A provenance ledger can verify that a result is correctly sealed and still let it land somewhere it was never authorized to go. Authorization and evidence-checking usually happen as two separate steps, and that gap is enough: a correctly-sealed result can be replayed into a slot it was never meant for.
This paper closes the gap. The Lindsey Commit Gate makes the authorization and the ledger write a single atomic act — a revocable, one-shot capability that is consumed exactly when the mutation commits, or not at all. It's fail-closed: if anything is off, nothing writes.
I tested it the way the discipline demands — adversarially, before believing it. 626 cases, 464 of them attacks across twelve families designed to slip a write past the gate. Zero unauthorized commits. Under 32 concurrent processes and simulated crashes it stayed idempotent and recovered without deadlocks.
The honest scope, stated plainly: this is the transactional integration of authorization and mutation under single-host, single-filesystem assumptions. It does not validate the research claims a ledger holds — it makes sure a sealed one can't be spent twice, or spent where it doesn't belong. That's a narrow guarantee, and it's the one I claim.
→ The paper (preprint, CC BY) · the discipline it belongs to