When the records do not match

In plain English

This summary is not the rules. Where it and the rulebook differ, the rulebook governs.

1. Almost always, nothing happens. Both sides send their account of a session, the two agree, and a matched pair is recorded. Nobody is notified and there is nothing to read.
2. Sometimes they do not agree. That is a divergence — and a divergence is a question, not an accusation. Nobody is in breach because two records differ.
3. Both companies are asked to explain, and both are marked while that happens. Not one. The scheme does not guess which side is wrong before asking.
4. Most end there, because one side goes and looks and finds its own fault: a dropped message, a retry, a clock, a bug.
5. The scheme never investigates. It holds no message contents, no logs and no access to anyone’s systems — and where a rule needs both records, it is forbidden from deciding on one side’s word.
6. What settles it is who can produce their own evidence. A company that cannot may not rely on its own account, and the other side’s account then stands unopposed.
7. If both can produce and still disagree, that is recorded and the scheme stops. The argument about money is theirs. What they take into it is two signed records made at the time.

The normal case

Two companies each send their own signed account of the same session. The scheme compares them in a fixed order: session totals first, because a disagreement there settles it without further comparison; then the sequence of interactions, the argument digest for each, and the direction each side recorded.

Where they reconcile, a matched pair is recorded. The rulebook calls it “a positive record that nothing happened”, and it exists so that the absence of incident is evidenced rather than assumed.

Clauses 23.1 to 23.3.

What a divergence is, and what it is not

A divergence is recorded when the two accounts do not reconcile: one side asserts an interaction the other does not; totals cannot be reconciled; the argument digests differ for the same interaction; the two sides record different directions; the sequences differ in order or content; or the two sides give different identifiers for the same session.

And then the rulebook says what it is not, twice, in two separate clauses.

This is not a technicality. A member whose records diverge once has done nothing wrong, is published as having done nothing wrong, and owes nobody anything. A scheme that treated every mismatch as an accusation would be unusable, and no competent risk function would let its company join one.

Clauses 23.4, 23.5 and 28.3.

The process, and its clocks

Every period below is fixed in Schedule 4 of the rulebook and has a value. Two of them bind the scheme rather than the member.

Where the explanation resolves it. If the divergence is explained by an emission failure at one member, that is an evidence failure against that member. If it is explained by interactions conducted outside the member’s own instrumented path, that is a different breach.

Where no explanation arrives. Failure to respond within the period is itself a breach — determinable on the face of the record, requiring no investigation of anything.

Clauses 23.5, 23.6, 27.5, 27.6, 32.1; Schedule 4.

What the scheme can determine, holding no logs at all

Four things. All arithmetic. None of them requires anyone to be believed.

• Whether each side sent a record at all. Failing to, within the deadline, is a breach in its own right — whatever the underlying facts were.
• Whether each side answered within the period. The same.
• Whether a record contradicts its own scope class. A caller whose own account shows an operation its class forbids, a ceiling crossed, or a delegation that had expired, has settled the question out of its own document.
• Whether a party disowns a record it signed. That is a breach independent of what happened.

Determination is “the comparison of an Assertion against a published Rule. It is arithmetic and it does not involve the Scheme forming a view.” Every determination records what it relied on: the rule, the session, the records, and the member it is attributed to.

Clauses 27.2 to 27.6, 29.1 and 29.2.

What the scheme cannot determine — and is forbidden from determining

That is clause 29.3, and it is the answer to the hardest question anyone asks about this scheme. If two accounts contradict each other and both are internally valid, Rootwall does not pick a side. It cannot — and it is not permitted to try.

• It never sees what was in the traffic. Records carry the names of arguments and a digest of their values, never the values. No request or response bodies, no argument values, no member’s log estate — and the rulebook adds that nothing in it may be read as claiming otherwise.
• It may not infer. No statistical baseline, no model, no anomaly score, no comparison with a member’s own history or with the membership. Observed usage may inform whether a ceiling is set sensibly. It may never produce a consequence for an individual session or member.
• It does not judge conduct it merely dislikes. Conduct inside a scope class that breaks no rule is not a breach. The scheme does not make a member answerable where no rule was broken.
• It takes no position on loss. See the witness function below.

Clauses 24.1, 24.2, 28.4, 29.3 and 29.4.

So how does the truth come out

By burden, not by investigation.

Each member holds its own substantiating material — the underlying evidence behind its own records. The scheme never receives it, never requests it, and never holds it. The member keeps it for a fixed period, and failing to keep it is itself a breach.

In a dispute, a member may choose to produce it.

In plain English: nobody’s evidence is seized. It is made expensive not to have kept it.

Why this works on a party that is not being straight. It has already signed a record it cannot now disown, because disowning it is itself a breach. To prevail it must produce material consistent with what it signed, knowing its counterparty is producing its own. That is a considerably harder position than exporting a log afterwards and asserting it.

Why it usually never gets that far. Most divergences are a dropped message, a retry, a clock skew or a bug — and the explanation step surfaces them, because one side goes and looks.

Clauses 21.2, 22.3, 22.3B, 24.4 and 27.9; Schedule 4.

If both sides substantiate and still disagree

The scheme records exactly that, and stops. Both accounts stand. The divergence stands on the record. Any breach that is determinable — a missing record, a missed deadline, a self-evident scope violation — is determined and carries its published consequence. Whatever remains in dispute between the two companies is theirs, and the rulebook says expressly that nothing in it excludes, restricts or replaces any member’s rights against another.

Not two log exports produced afterwards by each side’s own systems, each of which the other has every reason to disbelieve. That is worth more than a verdict from us, and it is defensible in a way a verdict would not be.

Clauses 29.3 and 32.4.

Disagreeing with a determination

A member may seek review within 20 business days. Review is narrow, and deliberately so. It is limited to four questions:

1. Was the rule relied on in force and applicable?
2. Are the records relied on the ones actually held?
3. Does the determination follow from them?
4. Is the consequence applied the one published?

Review is “not a rehearing, is not an arbitration, and does not extend to the merits of the Rule.” It is determined on the documents. There is no hearing.

A member that disputes a determination beyond those four questions may withdraw and pursue any remedy it has at law. Said plainly: the review is an arithmetic check on our own working, not a tribunal. If you want a tribunal, that is the courts — and the rulebook says so rather than pretending otherwise.

Where a review succeeds, the determination is set aside and the scheme records why.

Clauses 32.1 to 32.5.

The witness function — when members go to law

Where a member tells the scheme it is in dispute with another member about loss arising from a session, the scheme releases the records it holds for those sessions. It does not test whether a dispute exists; a member may obtain the record of any session it was party to, and the notification is a formality rather than a gate.

The scheme takes no position. It does not characterise the records, does not say whether loss occurred or was caused, does not quantify anything, and does not appear, advocate or opine for either member.

Release is not a determination and does not require one. Determination concerns rules; this concerns loss, and the scheme has no function in respect of loss beyond release.

Records are also released to a court, regulator or other authority where legally required, and the members are told unless we are prohibited from telling them. A request suspends destruction of the records concerned until the matter concludes.

Clauses 33.1 to 33.6.

Scope, in and out, on one page

Five worked examples, including two that go badly

1. A dropped record — the common one. One side records twelve interactions, the other eleven. Both are asked. The caller finds its emitter dropped one on a retry and says so. Determined against it as an evidence failure, with the published consequence. No question of fact was ever contested. Elapsed: days.
2. The self-settling record. A caller’s own account shows an operation its scope class does not permit. No conflict of accounts arises — it said so itself. The scheme formed no view about anything.
3. The denial that cannot be substantiated. One side records a call; the other records nothing and says it never happened. The first produces its substantiating material. The second cannot. It may not rely on its own account, the first stands unopposed, and its failure to send a record is separately a breach. The scheme did not decide who was lying. It applied a burden.
4. The genuine standoff. Both produce material and the accounts remain irreconcilable. The divergence is recorded and stands; any determinable breach is determined; nothing else is. The two companies take both signed records into their own dispute, and the scheme’s involvement ends.
5. The one nobody sees. A well-defended member stops a misbehaving caller below the published ceiling. No rule was crossed, so nothing is recorded, no consequence attaches, and the next company that caller approaches learns nothing. This is a real limitation of the design and it is stated in the rulebook rather than left to be found.

The questions this raises