Four format 1 change-sets carry revisit_if; §3.7 calls that a schema fault and format_faults has no row for it #81

Facts are from the Session A session's read of the branch for PR #80. Its close-out says "format: 3" (docs/sessions/2026-10-session-a.md, lines 163–167, "Found in passing"); that is wrong, the files declare format 1.

Finding

• docs/ledger-format-v1.md §3.7, "The reopen edge — revisit_if (format 4)": "A change-set declares format: 4 only when one of its versions actually carries a revisit_if; a store that never states one stays a pure format-1/2/3 store, and a lower-format file carrying the field is a schema fault."
• Four change-sets in this repository's store declare format: 1 and each holds one version carrying revisit_if:
  • .decisions/log/01KZX70EMPA47TBR0PFKX4M32Z.yml
  • .decisions/log/01KZX70EQGQCB1B190TS9FZ1A2.yml
  • .decisions/log/01KZX70ET1GMR2012XKEP5EWDW.yml
  • .decisions/log/01KZX70S86QGXVCA5GW5WSY6XA.yml
• No check exists. format_faults (ledger-core/src/store.rs:184) has rows for MERGE_FORMAT, CONTRACT_FORMAT, KEY_FORMAT and AUTHORITY_FORMAT, and none for REVISIT_FORMAT (format.rs:33, value 4).
• No fixture under ledger-cli/tests/fixtures carries revisit_if.

What moves and what does not

• revisit_if is hashed content: put_set(&mut m, "revisit_if", …) in canonical_json (ledger-core/src/canon.rs:83).
• format is not hashed. It is a field of ChangeSet (ledger-core/src/changeset.rs:40), not of VersionRaw.
• The four versions are tips, each with one unrevoked acceptance.
• L007 recomputes the version hash, which excludes format. L009 runs only over acceptances, and these files hold none. The merge driver's EditedLogFile fires only in a three-way merge where both sides edited the file.

So the declaration can be corrected without moving a digest or touching an acceptance.

Why it matters

The format declaration tells a reader which fields a file may carry. revisit_if is hashed, so a reader that trusts format: 1 and does not know the field recomputes a different version hash. The spec and the gate disagree about the repository's own store, and a second implementation written from the spec rejects what ledger verify passes.

Options

1. Correct the declaration. Change format: 1 to format: 4 in the four files and add the REVISIT_FORMAT row to format_faults. No digest moves and the four acceptances stand. The cost is a precedent: four landed log files are edited in place. The edit changes a declaration that is not hashed content and makes it true.

2. The spec gives way. Strike "a lower-format file carrying the field is a schema fault" from §3.7. No file changes. The format declaration then stops meaning what §3.7 says it means, for a hashed field.

3. Add the row with the four files exempt. The four paths and version hashes are pinned as a closed exemption. No file changes. The gate carries a permanent exemption for a problem option 1 removes.

Recommendation

Option 1. Nothing hashed changes, and it is the only option that leaves both the spec and the gate true. The decision for the principal is whether a landed log file may be edited in place when the edit touches only an unhashed declaration.

Scope

• Correct the "format: 3" statement in the Session A close-out.
• Establish how the four files were written at format 1: whether format::needed_for accounts for revisit_if. If the writer can still produce such a file, fix it in the same PR with a test.
• Tests: a lower-format change-set with revisit_if faults; a format 4 one parses; every stored digest is unchanged (Session A's digest test); the four acceptances still verify.
• Follow I6: Spec v1.6 / format 5 — key and exported on versions; key classes in the file gate #67's KEY_FORMAT row for the closed-count tests (finding.rs, gate.rs fails_only_with); say in the PR whether they change.
• Format document and migration note in the same PR (hard constraint 7). verify --export passes; say whether the export bytes change.

References

• Spec: docs/ledger-format-v1.md §3.7. PRD: docs/ledger-cli-prd.md §4.
• Size: S.
• Dependencies: PR Ledger Session A: format 5 keys, non-interactive refusal, authority model, revocation entity #80 merged. Independent of Session B; can land before or after.