Wave 2 — One event fabric from message to publication

#Canonical identity separation

TalkCo should keep these identifiers distinct:

Identifier	Meaning
`object_id`	Stable logical content identity
`event_id`	One signed causal event
`revision_id`	One immutable content revision
`projection_id`	A local or publication-facing materialization
`ciphertext_id`	Audience/epoch-specific encrypted bytes

This prevents a local database row, relay event, CRDT actor, or transport peer ID from becoming application authority.

#Promotion state machine

draft-local
  → message-committed
  → threaded
  → promotion-proposed
  → promotion-authorized
  → publication-reencrypted (when audience changes)
  → published
  → reply-exported / revision-created / tombstoned / audience-transitioned

Pinning is local and never changes access. Promotion creates a new immutable channel-post revision only after every meaningful participant whose material is lifted signs a consent receipt naming the selected source revision, target channel, audience, retention policy, and permitted provenance disclosure. If the source is MLS-protected—or publication changes context, audience, retention, associated data, or unlinkability—the client creates a fresh publication object and fresh ciphertext. Rewrap-only is permitted only for an already object-enveloped source whose signed policy and associated data explicitly authorize the projection and accepted linkability. The original private conversation remains private unless its members separately grant access.

Replies are signed child events with a thread root, parent revision, author/device, chosen audience, ciphertext envelope, and moderation references. Their effective audience is the intersection of the parent discussion scope, the commenter's chosen scope, and the commenter's current grants. A reply cannot widen its parent audience; broader publication requires a separate promotion and consent event.

#Relevant precedents and limits

Matrix rooms and event authorization provide a mature reference for signed events, state, and federation, but TalkCo must keep its own authority reducer.
Matrix relations show how replies and aggregations can be linked without rewriting the root object.
NIP-10 and NIP-09 are useful interoperability references for reply and deletion events, not an authority model.
Automerge conflicts support local projection and deterministic conflict materialization, but a CRDT cannot decide who was authorized to publish or moderate.
p2panda is a promising signed-operation/local-first reference; its current encryption defaults need verification before adoption.

The strongest seam is a TalkCo event graph plus deterministic reducer. A CRDT, MLS group, relay protocol, or database can be plugged beneath it.

#Falsifiers

Promotion and replies arrive in different orders and replicas disagree about valid parentage.
A malicious client manufactures a publication projection without a valid promotion authority.
A wider publication exposes the private source conversation or a reply from a narrower audience.
A tombstone, edit, or moderation event rewrites history rather than creating an auditable overlay.
A CRDT or relay arrival order changes the authority decision.

#Open Threads

Specify publication authority for personal posts, shared communities, and delegated channels.
Decide whether a publication commit contains a new ciphertext, a set of HPKE envelopes, or both for each audience class.