The timed-ledger spectrum.

// Take the head of a T1 session ledger, re-sign every entry with Falcon,
// and emit a permanent T3 anchor. Existing T1 Ed25519 signatures remain
// valid for offline replay of session history; the durable copy uses PQC.

fn promote_t1_to_t3(src: LedgerHandle, dst_spec: TierSpec) -> Result[Promotion, Error] {
    assert(dst_spec.sig_scheme == Falcon1024);
    let head = src.head();
    let checkpoint = build_checkpoint(src, head);
    let dst = open_ledger(dst_spec);
    dst.append_attested(checkpoint, hatp_host_key());
    anchor_now(dst, AnchorPolicy::MerklePermanent);
    Ok(Promotion { src_head: head, dst_head: dst.head() })
}

// Destroy the per-record AES key in the vault. The header (with its hash
// chain & signature) survives; the payload becomes unrecoverable bytes.

fn shred_entry(handle: LedgerHandle, cid: bytes32) -> Result[ShredReceipt, Error] {
    let entry_key = vault_key_for(cid);
    vault_destroy(entry_key);
    handle.mark_shredded(cid, ts_now());
    Ok(ShredReceipt { cid, ts_ms: ts_now(), proof: handle.head_attestation() })
}