Carry the licence answer that stands into the tree, which publishes the one it supersedes

[iderex]

Entry 1 of #1 was answered twice and the second answer stands. The tree publishes
the first. Nothing on this board holds the work of moving it, and the answer that
stands says of itself that the record is the build.

What is wrong

The answer that stands, read out of the issue that holds it:

gh api repos/Flowfin/core/issues/1/comments --jq '.[] | select(.created_at | startswith("2026-09-04T21:44")) | .body' | head -1
The answer of 2026-09-04 stands: MIT OR Apache-2.0. Entry 1 was answered twice because the second reading revisited it with the reason the first did not carry, that a core whose purpose is to be linked by clients this organisation does not write cannot be copyleft in any strength; the 2026-08-24 entry is superseded by that reading, and the record in docs/decisions/ says so in one sentence rather than leaving two answers on this issue for the next reader. Entries 2, 3 and 4 are unchanged. Label off; the record is the build.

What the repository publishes, read at the default branch:

git rev-parse origin/main
7587fa7149657fdb9890b06fb3de2619329e079b
gh api repos/Flowfin/core --jq '.license.spdx_id'
AGPL-3.0
git show origin/main:Cargo.toml | sed -n '8p'
license = "AGPL-3.0-or-later"
git show origin/main:README.md | sed -n '178p'
AGPL-3.0, copyright 2026 Nils Lehnen.
git show origin/main:LICENSE | sed -n '1,2p'
                    GNU AFFERO GENERAL PUBLIC LICENSE
                       Version 3, 19 November 2007

Four statements of one fact, all of them the answer that was superseded. This is
the first thing a client author checks before writing a line against this core,
and it is the one fact on this board where a reader following the decision to the
artefact finds the opposite of what was decided.

No record in docs/decisions/ states the outbound licence the answer names. The
only files carrying that expression carry it as a dependency's terms rather than
as this core's:

git grep -l -i 'MIT OR Apache' origin/main -- docs/
origin/main:docs/decisions/0243-the-means-a-certificate-is-validated-with.md
origin/main:docs/decisions/0268-a-conjunctive-licence-expression.md
origin/main:docs/decisions/0292-the-means-the-core-speaks-http-with.md
git grep -n -i 'distributed under' origin/main -- docs/decisions/
origin/main:docs/decisions/0103-what-admits-a-dependency-and-what-is-refused.md:76:inside a work distributed under AGPL-3.0-or-later. Refused for a second reason,
origin/main:docs/decisions/0103-what-admits-a-dependency-and-what-is-refused.md:84:Why the set is shaped this way. The core is distributed under
origin/main:docs/decisions/0268-a-conjunctive-licence-expression.md:178:inside a work distributed under `AGPL-3.0-or-later`, and that licence enumerates

Why this is not the file swap it looks like

The outbound licence is a premise other records reason from rather than a value
they quote, so four of them move with it:

git grep -c -i 'AGPL' origin/main -- docs/decisions/
origin/main:docs/decisions/0011-the-language-the-toolchain-and-the-binding-layer.md:2
origin/main:docs/decisions/0091-what-the-first-release-contains.md:1
origin/main:docs/decisions/0103-what-admits-a-dependency-and-what-is-refused.md:5
origin/main:docs/decisions/0268-a-conjunctive-licence-expression.md:3

0103 derives the shape of its admitted set from the direction of one-way
compatibility, in its own words:

git show origin/main:docs/decisions/0103-what-admits-a-dependency-and-what-is-refused.md | sed -n '84,88p'
Why the set is shaped this way. The core is distributed under
AGPL-3.0-or-later, so the one-way compatibility is the direction that matters: a
permissive or weak-copyleft node can be carried inside this work, and a node whose
own terms forbid the conditions AGPL-3.0-or-later imposes cannot, whichever way
round it is more convenient. `GPL-2.0-only` is named rather than left to the

Under the answer that stands that direction reverses and the admitted half
shrinks, so 0103 is superseded rather than corrected, and 0268 answered its one
unnamed term against the premise that moves.

What no entry in the graph is waiting on, measured rather than assumed

The shrinking set costs nothing that is already here. Every node in the resolved
graph today is permissive, so no current entry is admitted only by the clause that
moves:

cargo metadata --format-version 1 --locked | jq -r '.packages[] | select(.name != "flowfin-core") | "\(.name) \(.version) \(.license)"' | sort
base64 0.23.1 MIT OR Apache-2.0
block-buffer 0.12.1 MIT OR Apache-2.0
bytes 1.12.1 MIT
cfg-if 1.0.4 MIT OR Apache-2.0
cpufeatures 0.3.0 MIT OR Apache-2.0
crypto-common 0.2.2 MIT OR Apache-2.0
digest 0.11.3 MIT OR Apache-2.0
http 1.5.0 MIT OR Apache-2.0
httparse 1.10.1 MIT OR Apache-2.0
hybrid-array 0.4.14 MIT OR Apache-2.0
itoa 1.0.18 MIT OR Apache-2.0
libc 0.2.189 MIT OR Apache-2.0
log 0.4.34 MIT OR Apache-2.0
sha2 0.11.0 MIT OR Apache-2.0
typenum 1.20.1 MIT OR Apache-2.0
ureq-proto 0.6.1 MIT OR Apache-2.0

That is a reading of today's graph and not a promise about the next entry, which
is exactly what the superseding record has to state rather than leave to be
re-derived.

What this does not decide

Which of the two answers stands. That was taken on #1 on 2026-09-04 and this
issue executes it. Anyone who wants to reopen it argues on #1 rather than here.

Whether one person may change the terms of what is already published. #1 carries
the reading that every commit on the default branch is by one author, so there is
nobody to renegotiate with, and this issue does not re-take that reading.

Done when

A record in docs/decisions/ states the outbound licence as MIT OR Apache-2.0,
names the answer it supersedes and the reason given for it, and states what the
admitted set of #103's successor is under the reversed direction.

0103 is superseded by that record rather than edited, 0268 is re-read against the
premise that moved, and the pointers in 0011 and 0091 name the record that stands.

The root carries the licence texts the expression names, and Cargo.toml,
README.md and NOTICE.md agree with them.
gh api repos/Flowfin/core --jq '.license.spdx_id' reports what the tree carries
rather than what it superseded.

A reading of the resolved graph against the successor record's admitted set is in
the change that lands it, so an entry admitted only under the old direction is
found by that run rather than by the next reader.

[iderex]

The last condition here is a state on GitHub rather than a byte in the tree, so it could only be read after the merge. I said in #307's body that I would take the reading and write it here whatever it said. It says Apache-2.0, read at the mainline this change landed on:

git rev-parse origin/main
27e4629578cb0fe42473f5b18d487217df576506
gh api repos/Flowfin/core --jq '.license'
{"key":"apache-2.0","name":"Apache License 2.0","node_id":"MDc6TGljZW5zZTI=","spdx_id":"Apache-2.0","url":"https://api.github.com/licenses/apache-2.0"}

So the listing no longer reports the answer that was superseded, which is what this condition asks. What it reports instead is one member of a two-member offer, and that is worth stating rather than reading as agreement: the field holds a single SPDX identifier, the offer is a disjunction of two, and the detector picked the file it matched. It is not MIT OR Apache-2.0 and there is no shape of that field in which it could be.

What the tree carries is unambiguous and is the authority for the terms:

git show origin/main:Cargo.toml | sed -n '8p'
license = "MIT OR Apache-2.0"
git ls-tree --name-only origin/main | grep -i licen
LICENSE-APACHE
LICENSE-MIT
git show origin/main:README.md | sed -n '178p'
`MIT OR Apache-2.0`, at your choice, copyright 2026 Nils Lehnen.

A recipient who takes MIT alone is within the offer whatever that listing says, because the two files at the root and the expression in the manifest are what grant it. Anyone treating the provider's field as the licence of this repository reads half of one, and docs/decisions/0303-the-licence-the-core-is-offered-under.md names that field under what it does not decide for exactly this reason.

The other conditions were met in the change itself and the evidence for each is in #307's body: the record states the outbound licence, names the 2026-08-24 answer it supersedes and the reason given for the one that stands, and carries the admitted set under the reversed direction; 0103 is superseded rather than edited; 0268 is re-read against the premise that moved, with its conjunction rule untouched and Unicode-3.0 held on the ground that survives; 0011 and 0091 each carry a pointer to the record that stands; the root carries both texts and Cargo.toml, README.md and NOTICE.md agree with them; and the resolved graph is read against the successor's admitted set in the record, sixteen packages, none of them admitted only by the clause that moved.

Two things this did not do, so that neither is discovered later as a surprise. The two dependency entries in Cargo.toml still cite 0103 by number; every licence statement in those comments is still true under the successor, so what is stale is the number and not the judgement, and the record names that residual in its own text. And nothing in this repository reads a licence expression, before or after this change, so the reversed set is applied by the review and by the line beside a manifest entry and by nothing that runs.