Each instance has its own append-only chain — one chain per user. Every version writes a block with the fixed schema (n, version, ts, prev_hash, instance_h, delta_h, meta_sig, hash): a sequence number, version, timestamp, the previous block's hash (the link), instance and delta hashes, the metaSurf signature, and this block's hash. The prev_hash chaining makes tampering evident, exactly like a blockchain — but scoped to one user, locally (e.g. IndexedDB).