The state dimension the-trail is at governance-read; its transition to shared reads «two people, one of them a guest, each see what they owe by the web or desk surface of a deployed service». The service answers `/` with 404 and desk has no code. Its one cross-cutting view, `GET /v1/mine` (code/crates/specdossierd/src/people.rs), lists the SOWs of the levels the service is configured with whose ratification policy names a hat the person holds, and the signatures those hats owe; it reads no round, no invitation and no point, and only the primary authority.
The rounds the service holds (its store, adr-003: transient, never the record) carry each dossier as put — who opened it, whom it invites and as which hat, whether a guest — its revisions and digests, its points with who raised them and at which digest, whether a signature is required and the attestations made, and the intents prepared on the face; the service's signed log holds each landing. Who may see a round is already decided by the core's `takes_part` and the authority the round answers to. Whether a dossier is agreed the service does not know: the agreement lives in the person's copy (adr-003) and reaches the service only at a landing.
The principal chose, 2026-10-07: what is owed is what the service knows, per round; a home page `/` with its JSON; a local walk with two people, one a guest, while a deployed service stays the operator's act and notifications stay out.
WHAT IS OWED IS DERIVED FROM THE ROUNDS, ON EACH REQUEST. For the person the authority identified, the service goes through the rounds it holds that they take part in (`takes_part`, under the authority the round answers to) and derives, for each: - for the person who opened the dossier: the points raised in it, which the agreement answers; the signature, when the dossier requires one and no attestation is held; the landing, until the service's log holds one for the dossier; the intents prepared and not applied; - for an invited person, a guest or not: the round's current revision when they have raised no point at its digest — read it, and say what they have to say. Nothing owed is stored: no table of debts and no table of people (identity-is-the-authoritys); a debt disappears when what it is derived from changes.
SHOWN ON THE HOME PAGE AND IN ITS JSON, EACH DEBT LINKED TO ITS ROUND. `/` shows a logged-in person what they owe, round by round, each row linking to `/r/{id}`, where it is reviewed; without a session it leads to the login and back. `GET /v1/owed` answers the same as JSON for a client. A round the person does not take part in is never named.
NO AGREEMENT IS CLAIMED. The page says what the service knows and how it knows it; it never reads a dossier agreed, since the agreement is the copy's (adr-003, files-are-the-floor). Points stay owed until the landing shows them answered — the service's knowledge, stated as such.
WHAT THIS DOES NOT DECIDE: `/v1/mine` (the SOWs of configured levels) stays as it is; notifications; desk; deploying a service, which is the operator's act and what the-trail's transition to shared still waits on.
What the service shows a person as owed is derived on each request from the rounds they take part in and the service's log, is stored nowhere, names no round they do not take part in, and never reads a dossier agreed
Extend /v1/mine with the rounds
Rejected: Mixes the SOWs of configured levels with the rounds of dossiers, two sources of different standing; /v1/mine stays as it is.
Store each person's debts as rounds change
Rejected: A second record beside the rounds, and a table of people (identity-is-the-authoritys).
Read the opener's agreement from the project to clear points
Rejected: The service never reads the project (adr-003); the landing is where it learns of the agreement.