The operator queue: what is proposed, disputed, and ruled

?ref=subject:fact:convoy-departure&ref=… — one or more refs. Built for the human who has to DISPOSE, not for the machine that proposed: each ref comes back with its live proposals, the conflicting records in full (not just a boolean), the canonical spelling if anybody chose one, and whether an operator has already ruled.

IT MUST BE TOLD WHICH REFS TO EXAMINE, and that is a limit rather than a design: there is no argument-free read that lists a workspace's links, so this queue is only as complete as the list it is handed. index.complete is false on every response and names the missing verb.

derived_closure is DERIVED and, over this verb, is exactly the direct live corresponds neighbours — the scoped load it folds does not contain the chained hop. It is not an identity class.

corresponds is SAME ENOUGH TO JOIN ON and nothing more: not identity, and NOT TRANSITIVE (CR2). a—b and b—c never yield a—c. No read on this surface unions two subjects' beliefs, and none ever will — that would merge two facts a human never agreed were one.

Only an operator identify says two refs are ONE THING, and the gateway's own credential cannot clear that floor: an identity written through an ordinary credential is stored, stays auditable, and folds INERT. That is the design (memory proposes, never disposes), not a gap.

Even an effective identify is FORWARD-ONLY (CR3): it emits an alias pair for write-time normalization and rewrites no history. Both keys keep their own neighborhoods and their own belief folds forever.

A conflicts link contributes a disputed MARK and nothing else (CR1) — no status change on either side, nothing retracted, no auto-resolution.

band is PAYLOAD (K6/CR4): the fold is invariant under permuting every band in the log. Filter on it if you like; never rank on it, or a confidence score starts outranking a person.

There is NO delete. Withdrawing a link is bottom, an append.

Requires the coord:read scope. Accepts all three lanes: a session JWT (bounded by the caller's role on this workspace) or an il_* machine credential whose own scope set, workspace set and validity window cover it — both ceilings apply and neither can raise the other, so a credential carrying coord:read is still refused where the role does not permit it.

A credential with no scope record resolves to LEGACY_DEFAULT, which does NOT include coord:read — mint a key with it explicitly (POST /v2/workspaces/{id}/keys).