The proposed current-standing rule is simple and converges once replicas learn the same grant/revocation facts, but revoking a writer can remove its statement from current selection; a new grant can revive old statements. Retained changes adopted by a surviving authorized statement remain data. An admin can explicitly adopt a version to preserve it.

The alternatives are consequential:

Signed adoption receipts: an authorized admin certifies particular statements/history, preserving adopted validity across writer revocation. This adds signed facts and requires specifying who may finalize offline work and what receipt conflicts mean.

Serialized authority cuts: sequence the authority state and bind writes to it. This adds coordination and changes offline acceptance; an integer without a trusted ordering mechanism does not solve it.

Causal revocation semantics: define concurrent operations and visibility cuts explicitly. This can preserve offline collaboration but requires a real authority/history model, not comparisons of claimed timestamps.

Do not adopt rollback merely because it is easiest to implement. The procedure exists so its product effect can be reviewed against these alternatives.

Approve or replace the tentative root/role/scope policy. ResourcePolicy requires a reviewed format and bootstrap/recovery story. Permanent admins cannot be removed by ordinary revocation; compromised-root recovery may require a new anchor/resource migration.

Choose history semantics. Decide whether current-standing rollback/revival is acceptable, whether joining readers see retained history, and whether signed adoption is required.

Specify deterministic apply execution. The exact immutable CID is settled; executable format, sandbox, inputs and compatibility are not. Unsupported code must remain explicit. Utility snapshots stay nonauthoritative.

Review public/control disclosure. Public content does not imply public reader roster. Confirm the minimal evidence rules, personal post-revocation control access, public-to-private treatment and plaintext server custody.

Validate wire/index costs. Compile the candidate protocol, run the SQL fixtures and benchmark representative authorized sets. Specify real crypto/signature/CID test vectors and transport races before implementation claims.

Plan migration explicitly. Inventory legacy owner, path-writer, AGENT, alias and vault invitation facts. Do not promote devices to irrevocable-admin. Preserve original signatures/URLs; separate compatibility parsing from new authority grants.

The tentative writer action includes state writes such as comments; there is no separate reader participation exception. Independently owned comments need explicit audience/root rules, and old comment behavior must be migrated deliberately.

Later extensions include inherited scopes/groups, delegated creation, cross-root moves, encrypted storage and native live republish. Their existing schema/proposal shapes are not evidence that their semantics are implemented.

Stable node identity is the initial node CID. BaseNode owns only optional node/parent/name and inherits the signed envelope's stored string type without a fixed HM26Node literal. Both change variants reject prev; snapshot/tombstone/redirect permit their optional breadcrumbs. Change DAG truth wins over utility snapshots. Admin grants and ancestry are permanent; only same-scope admins revoke reader/writer grants.

The standalone SQL/protobuf checks validate actual syntax and representative index/query behavior. They do not verify signatures, full historical semantics, networking, crypto freshness or performance. The source record records what was inspected and what remains a design recommendation.