The card can never be edited. A typo costs a revocation. Is that right?

[andrei-chernikov]

Five fields go on-chain in readable text and become the passport's card: title, author, short description, domain, object type. After minting, none of them can be edited. Ever.

A typo in the title is not fixable. Correcting it costs revoking the passport and issuing a new one — a second fee, and a revocation that stays visible in the record forever.

Why it was built that way

If the card can change, it proves nothing. The value of "this record has said the same thing since March 2026" comes entirely from the fact that nobody could have changed it — not the issuer, not us, not a court order. Every mutable field is a field an attacker or a coerced maintainer can rewrite, and a passport whose description can be edited after sale is a passport that can be made to describe a different object.

Everything that legitimately changes — sales, damage, restoration, attestations — is recorded as an append-only event. Added, never rewritten. The history accumulates instead of being corrected, which is the point.

Why it might be wrong anyway

Nobody has minted a real passport yet. When people do, some fraction will contain typos, because that is what happens. Each of those costs money and leaves a revocation on the record that looks, to a stranger, exactly like a passport that was revoked for a real reason.

That is a design that punishes carelessness with a permanent mark indistinguishable from a mark of dishonesty.

The questions

• Should a revocation say why? Right now the record shows that a passport was revoked, not whether it was a typo or a forgery. A reason field is cheap and would separate the two — but it is issuer-written, so it is a claim, not a fact. Does that make it worthless or still useful?
• Is there a correction that is not a revocation? An append-only event of type "correction" that points at the field and the intended value, leaving the original visible. The original card still says what it said; the reader sees both. Does that break the immutability guarantee or preserve it exactly?
• Should minting have a confirmation step that is genuinely hard to skip? Interface work rather than protocol, but it is where the problem actually gets solved. What does that look like without being annoying on the tenth passport?
• Is a free grace period defensible? Edit within an hour of minting, before anyone could have relied on it. It sounds humane and it is a hole: an hour is enough to sell something.

Nothing here is decided. The immutable card is load-bearing and will not be removed — but the experience around it has never been designed, because nobody has yet made the mistake it would protect them from.