A branch is transaction time with a tree order.

1. The boundary is sacred

   Everything above the libSQL connection is project code; the engine is never patched, never forked.

2. Two clocks, never mixed

   Every row carries valid and transaction time; no path may derive one from the other. Lineage is a clause on the second clock.

3. Assertions are immutable

   Rows are never updated in place; a new recorded state is a new insert with a fresh recorded_at.

4. The ledger is a table, not the log

   Reconstruction reads transaction_log, captured by engine triggers, never the WAL, replication frames, or CDC.

5. No physical deletion in primary tables

   Rows leave only through a declared, verified archive session; ad-hoc DELETE aborts at the trigger layer.

6. Derivative state is disposable

   links_current is a cache of current recorded state, rebuildable by one deterministic query; audit detects drift, rebuild recovers.

7. Embeddings are immutable per version, excluded from the ledger

   Vectors live in per-model tables, never in log payloads; vector search is present-state only.

8. Fidelity is a parameter, never a silent default

   Queries mixing time dimensions declare it in their signatures; the past's text is never attached silently.

1. as_of_valid(v)True at v — valid time under current belief. No branch predicate: branches share the valid-time domain, so no valid-time query changes meaning.
2. as_of_recorded(r)Believed at r — the log folded to r. An unstated attribute mode refuses rather than defaulting (Doctrine VIII).
3. reconstruct_on(r, L)Believed by L — the fold scoped by ancestry, nearest ancestor winning. Resolution is silent: one position per key, no flag where a sibling disagrees.

Compose the instants: as_of_valid(v) + as_of_recorded(r) asks believed at r about true at v: current belief about the past routinely differs from past belief about the past.

import datetime, macrame
db = macrame.Database.open("ledger.db")
tuesday = datetime.datetime(2026, 3, 3, tzinfo=datetime.timezone.utc)
past = db.load_subgraph(
    "invoice-7", 3, 1 << 20,
    as_of_recorded=tuesday,
    attribute_mode=macrame.AttributeMode.AT_TIME,
)  # Tuesday’s topology wearing Tuesday’s titles

1. Embedded, no serverOne libSQL file, one writer, WAL readers unblocked. Branch, fold, and archive against the file in place — there is nothing to operate.
2. Rust core, Python bindingsTraversals, belief-at-instant reads, snapshots, and the archive from either side of the boundary — and the graph algorithms run on loaded subgraphs.
3. History you can auditEvery superseded row stays in the ledger. Reconstruction replays the trigger-captured log, snapshots anchor the trunk, and archive sessions move cold rows with verifiable reports.
4. Branches for real workCompeting extractions, corrections under review, planning scenarios — each lineage keeps its recorded positions, resolved by rule on read instead of merged by convention. The sharpest case: a correction authored Monday, reviewed Wednesday, adopted Friday — recorded as a candidate before it becomes the accepted position.
5. Integrity by constructionOverlap guards, lineage provenance, and deletion refusal live in triggers and the single writer. Callers inherit the guarantees; they are never asked to keep them.

Around the ledger sits the rest of the system: snapshots that anchor trunk reconstruction; archive sessions that move cold rows, blobs with them, under verifiable reports; a content-addressed blob store reclaimed through the archive instead of by reference counting; application attributes riding the concept row as versioned JSON with expression indexes over their paths; a branch-global key-value sidecar for the operational state the ledger should never see; full-text search beside present-state vector search; and communities, shortest paths, and dense cores running on loaded subgraphs. Per-shape version gates keep older binaries folding what newer ones wrote.

BranchBench illustrates a tradeoff: fast forks can bring increasingly expensive reads as histories deepen. Macrame’s measurements show a different scaling profile: trunk operations remain unchanged, forks add one register row, and branch reads stay depth-independent through 100 levels.

• Divergence is modeled; convergence is not. No rule composes two lineages' recorded positions into one — by design, since a merge rule that silently picks winners would violate the integrity the refusals protect. Ancestry-determined precedence is the outlined form of the missing rule.
• Inheritance without restatement. Branches inherit concepts but cannot restate them, so retiring an inherited concept has no branch-local operation — the deferred overlay design stands until its reopening symptoms appear.
• Replays fold from the initial state. A snapshot without recorded_at cannot serve a lineage-scoped cutoff, so closing this gap means snapshotting per lineage or not at all, with the storage costs computed first.
• Similarity lives in the present. The embedding index derives from current recorded state and crosses no lineage; temporal-vector consistency is stated as a limit: to our knowledge an unclaimed gap anywhere.