decisions: Orgchain v1.14.1, a belt counts only on its seat's sat

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01H4upF5LVwmPDDqrhdUfnXh

docs/decisions.md

@@ -74,3 +74,4 @@ Format: date · decision · why. Add at the bottom. Never edit an old entry; sup
 - 2026-10-15 · **Orgchain v1.12: both sides of a deal, and orgs change hands.** The operator asked for offers on orgs to sell as well as to buy: the other side of the PSBT. Deals now go both ways on a lot, an item or an org inside a holding (which its parent sells). Buy makes an offer, the buy order the lab already had; Sell makes an ask, the sell order, signed SIGHASH_SINGLE|ANYONECANPAY on the lot's input alone, so any node can take it behind a 600-sat dummy of its own. An org sells cash-free: its money, gas tank and items go home to its parent first, and it is frozen while listed. Two new `lineage/v0` ops move it into its buyer's tree, `join` (signed by whoever holds the org's inscription) and `adopt` (signed by the buyer), in either order; it takes the buyer's next index and derives its keys there, and its old parent keeps the old index unused. Rehearsed on Bitcoin Core regtest from height 131, beside the earlier rehearsal (twelve beats and 104 transactions: an org on an ask, another on an offer, an item on an ask), and ord tells the same story. The first comparison caught the miner putting a join and its adoption the other way round within a block, so a move now records both halves and each half belongs to both holdings. The sample ends with both sides standing: lineage's offer for the launch kit, and well-known's ask for mailr. `lineage/orgchain` main `adca270`, time's `gh-pages` `83eac0c`; 90 unit tests and Playwright 22/22. Token 68 (`orgchain-acquire-20261015`, `write:repository`) pushed `gh-pages`, but the push to main was refused because the script named the wrong local branch; the script was stopped and 68 deleted by id (the table checked). Token 69 (`orgchain-acquire2-20261015`, `write:repository`) pushed main and this line and is deleted right after; the table is checked. Next: pledge, a lien with a timelock. Why: a sale has two sides, and an org that changes hands should keep its history and leave with keys only its new owner holds.
 - 2026-10-15 · **Orgchain v1.13: whole trees change hands.** The operator asked for full holdings transfer next. An org now changes hands with its tree (the derived orgs and agents below it, and the items they hold), and a holding changes hands whole, sold by its owner, whom the lab wallet plays; the price goes there, and the holding becomes its buyer's next org. Sales stay cash-free: the money in the tree, every gas tank included, goes to the seller first, and the items go with the tree. An ask signs one input, so listing a tree bundles every inscription in it into one output at the lot's key; an offer spends every output the tree sits in and merges them. After the `join` and `adopt` the buyer splits the output back, one inscription to an output at its new key, each item with the node that held it, by the layout the deal recorded. A listed or sold tree is frozen whole, and a listed holding mines nothing (the default mining rule would otherwise have paid keys it was about to leave). Transactions take up to 64 inputs and outputs. Rehearsed on Bitcoin Core regtest from height 144, beside the earlier rehearsals (sixteen beats and 131 transactions: time with its six below it on an offer, then acme whole on an ask, eleven inscriptions in one output, each split back), and ord puts every inscription in the same output as the lab. `lineage/orgchain` main `74ed801`, time's `gh-pages` `07c3810`; 95 unit tests and Playwright 24/24. v1.12's commit went out under the Mac's default author by mistake; v1.13 is teahubxyz's again. Token 70 (`orgchain-holdings-20261015`, `write:repository`) did the pushes and is deleted by id right after; the table is checked. Next: pledge, a lien with a timelock. Why: a business is sold with what it runs and what it made, an owner can sell a holding whole, and the buyer should leave the deal holding every key.
 - 2026-10-15 · **Orgchain v1.14: soulbound belts.** The operator said belts shouldn't trade: they are soulbound, tied to an agent and moving with it, and pointed at ord's charms. A belt is now inscribed on its seat's own sat, as a reinscription: one reveal spends the seat's coin (the seat's own key co-signs, accepting the belt), the issuer's coin (the parent) and a commit that pays the fee, returns both coins unchanged, and points the belt at the seat's sat. ord gives it two charms, ♻️ reinscription and ❤️‍🔥 vindicated (a pointer and an envelope past the first input would have cursed it before the jubilee). So a belt travels with its seat through every act, graduation and sale, a tree splits back one inscribed sat to an output, and a belt is never a lot. An award costs two fees (1,000 sats) and no postage. The reducer is unchanged, since a belt was already bound to the seat it names; belts from before v1.14 stay with their issuers. The engine's sixth local change is that three-input reveal, and nothing looser. Rehearsed on Bitcoin Core regtest from height 161 (sixteen beats, 131 transactions): ord charms the three belts as the lab does, and after two whole-tree sales each belt still shares its seat's satpoint; the compare now checks satpoints and charms, and the v1.13 recording passes it too. `lineage/orgchain` main `c8c18b0`, time's `gh-pages` `7fa9f05`; 98 unit tests and Playwright 24/24. Token 71 (`orgchain-belts-20261015`, `write:repository`) did the pushes and is deleted by id right after; the table is checked. Next: pledge, a lien with a timelock (v1.15). Why: a belt certifies a seat, so it must never be sold apart from it, and keeping it on the seat's sat makes ord's account of where a belt is match the reducer's.
+- 2026-10-15 · **Orgchain v1.14.1: a belt counts only on its seat's own sat.** The operator agreed reinscription is the mechanism, since a belt is re-inscribed as it grows (white, green, black), and said older belts can go, as nobody uses the system yet. So placement is now a rule of `lineage/v0`, not just Orgchain's habit: an award counts only if it is inscribed on its recipient's own sat, which any indexer can check (the reducer compares sat numbers, or, without ord's sat index, satpoints, which two inscriptions share exactly when they share a sat). Belts inscribed elsewhere, as before v1.14, are rejected. A promotion is another reinscription on the same sat, over the belt before it; the reducer keeps each skill's ladder, Inspect shows it, and the sample's sol goes white, then green. An award and its recipient's own close no longer conflict within a block, since both spend the recipient's inscription. Rehearsed again on Bitcoin Core regtest from height 178 (sixteen beats, 133 transactions): ord shows sol's sat carrying sol, its white belt and its green belt, in order, each belt charmed ♻️ and ❤️‍🔥, and the compare matches; the fixture is re-recorded. `lineage/orgchain` main `5a7f11e`, time's `gh-pages` `4359351`; 100 unit tests and Playwright 24/24. Token 72 (`orgchain-belt-rule-20261015`, `write:repository`) did the pushes and is deleted by id right after; the table is checked. Next: pledge, a lien with a timelock (v1.15). Why: with the rule in the protocol, a belt is provably soulbound to anyone reading the chain, not only to Orgchain.