The research now makes tentative choices sufficient for complete procedures, rather than leaving every protocol branch unanswered. They are documented in authority model, workflows, peer RPC and node index. Nothing here ratifies a new runtime protocol or changes the published structural schemas.

The recommended first design

Area	Tentative conclusion	Review consequence
Authority	Exact-resource grants; admin-issued; writer⇒reader and admin⇒writer	No automatic subtree access or writer invitations
Proofs	Exact permanent admin proof for delegated issuance; independent grants union	Do not silently implement Keyline late binding
Roots/public audience	Additional signed ResourcePolicy grounded in an independently expected root	Needs a reviewed new format; parent/name still grant nothing
Write timing	Current-standing authorization of node statements	Writer revoke can roll state back; regrant can revive old statements
Node selection	Highest authorized signed timestamp, binary CID tie-break	Missing state does not turn an older rendition into latest
Change replay	Topological order with binary CID ready-node tie-break	Deterministic order alone is not CRDT semantics
Placement	Same-root moves; deterministic cycle-edge suppression	Cross-root namespace admission remains outside first policy
Peer exchange	Versioned protobuf/gRPC over libp2p; contextual streaming bytes	Existing Bitswap can optimize the same live predicate
Sync sets	Permission-filtered scopes, frozen membership and live ACL fences	Child grants/moves/revocations invalidate recursive views
Changes	Durable local events/watch cursors plus RBSR repair	Sequence numbers are local delivery order only
Publication	Stable offer IDs, per-CID receipts, commit-before-ack	Transport progress is not publication success
Index	SQLite source facts + rebuildable provenance/cache rows	Revision-tagged cache is not authority
Live republish	Explicit reader-source/writer-destination copy automation	Native republish payload remains unsupported/unsettled

The biggest decision: historical authorization

The proposed current-standing rule is simple and converges once replicas learn the same grant/revocation facts, but revoking a writer can remove its statement from current selection; a new grant can revive old statements. Retained changes adopted by a surviving authorized statement remain data. An admin can explicitly adopt a version to preserve it.

The alternatives are consequential:

Signed adoption receipts: an authorized admin certifies particular statements/history, preserving adopted validity across writer revocation. This adds signed facts and requires specifying who may finalize offline work and what receipt conflicts mean.

Serialized authority cuts: sequence the authority state and bind writes to it. This adds coordination and changes offline acceptance; an integer without a trusted ordering mechanism does not solve it.

Causal revocation semantics: define concurrent operations and visibility cuts explicitly. This can preserve offline collaboration but requires a real authority/history model, not comparisons of claimed timestamps.

Do not adopt rollback merely because it is easiest to implement. The procedure exists so its product effect can be reviewed against these alternatives.

Decisions needed before implementation

Approve or replace the tentative root/role/scope policy. ResourcePolicy requires a reviewed format and bootstrap/recovery story. Permanent admins cannot be removed by ordinary revocation; compromised-root recovery may require a new anchor/resource migration.

Choose history semantics. Decide whether current-standing rollback/revival is acceptable, whether joining readers see retained history, and whether signed adoption is required.

Specify deterministic apply execution. The exact immutable CID is settled; executable format, sandbox, inputs and compatibility are not. Unsupported code must remain explicit. Utility snapshots stay nonauthoritative.

Review public/control disclosure. Public content does not imply public reader roster. Confirm the minimal evidence rules, personal post-revocation control access, public-to-private treatment and plaintext server custody.

Validate wire/index costs. Compile the candidate protocol, run the SQL fixtures and benchmark representative authorized sets. Specify real crypto/signature/CID test vectors and transport races before implementation claims.

Plan migration explicitly. Inventory legacy owner, path-writer, AGENT, alias and vault invitation facts. Do not promote devices to irrevocable-admin. Preserve original signatures/URLs; separate compatibility parsing from new authority grants.

The tentative writer action includes state writes such as comments; there is no separate reader participation exception. Independently owned comments need explicit audience/root rules, and old comment behavior must be migrated deliberately.

Later extensions include inherited scopes/groups, delegated creation, cross-root moves, encrypted storage and native live republish. Their existing schema/proposal shapes are not evidence that their semantics are implemented.

Settled invariants that remain unchanged

Stable node identity is the initial node CID. BaseNode owns only optional node/parent/name and inherits the signed envelope's stored string type without a fixed HM26Node literal. Both change variants reject prev; snapshot/tombstone/redirect permit their optional breadcrumbs. Change DAG truth wins over utility snapshots. Admin grants and ancestry are permanent; only same-scope admins revoke reader/writer grants.

The standalone SQL/protobuf checks validate actual syntax and representative index/query behavior. They do not verify signatures, full historical semantics, networking, crypto freshness or performance. The source record records what was inspected and what remains a design recommendation.