The record

A record belongs to one person and is divided into partitions, each holding that person's entries. An entry has an internal ID and an immutable version, a partition, a domain and key from the vocabulary, a typed value, a semantic kind, provenance, a temporal interval, an optional overlay, approved renderings, a status and the origin it was written at. The exact stored and exported shape is the entry schema.

Typed, not free-form

Every entry uses a key from the vocabulary: 30 keys across 17 domains in this edition. The value must pass that key's closed schema, and a key outside the vocabulary is rejected; there is no arbitrary-JSON lane. Safety and sensitivity come from the vocabulary, never from a flag a contributor supplies. See Domains.

An entry's context_kind is fact, preference or state, separately from where it came from. Facts describe a declared or evidenced condition, preferences express choices, and states describe bounded current circumstances.

Versions and deletion

A change creates a new immutable version; nothing is overwritten in place. Deleting an entry creates a separate tombstone that carries the entry's ID, version, partition, domain and key and the deletion time, and no value or evidence. A partition holds at most 10,000 entries that have not been deleted; a write that would add another fails with entry_limit_reached and changes nothing. No agent operation adds an entry, so only the person's own operations, such as accepting a proposal or importing, can meet that limit.

Temporary context

Every entry has a validity interval: the start is inclusive and the end exclusive, and an entry is eligible only inside it. A state, and every temporary overlay, needs a finite end. An overlay is a separate preference that temporarily replaces a lasting one for the same key without altering it, and only when the person enables it. When it ends, the lasting preference applies again on the next read; expiry does not erase history or a recipient's copy. A temporary preference cannot silently remove a safety-critical fact. Both the entry and the recipient's grant must be valid for a read. See consent, temporary context and portability.

Record identifiers are owner-only. A recipient sees pairwise references instead; see Discovery and handles.

Written against edition 1.0-draft-1: A4 Data model