The round-tree is a flight recorder

The session/round mechanism of vibe-linter (this round's audit pairs with this round's fix) is nonce / freshness / fencing-token reinvented (anti-replay; Raft epoch rejects zombie subagents). A token becomes a triple (round, state-hash, issuer-signature) chained into a hash chain — and the beautiful merge: the session mechanism and the audit ledger are the same object (tokens are append-only chain entries = the task's provenance).

Per Perrow's normal accidents, attribution must be built into the substrate beforehand (a black box). Four requirements:

1. record the policy-state version active each round (which skills/net/validator-calibration) — because blame lands two ways: executor wrong, or rules wrong (a lock let through what it shouldn't) = a case-law moment feeding the amendment loop;
2. keep failed branches (negative data + preference pairs = literal DPO training pairs);
3. tamper-proof (append-only, hash-linked, worker can't write — "history needs ring protection too");
4. risk-tiered retention.

Precedents: W3C PROV, event sourcing, OpenTelemetry span trees. "git is the weakest precedent — it records artifact evolution, not verdicts and reasons." The whole thing wants a globally unique ledger (coins = authority declarations → single source of truth, UTXO-set analog; double-entry bookkeeping of trust, with a conservation-law checker that finds dead coins = the lock-audit data).

Up: vibe-linter