Arising from dec-0006 — Tiers are fractal — one entry model, one join rule, one drift flag, at every level

Inheritance is one-way and read-time only — private context never lands in a public ledger

The personal ledger is private. Repo ledgers ship publicly as part of an OSS repository. The tier design (dec-0006) puts them in the same graph, so the boundary has to be enforced by the architecture rather than by care.

Three rules, and they are absolute:

1. **Downward only.** A child ledger may read its parents. A parent is never written to by a child, and dira has no verb that does so. 2. **Read-time only.** Inherited context is materialized into a session brief in memory. It is never persisted into the child's `.dira/entries/`, so it cannot be committed by accident. 3. **No leakage through derived artifacts.** Any entry marked `private: true` — and every entry in a `tier = "person"` ledger by default — must not appear in a mirrored ADR, an exported view, a hosted render, or a `dira check` message that is written to a public path. Where a check needs to cite a private constraint in a public context, it cites the **ref only** (`me:cst-0002`), never the text.

The failure this prevents is unrecoverable in the way that matters: a private strategic note or personal constraint committed into a public repo's git history cannot be un-published. Treat any violation as a security bug, not a UX bug.