2. Glossary

Repository: bloque-app/aledgent
Commit: 5ca6b8a
Version: 0.4.27
Status: draft
Rendered: 2026-10-17T19:30:18Z
Source: SPEC.md, last changed in 5ca6b8a

One canonical name per concept. This document uses each term only in the sense given here.

Term	Definition
aledgent	The service this document specifies. Also called the ledger when the context is the service rather than the book.
Book	The complete, append-only, double-entry record of every entry aledgent has ever made. A deployment has exactly one book.
Operator	The party that runs a deployment of aledgent (§3).
Integrating party	An organisation that integrates aledgent to hold and move value for the identities it serves, or for itself. The operator registers it (`REQ-ID-7`). Like any organisation it holds an identity in the book, and it keeps its own record of the identifiers it serves (`REQ-ID-6`).
Identities principal	The principal that opens identities (`REQ-ID-6`): the operator, or the principal that plays that role in a deployment. It may also open ledger accounts, for any identity.
Identity	A principal that can own ledger accounts: a person, an organisation or an agent.
Agent	An autonomous software principal that acts for another identity, under delegated authority.
Ledger account	The unit of balance ownership: a container of balances in one or more assets, owned by one identity. Whoever holds authority over it can act on it.
Asset	A unit of value with a registered identity and a fixed precision. Amounts are integer counts of the asset’s minor units.
Book-only asset	An asset in the registry that is bound to nothing on the settlement layer. Its value enters and leaves by issuance and redemption only (`REQ-AS-7`).
Binding	The one-time act that ties a book-only asset to its identity on the settlement layer, at zero divergence (`REQ-AS-8`).
Seed	An initial state committed at a book’s genesis by a digest, from which the book’s first state is derived before it takes any command (`REQ-RC-6`). It is sealed once that state is in place and checked against the commitment.
Alias	A name for a ledger account, by a source and a name within it: a prior system’s identifier, loaded with a seed, or a name the operator registers after genesis, such as a role (`REQ-RC-7`). It names one account for good and carries no personal data (`INV-17`).
Archived identifier	A prior system’s identifier that the initial state deliberately left out. It names no ledger account and never will (`REQ-RC-7`).
Balance kind	One of three amounts of an account’s holding in an asset, each readable separately: available, reserved, encumbered. Their sum is the total. Whether the three are partitions of one account or positions the account draws on is an implementation choice.
Available	Spendable now, without any further decision.
Reserved	Committed to one identified operation whose outcome is not yet known. Already deducted from available. MAY be derived as the sum of the account’s open reservations.
Encumbered	Restricted by a standing rule on a specific amount, not tied to a single operation: a dispute, a legal hold.
Freeze	An account status, not a balance kind. A frozen account refuses debits and accepts credits. Its balances do not change: its value stays available, and is not spendable while the freeze lasts (`REQ-LA-7`).
Entry	One side of one posting: an account, an asset, a direction, an amount, a balance kind.
Posting	The atomic, balanced set of entries committed together. The unit of atomicity in the book.
Movement	An account’s own view of a posting: direction, counterparty, amount, asset, time, status. Derived from the book, never a separate record.
Operation	The unit of intent a principal submits. It is one of: transfer, reservation, capture, release, deposit, withdrawal, issuance, redemption, reversal, custody change, credential change, recovery, opening load. One operation causes zero or more postings.
Operation record	The mutable object carrying one operation’s intent, state, deadline, evidence and outcome. Distinct from the book: it causes entries there but never lives inside it.
Reservation	The act and the record of moving value from available to reserved for a named operation. The reservation is the operation’s balance effect, taken immediately.
Capture	Completing a reservation. Value leaves reserved and reaches its destination. MAY be for less than the reserved amount.
Release	Ending a reservation without a capture. Value returns from reserved to available.
Reversal	An operation of its own that undoes the postings of a settled operation, with one `Reversal` posting that references them. The operation it reverses stays settled. One principal proposes it and a different principal approves it, each under its own authority.
Issuance / redemption	Value entering or leaving the book other than through the settlement layer, done by a principal holding issuance authority for the asset.
Partition	A part of the book’s state that commits on its own: every ledger account belongs to exactly one, and everything ordered against that account lives there (`REQ-RT-9`). Partitions hold one book; they do not split it (`INV-25`).
In-transit position	The book position that holds, per asset, the value of transfers whose payer’s partition has committed the debit and whose payee’s partition has not yet applied the credit (`REQ-RT-11`).
Consistent cut	One commit of each of the book’s writers, chosen so that no message is applied in it that was not sent in it, and no message in transit in it has been dropped by its sender. Anchors, reconciliation and bindings read the book at one (`REQ-RT-14`).
Execution node	One running instance of aledgent, with its own local storage, that holds a copy of the state of one or more of the book’s writers (`REQ-RT-13`) and takes part in committing it. Execution nodes are interchangeable and disposable: none holds anything that is not also held elsewhere, and none is part of the book’s identity (`NFR-21`).
Issuance counterparty	The named book position that value enters from and leaves to when it crosses aledgent’s boundary. Its balance is the negative of all value aledgent holds.
Settlement layer	The one external network through which value enters and leaves aledgent, and on which anchors are published. Defined by §4.4, never by name.
External leg	The part of an operation that executes on the settlement layer. It is inbound when value arrives, or outbound when value departs.
Settlement adapter	The component that executes outbound legs on the settlement layer and observes it, holding the keys to do so. It submits evidence but never decides outcomes.
Counterparty	The party on the other side of an external leg. Not a ledger account.
Observation	A recorded external fact: that a named event happened at a named coordinate on the settlement layer. Evidence, not a verdict.
Coordinate	The tuple that names an event uniquely and stably within the settlement layer. The deduplication key for observations.
Confirmation	An observation establishing that an external leg was included on the settlement layer. Not final, not settled.
Finality	The point after which the settlement layer cannot revise an observation.
Settlement	The completion of value exchange with a counterparty. Reached only after finality.
Authority	The right to cause a named class of operation on a named ledger account, within bounds.
Credential	Whatever proves that its holder has an authority: a key, a device-bound credential, an issued secret. Never a name.
Owner authority	The authority an identity holds over its own accounts, exercised with its own credential.
Delegated authority	A scoped, bounded, revocable authority that an identity grants to another principal: an agent, a member.
Operator authority	The custodial authority the operator holds over accounts in the delegated custody mode.
Recovery authority	The authority to co-sign the reissue of a holder’s credential over an owned-custody account, after a delay. A principal distinct from the operator holds it.
Successor	A principal the holder names, who may claim the holder’s account after a stated delay that the holder can cancel.
Custody mode	Whether an account is delegated, where the operator may act for it, or owned, where only the identity’s own credential can.
Cost sponsorship	aledgent bearing any settlement-layer cost an operation incurs, so that no identity holds, funds or is asked about such a cost.
Client key	A key the caller supplies to make a submission idempotent. It is opaque to aledgent. Nothing but deduplication depends on it.
Operation reference	The identity of an operation, derived by the service and unique forever. Never supplied by a caller, never parsed, and never carries status.
Anchor	A commitment published on the settlement layer to a state of the book at a point in time.
Checkpoint	The book state an anchor commits to.
Code version	The identity of everything that decides a writer’s transitions: a digest of each executable artefact, together with the settings it was built with. Two builds of the same source with different settings are two code versions. It names the platform its artefacts are built for, each artefact’s identities on that platform, and its code generation (`REQ-RT-19`, `REQ-RT-20`). What only replays a range, and decides nothing, is not part of it.
Code map	For each of the book’s writers, the ranges of its inputs and the code version that executed each range, derived from the book’s own inputs (`REQ-RT-16`).
Code archive	Where every code version that has executed an input is kept, by its digest (`REQ-RT-17`).
Code generation	The count of a writer’s upgrades: 0 at genesis, and one more after each upgrade. A writer holds the generation of its code in force. Each code version names one generation, and the code that decides its transitions carries that generation in its own bytes (`REQ-RT-20`).
Platform	The execution environment a writer’s code runs on: the runtime that executes it and the software on the execution node that drives it, named with their versions. The capabilities of §4.4 are requirements of a platform. Two platforms that both meet them are interchangeable for the book (`REQ-RT-19`).
Writer state	Everything a writer has committed after an input. That is its code version and code generation, the construction of its state commitment, its upgrade-authority mode and any scheduled change of it, and any scheduled upgrade. It also includes its configuration and bounds, every record it holds, its counters and log head, its committed inputs not yet archived, the deliveries and notifications it has not yet recorded as made (`REQ-RT-4`), the input number at which it was founded as a continuation, if it was (`REQ-RT-21`), and, for each other writer, the messages it has enqueued, applied, sent and had acknowledged (`REQ-RT-13`, `REQ-RT-14`). Exactly two kinds of field are host-local and are not part of it: the identity under which the platform accepts the writer’s inputs from the execution node that drives it, and a diagnostic that the platform reports to the writer about an input (such as the slot it observed). No other field is host-local.
Continuation	A writer founded to take over another writer’s sequence at an input number, from the other’s writer state and log head, so that the book’s inputs and their hash chain go on unbroken (`REQ-RT-21`).
Disclosure	A statement about ledger facts, addressed to a named recipient. The recipient can verify it without aledgent’s continued cooperation, and without learning anything the statement does not assert.
Verifier	The recipient of a disclosure: an auditor, a regulator, a counterparty.
Assurance level	The declaration of which §9 invariants a deployment enforces rather than attests.