Problem
The journal era has no override primitive: reconcile cannot express accept-current-without-drift, deletions are unrepresentable in schemas_journal, and today's maintainer-ruled ledger repair (recording gen 287's unjournaled recovery step) had to be a hand-crafted append (journal line 307). Truthful and prefix-preserving, but outside the toolchain.
Direction (maintainer naming: commit/amend, not 'repair')
In the store era every event append IS a commit through the transaction protocol. The override is therefore just another commit: napl amend records an event that supersedes an earlier one, and --force gates the maintainer-only override semantics (git force-push mental model). Append-only under the hood: objects are immutable, HEAD moves by CAS, the reducer resolves the amending event - force-push semantics with zero history rewriting. Capabilities: record a missed step (accept-current), record a deletion, supersede/revert an event - each with WHO/WHY pinned in the event payload (Audit/Revert kinds already exist in the Event model).
Acceptance criteria
- No override scenario requires hand-editing store or journal state.
- Every amend is a store event with provenance (operator, reason), replayable by the reducer, visible in blame/history.
- The audit classifies amended chains as exact, with the amend event in the chain.
- --force is maintainer-gated, never available to agents.
Sequenced post-store (#30); pairs with the healing/move-event design.
🤖 Generated with Claude Code
Problem
The journal era has no override primitive: reconcile cannot express accept-current-without-drift, deletions are unrepresentable in schemas_journal, and today's maintainer-ruled ledger repair (recording gen 287's unjournaled recovery step) had to be a hand-crafted append (journal line 307). Truthful and prefix-preserving, but outside the toolchain.
Direction (maintainer naming: commit/amend, not 'repair')
In the store era every event append IS a commit through the transaction protocol. The override is therefore just another commit:
napl amendrecords an event that supersedes an earlier one, and--forcegates the maintainer-only override semantics (git force-push mental model). Append-only under the hood: objects are immutable, HEAD moves by CAS, the reducer resolves the amending event - force-push semantics with zero history rewriting. Capabilities: record a missed step (accept-current), record a deletion, supersede/revert an event - each with WHO/WHY pinned in the event payload (Audit/Revert kinds already exist in the Event model).Acceptance criteria
Sequenced post-store (#30); pairs with the healing/move-event design.
🤖 Generated with Claude Code