Lifecycle transitions and entrenchment

Two layers

Everything in the “reality pokes a running contract” space splits cleanly in two. Naming the split is what makes the ambition - cover the mechanics that exist in law and contract, not just the binary ones - tractable: every legal event gets exactly one home.

• Execution overrides (RFC 0001) - deviate a running contract, identity unchanged: suspend and toll, waive, judgment override, external authority, and hardship (below).
• Identity transitions (this RFC) - change which contract exists: form, amend, assign, replace or novate, terminate, rescind.

Mechanic	Legal name	Layer	Identity
Form	offer / acceptance / signing	transition	born
Amend	variation	transition	continuous
Assign	assignment / cession	transition	same contract, new party
Replace / Novate	novation / supersession	transition	old discharged, new born
Terminate	termination for notice or cause	transition	contract ends
Rescind	avoidance / voidness	transition	unwound from the start
Entrenchment	mandatory terms / eternity clause	guards both	-
Hardship	changed circumstances	override	continuous

The covenant threaded through all of it: every transition is a declared, gated capability. Absent gate = prohibited. A contract that declares no replacement gate cannot be mechanically replaced - the parties take the honest manual road (mutual termination plus a fresh signing). “Everything declared, nothing silent,” applied to the contract’s own mortality.

These mechanics ship as standard-library modules that cite the relevant statute, not as clauses rewritten into every contract.

Entrenchment - the anti-rug-pull spine

The honest creak that haunts every override and every amendment: a powerful amend or replace gate is a governance hole wearing a receipt. If a transform or a successor contract can quietly strip a protective term, the properties hold technically while the contract lies socially. Entrenchment is the structural answer: declare which terms are protected, and the machine rejects any transition that violates them - at runtime and at authoring time.

# protected terms. entrenchment is signed at genesis; it binds amend AND replace AND terminate.
entrenched:
  withdrawal.window   floor 14 days                 # may move only toward the consumer (grow); never below statute
  cap                 ceiling-monotone down          # the ceiling may drop, never rise, via any transition
  confidentiality §16 frozen  survives replace,terminate,rescind   # an eternity clause: outlives the contract itself
  price.base          change-requires buyer.attest and supplier and auditor   # higher authority to touch
  liability.cap       change-requires notice 30 days then no counterparty.object  # procedural: cooling-off + veto

  self  frozen        # the guard on the guard: de-entrenching needs the same authority it protects

Four grades of protection - a closed vocabulary:

Grade	Meaning	Legal analogue
frozen	untouchable by any transition, ever	an eternity clause
floor / ceiling-monotone	may change only in the protected direction	mandatory consumer protection, statutory minima
change-requires <authority>	may change, but only with elevated signing	an entrenched-amendment procedure
change-requires notice ... then <veto>	may change, but only after delay and a window to object	no-oral-modification clauses, procedural entrenchment

How the rug-pull surfaces as an issue - in two places:

1. At runtime: a transform or a replacement that would violate an entrenched term is rejected, and the receipt names the violated clause. The deviation cannot happen silently.
2. At authoring time (the linter): a contract that declares a replacement or amend capability but leaves profile-mandated floors un-entrenched raises a finding - “replaceable contract, protected floors undeclared: rug-pull risk.” Profiles turn the warning into an error: a consumer profile must entrench consumer floors; a public-sector profile must entrench statutory ceilings. The creak stops being a footnote and becomes a lint gate.

The machine still enforces only what the author declared. Entrenchment makes the protection declarable and checkable; the profile mandate makes it mandatory. Without the mandate, an author who entrenches nothing still ships a rug-pull - so the profile floor is load-bearing, not the syntax alone.

Replace / Novate - old discharged, new born

Not amend. Amendment keeps identity; novation discharges the old obligation and creates a new one - limitation clocks can restart, sureties can lapse. So it is a distinct mechanic, and a gated one.

replacement:
  §22 supersession   tier soft   category material-change
       # predicate ("a material change", "a regulatory change making performance unlawful") -> prose, forever;
       # the machine NEVER evaluates it - it judges the notice + the successor, not the world
       implemented-by: replace.propose, replace.effect

  trigger    replace.propose  from either-party        payload signed-notice     # cites §22 + the event
  authority  replace.effect   from buyer and supplier  payload successor-genesis  # who may effect it
             # ...or `from regulator` for a statutory swap (external authority, RFC 0001)

  successor must:                          # <- the machine's actual teeth
    pin predecessor.final-state-hash       #   continuity: the successor replays from the last state; determinism holds
    preserve claims open                   #   accrued-but-unsettled claims carry; never silently voided
    honour entrenched                      #   every frozen/floor term survives the swap, or...
    else reject "successor violates an entrenched term"

  on replace.effect:
    carry     claims.open, pools.*         # declared carry-over
    discharge obligations delivery.*       # declared discharge: the old duties die HERE (novation, not amend)
    escalate  level superseded             # replacement always summons humans + leaves a receipt

The elegant part: this is not a new primitive. It is a composition of pieces the standard already has - the successor genesis is staged binding (a constraint-violating binding is already rejected); the pin predecessor.final-state-hash is the transform’s from-hash guard at whole-contract scale; honour entrenched is the section above. A new declared block, zero new engine machinery.

Prior art: novation proper (discharge-and-replace, distinct from assignment and amendment); the ISDA novation definitions and protocol (novation standardized as a machine-adjacent procedure); and, in EU public procurement, the rule that an amendment so material it is legally a new contract triggers a re-procurement - the same gate, imposed by statute.

Assign - same contract, new shoes

A party hands its position to a third party; the contract is unchanged. The one-line difference from novation: carry all and rebind (nothing discharged) versus discharge plus a successor genesis.

transitions:
  §19 assignment   tier soft   category transfer
       implemented-by: assign.propose, assign.effect

  in  assign.propose  from supplier            payload signed-notice
  in  assign.effect   from supplier and buyer  payload new-party-binding   # counterparty consent gate

  assignee must:
    satisfy binding.constraints of party supplier   # new party fills the SAME slot, same constraints
    else reject "assignee fails the supplier slot constraints"

  on assign.effect:
    rebind    party supplier -> payload.assignee     # rights + obligations move
    carry     all                                    # nothing discharged - identity preserved
    notify    buyer
    escalate  level assigned

Prior art: assignment and cession of a contract; anti-assignment clauses (why the consent gate is declared, not assumed); supplier substitution inside a procurement framework.

Terminate - by notice or for cause

Two flavours, legally distinct. Termination by notice is ordinary, prospective, and winds down over a period. Termination for cause needs a material breach on record - the ground (“material breach”) is soft, but the breach event is hard.

transitions:
  §17 termination
       implemented-by: terminate.notice, terminate.cause

  in  terminate.notice  from either-party  payload signed-notice   # convenience / expiry
  in  terminate.cause   from either-party  payload signed-notice   # for material breach

  rule on terminate.notice:
    due wind-down within notice-period 3 months      # obligations run out the notice window
    escalate level terminating

  rule on terminate.cause:
    if payload.overrides is not a recorded breach receipt of this contract -> reject "no cause on record"
    discharge obligations forward
    settle    claims open                            # accrued claims crystallize, don't vanish
    escalate  level terminated

  finally:
    honour entrenched survives terminate             # confidentiality & co. outlive termination

Prior art: termination on fundamental breach (sale of goods, CISG); the NEC4 termination procedure; ISDA early-termination and close-out netting (accrued claims crystallize, they do not vanish - the settle step).

Rescind - unwound from the start, without erasing the log

The hard one against determinism. Rescission - on grounds of fraud, duress, or mistake - says the contract never should have bound. But the log is immutable; you cannot delete. So rescission is declared reversal, never erasure: emit compensating events that restore the pre-contract position going forward; the record stands forever; “never existed” is a view computed from the reversals.

transitions:
  §24 avoidance   tier soft   category rescission
       # grounds (fraud, duress, mistake, unconscionability) -> prose;
       # a court OR a mutual signed decision triggers; the machine never judges the ground
       implemented-by: rescind.order

  in  rescind.order  from court or (buyer and supplier)  payload signed-decision

  on rescind.order:
    reverse   effects all           # NOT delete - emit reversal receipts (an accounting reversal at contract scale)
    restore   pools, payments       # what moved, moves back (restitution)
    freeze    ports all             # forward: the contract acts as if it never bound
    escalate  level rescinded
    # the event log stays immutable; the "rescinded" projection is a fold over the reversal events

Termination is prospective (“stop here”); rescission reverses (“as if never”). Both keep the record. Prior art: the law of voidness and avoidance; restitution of an undue transfer; and event-sourcing’s compensating events (never mutate history).

Hardship - renegotiate, do NOT toll

Force majeure and hardship are different animals. Force majeure = performance impossible -> suspend and toll. Hardship = performance still possible but brutally onerous -> the obligations keep running while the parties are dragged to the table. Political change and climate change usually land here, not in force majeure. (This one belongs to the execution-override layer, but it is set out here because it is the family that most needs the distinction drawn.)

overrides:
  §15 hardship   tier soft   category hardship
       # predicate ("a fundamental alteration of the equilibrium of the contract") -> prose
       implemented-by: hardship.invoke

  in  hardship.invoke  from affected-party  payload signed-notice   # cites §15 + the event

  rule on hardship.invoke:
    # NO toll - obligations keep running (the duty to perform during renegotiation)
    escalate level renegotiation
    accept

  escalation:
    level renegotiation:
      due meet within 30 days
      due transform.propose or hardship.withdraw within 90 days
      when no transform by 90 days -> open termination path §17   # deadlock -> exit, NOT free suspension

The one line that carries the legal weight: no toll. Fold hardship into “suspend and toll” and the machine gets the consequence wrong. Prior art: the UNIDROIT hardship articles; the ICC Hardship Clause (published separately from the ICC Force Majeure Clause, for exactly this reason); general adjustment-of-terms doctrine.

Honest creaks

1. Entrenchment is only as good as the profile mandate. Author entrenches nothing, and a rug-pull ships. The syntax makes protection declarable and lintable; only a profile floor makes it mandatory.
2. Rescission’s reversal is not always physically possible. You can reverse a payment; you cannot un-deliver a consumed service or un-disclose data. Reversal restores value (restitution), not the physical world - the receipt must be honest that some reversals are monetary settlements, not a true undo.
3. Novation versus amendment is a drafting judgment the machine can’t make. Whether a given change is “so material it is really a new contract” is soft. The machine enforces the declared choice; a mis-declared amendment that should have been a novation is a legal error the linter can only nudge (a large transform touching core terms -> “consider replace, not amend”).
4. A frozen term is a genuine lock-in. An eternity clause can outlive its own good sense. That is the point (protection), but a contract that freezes too much becomes un-evolvable and dies by termination instead of amendment. The trade-off belongs in authoring guidance, not silently in the grammar.

Open questions for comment

The effect-verb question below resolves against compose, don’t extend: reverse, rebind, carry, and the rest should first be sought as named compositions of the core verb set, not core additions.

• Is entrenchment a first-class genesis block with a closed grade vocabulary (frozen / floor / change-requires)?
• Is replace/novate a distinct mechanic from the transform, or a transform flavour? (Leaning distinct: discharge-and-reform is not a delta.)
• Is assign its own transition, or a party-slot rebind convention? (Leaning: its own, but thin - the difference from novation is carry all versus discharge.)
• Should terminate model notice and cause as two ports, with cause requiring a breach receipt?
• Is rescission’s reverse / restore a core effect family, given determinism forbids deletion?
• Is hardship its own override family, with no toll, opening a renegotiation clock to a transform?
• Are the new effect verbs (rebind, reverse, restore, carry, discharge, settle, pin, preserve, honour) a small closed core set, or profile-defined?