Constructing the undo before the write admits 13.8% of write-capable MCP tools

The reason the ordering is forced sits in the identity scheme, not in anyone's threat model. Canonical identity here is a projection: take the space of concrete presentations of a value, encodings and field ordering included, and quotient it by canonicalisation equivalence ^[6]. The map is surjective and not injective, so it has no left inverse, and the bytes do not come back out of the identity ^[6]. A ledger holding identities alone can prove which value was decided about and cannot produce that value ^[7]. So the inverse material has to be stored separately, before the change lands, or there is nothing in the record to rebuild it from afterwards ^[7].

In the implementation that second half is not one struct. It is three receipt fields: the canonical identifier of the change, the identifier of the stored inverse delta, and the recorded read set ^[8]. The author singles out the read set as the field that turns "restorable" into "attributable", and the one most often absent elsewhere ^[8]. I would check that field first in any comparable system, because a rollback that knows what changed and not what the change was computed from is a guess with good provenance.

The digest details are where interop usually goes wrong. The primary body is canonical DAG-CBOR with a BLAKE3 digest over it, and there is a JSON-compatible route carrying an RFC 8785 digest under SHA-256 that explicitly does not constitute identity ^[9]. An earlier internal draft had named the identity hash SHA-256; the post prints that correction next to the right answer instead of patching it quietly ^[10]. Published errata remain rarer than they should be.

The gate returns Admit(proof), Deny(reasons) or Escalate(ticket), three arms and no fourth, and an evaluation that could not be performed is not an arm at all but an error returned outside the verdict type ^[11]. That is the part worth arguing about. The familiar ALLOW / DENY / UNKNOWN triple merges two different unknowns: evaluated and could not decide is a decision, could not evaluate is the absence of one ^[12]. If your policy service times out and your gate answers UNKNOWN, you have written an outage into the ledger as a ruling.

Which brings the whole design back to one fraction. The complement of the census share is 86.2% of write-capable tools ^[1], and under this gate those are refusals rather than reversible writes. The author states the consequence himself: if the production figure sits at or below the census figure, what he has built is mostly a refusal machine, and reversibility as a property degrades into refusal as a property ^[5]. For the census share to transfer to a private fleet, those write endpoints would have to expose compensating or read-before-write operations at the same rate that public MCP servers do, and the census counted public servers only, at stage one, excluding production deployments ^[4]. The census is the cheap experiment. It runs against your own tool manifest and costs nothing but a morning.

On the rest of the evidence: the Lean model and the Rust implementation are related by a differential test over conformance vectors, and the author says no refinement theorem exists ^[13]. Two of seven listed falsifiers are blocked for want of an operator population, four more sit in the paper, and the offline re-verification one is runnable today by pointing the verifier at a frozen receipt corpus with networking off and checking signature, log inclusion and identifier consistency ^[14][16]. The paper is a forthcoming preprint with no DOI ^[17]. That is a fair statement of where the work is, which is more than the ordering it replaces usually offers.