Storing each domain and mailbox proof as a timestamped event lets an auditor replay a disputed join

admits() is where the policy turns into a boolean. It takes one Evidence value and a mailboxConfirmed flag. dnsFresh is true only when Method equals "dns_txt" and now.Sub(ObservedAt) is 24 hours or less, and the return statement is dnsFresh && mailboxConfirmed ^[7]. So a dns_txt observation taken 25 hours ago fails the gate whatever the mailbox says, and a fresh TXT observation fails when mailboxConfirmed is false ^[9].

The mailbox side arrives as a bare boolean with no observation time, so the 24-hour bound applies to the DNS evidence only ^[10]. The post is explicit that 24 hours is a policy example and not a protocol constant: shorter for a privileged role, longer for a low-risk invitation, with the decision record of inputs, policy version and reason for acceptance or rejection as the part that has to stay stable ^[8]. Putting the same bound on mailbox access means passing a second Evidence value and comparing its ObservedAt too.

The prose lists seven things an evidence event should carry: normalized domain, method, challenge digest, resolver result, observed time, actor, and policy version ^[5]. The struct printed below it has six fields. It compiles fine, and the actor is the one item on the list that does not appear in it ^[6][11].

The worked case is a clinic acquired on 18 April 2026, where the old owner still controls an address inside a shared billing inbox and the new owner controls the registrar and the authoritative DNS ^[14]. A DNS-only gate admits an employee with no current mailbox at all, including a contractor whose forwarding rule was never revoked ^[16]. For a reviewer to place a join before or after that date, the record has to keep both timestamps, the exact TXT value observed, and the mailbox identifier that passed ^[17].

"In a payment or ledger backend, I model both as evidence events, never as a mutable verified=true column," the author wrote ^[4]. The failure lists are the reason. DNS has stale TXT records, split-horizon views, forgotten staging zones, and a record that survives a corporate transfer ^[13]. Mail has shared inboxes, forwarding, delegated access, and account-recovery procedures, any of which can let several people satisfy the same challenge ^[12].

The comparison the post draws is control surface against operational friction: changing a published TXT record needs an administrator, which is slower during an urgent onboarding and produces an inspectable organisational signal, while mail confirmation is quick for an individual and easy to automate and inherits every weakness of the mailbox's delegation and recovery chain ^[18]. Both proofs are point-in-time identity claims ^[3].

In all three directory products named, directory state, mail routing and application authorization stay separate records ^[22]. The post is one practitioner's account, and it does not measure how often a retained billing inbox or a stale TXT record admits the wrong party.