the principal's decision procedure is a committed trace program in a total first-order language

agent-decided, reversible. In the evaluation ecosystem of projects/deference/rounds/2026-09-10-committed-principal-program/, the mandate event carries the principal's program π_P, a term of a total first-order language whose only input is the reason trace: constants, pattern counts over the trace (by kind, content, and a decidable proof check), sums, differences, products and a positivity test, one term per candidate, clamped to [0, 1]. Its input type is the point: a trace program cannot name the disposition register, a side-channel message or the selection coordinate, so susceptibility is a program of a different syntactic class (register programs), visible at issuance. The 2026-09-09 reading principal is the program reading; the canonical member of the non-degeneracy band is proofcheck, whose verdict depends on the trace only through the proof check. Rejected alternatives: a general-purpose language (undecidable evaluation, no typing fact); an opaque committed hash of the procedure (re-executable by nobody); typing the program over the whole log (it would read the prohibited channels).