stzSecurityLedger

(no comment in the source: the name reads as a sentence) initno extension

(no comment in the source: the name reads as a sentence) handleno extension

Bind this face to a ledger owned elsewhere (the process ledger). Destroy() will not free an adopted handle -- the owner does.no extension

The engine's own answer -- a face bound to the process ledger (AdoptHandle) never knew the capacity it was created with.no extension

recording --------------------------------------------------- Append an stzSecurityEvent. The engine chains it; nothing about the digest is under the caller's control.no extension

Append a canonical line directly -- the acquisition path (I8), used when rebuilding a ledger from verified evidence. The chain is recomputed here; it does not carry the original file's.no extension

Call it BEFORE recording. Returns [ :ok, :verified, :brokenAt, :why ]; a broken stored history is REFUSED (:ok = 0) and nothing is attached.no extension

(no comment in the source: the name reads as a sentence) is durableno extension

Verify the WHOLE stored history from genesis -- where Verify() can only speak for the retained window. [ :intact, :brokenAt, :message ]no extension

Events ever recorded (keeps counting past capacity).no extension

Events still retained in the window.no extension

reading ----------------------------------------------------- The record at 1-based position i (oldest retained first), in the I0 field shape plus its chain digest.no extension

(no comment in the source: the name reads as a sentence) allno extension

(no comment in the source: the name reads as a sentence) recentno extension

the analyst's pivotsno extension

(no comment in the source: the name reads as a sentence) of subjectno extension

(no comment in the source: the name reads as a sentence) of kindno extension

(no comment in the source: the name reads as a sentence) of traceno extension

(no comment in the source: the name reads as a sentence) of outcomeno extension

(no comment in the source: the name reads as a sentence) of severityno extension

(no comment in the source: the name reads as a sentence) of originno extension

Everything that was not granted -- the signal to watch. Refused and failed -- NOT "everything that is not granted". The negative form was here too, and it was wrong the moment the OBSERVED outcome arrived (I2's session seams): an expired session would have been counted as a refusal by this pivot, in a system whose whole point is that a warning must mean something. Kept in step with stzSecurityEvent.IsRefusal(), deliberately as one positive list.no extension

(no comment in the source: the name reads as a sentence) sinceno extension

(no comment in the source: the name reads as a sentence) betweenno extension

the chain --------------------------------------------------- The head digest: one string that commits to the ENTIRE history ever recorded (including evicted entries).no extension

(no comment in the source: the name reads as a sentence) digest atno extension

[ :intact, :brokenAt, :message ] -- brokenAt is the 1-based index of the first entry whose stored digest disagrees with a recomputation, 0 when the retained window is consistent.no extension

sealing (evidence leaves the process) ----------------------- Write the retained window as a verifiable file: one "<digest>TAB<canonical>" line per entry, a header carrying the count and an HMAC seal over (head digest | count). Re-check it with StzVerifySealedLedger(path, key) -- editing any line breaks the chain; editing the seal without the key is not possible. As SealTo, plus WHO attested and WHEN -- the custody header that turns a sealed file into an attested one (I7). Unknown "#" lines are ignored by verifiers, so the format stayed compatible.no extension

(no comment in the source: the name reads as a sentence) seal tono extension

OCSF, newline-delimited: what a collector ingests as a stream.no extension

OCSF as one JSON array (the batch form).no extension

The OTLP logs envelope -- the same shape stzLog ships (perf P9), so security events and log lines arrive at one collector looking like what they are: records of the same run, sharing trace ids.no extension

legibilityno extension

(no comment in the source: the name reads as a sentence) showno extension

(no comment in the source: the name reads as a sentence) resetno extension

(no comment in the source: the name reads as a sentence) destroyno extension