is held when any
identifier in its CITES or its ASSUMPTIONS is held, transitively,
a visited set stopping a cycle; an identifier that is not a
record of the register (the TFK's) is ignored. The seeds, each
bounded by the held blocks, are: (S1) a record the account
authored in a held block; (S2) a corroboration the account
supplied in a held block; (S3) a record the account vetted as
AI-LEAD, in the lead's own block at incorporation, its VETTED_IN,
defaulting to the record's own BLOCK when none is recorded, that
block being held. The account's older work is reviewed, not held
(5.14 CR6). The functions hold_scope, held_closure, hold_record
and release_record are TPC functions with vectors in both
residences (5.1.5). [D111.1] [D192.2]
3.3.14 WITHDRAWAL SETS THE GRADE (D111.1, D193.2, D194.1). A strike is a
separate WITHDRAWAL record (3.3.3, 4.6) and writes STATUS REFUTED
into the struck record in place, on the pattern of the hold: the
mark on the record itself, the separate record as the audit
trail. The grade a withdrawal sets is its WITHDRAWAL record's:
status_set on the withdrawn record and WITHDRAWN on each cascade
member, computed into the current grade, never written in place;
an author's withdrawal, a supersession and a cascade write
nothing in place; a WITHDRAWAL of cause INHERITED writes STATUS
REFUTED when its status_set is REFUTED, as a strike does, and
nothing when it is WITHDRAWN (3.4.2). STRUCK is retired as a
status word for REFUTED. [D111.1] [D193.2] [D194.1] [D215.2]
3.3.15 A COMMUNITY-LEDGER MATCH AS A REPRODUCTION (D119.1). A MATCH on
the community ledger (5.9.12) whose INDEPENDENCE passes the
eligibility check of 3.3.12 is a reproduction for the purpose of
RELEASE, kind LEDGER_MATCH; TPX writes the RELEASE on it under
COMMUNITY PARROTS ACCEPT (5.16.11), and writes the CORROBORATION
record (3.3.4), LANDED_BY "TPX", from its reserved range
(3.1.11). The trust-tier gate on a ledger MATCH (5.14 CR11: only
a TRUST TIER member's match releases) is one more refusal in the
same check, built as release_record's tier parameter (tpc_hold
0.3.0): null with REPRODUCTION, required with LEDGER_MATCH, run
after the account, SAME-MODEL and origin checks; the RELEASE
record and its digest do not change. [D111.1] [D119.1] [D122.1]
[D192.2]
3.3.16 OBJECTIVE EOM-0 (D176.1). A UWC declared with STRUCTURE_CHECK ON
whose STRUCTURE LINE names an UNDER finding opens with the
objective EOM-0, which TPX sets OPEN on the landing that
instantiates the UWC (5.5.4): its first register work settles,
for each UNDER unknown, the law that determines it. While EOM-0
is OPEN general pushes wait: TPX lands a PUSH only from a work
block of KIND EOM-0 or REPRODUCTION (5.8.3) and refuses any other
with the reason EOM-0 OPEN. TPX's own writes (HOLD, RELEASE, a
ledger corroboration) are not pushes and do not wait. An UNDER
unknown is settled by a standing L record deriving its equation
from the TFK in a declared form, or by a standing ASSUMPTION
record supplying it, priced in a(r), either carrying on its
declared form ROLE EOM(q) or another ROLE that enters the
matching; or by H-DECL's declaration that its gap stands, a line
of UWC STATE naming the UWC and the unknown (5.6.17). An initial
value's ASSUMPTION record declares no ROLE and settles nothing
(3.2.15). Settlement is MECHANICAL: TPX settles an UNDER gap
inside the PUSH when the later test's function over the TFK and
the standing records whose declared form carries an entering ROLE
returns it among SETTLED (TPC settlement_check; 5.3.47), writes
the gap's STATE line SETTLED BY those records (3.3.5), and closes
EOM-0 when every UNDER gap is SETTLED or STANDING. An OVER-EOM,
OVER, CLOSED or ROLE MISMATCH finding never opens EOM-0: the
register cannot repair the TFK, whose repair is COPY-FORWARD
(2.1.2). A CLOSED EOM-0 does not reopen: a later test that finds
an UNDER unknown again is information, on which H-DECL may open
an audit block (5.3.47). Under STRUCTURE_CHECK OFF no EOM-0
opens. A record gives its equation a declared form with EQUATION,
REFS and ROLE (3.2.19, 3.3.7), checked at landing (2.2.13-2.2.16;
3.2.21). The PUSH's EOM-0 SETTLEMENT field stays only for a
settling record without a form: [[UNKNOWN, RECORD_ID], ...]
sorted by UNKNOWN in code point order, each RECORD_ID a standing
record of the UWC and each UNKNOWN an OPEN UNDER gap's DOF, the
naming the lead's INSPECTION, recorded with the lead's account;
TPX refuses a naming of a record that carries a form, and a
naming never settles an unknown the test read and left OPEN.
[D176.1] [D198.1] [D199.1]
3.3.17 PROMOTION RECORD (D201.1). Written by TPX from its reserved range
at each landing that promotes: [promotion_id, PROMOTION,
landing_block, [[id, class_read, floor], ...], digest], the list
sorted by identifier, the digest digest_fields over
["TPC-PROMOTE", "1", ...] (TPC promotion_record). It sets
ESTABLISHED on each record it lists; nothing is written in place
and nothing on the TrM entry. A successor's batch re-promotion
writes one (3.4.6). [D201.1] [D202.1]