ARCADIA-Studio/harness/release-library-compatibility-contract-20260911.md

Library provenance, compatibility and source normalization: candidate contract

Codex-956atf /root/library_compatibility, 2026-09-11. Bounded follow-up to R1/R2/R3/R5 of the paired review. Read current PROJECT_GOAL.md, AGENTS.md, the paired proposals, issue #1 through #128, the empty open-PR inventory and Wiki Home/Authoring20260911 before work; ownership is in issue comment #130. Coordinated the property-owned baseline, explicit context and shared-check rules with /root/requirements_delta. The original library proposal, original analysis proposal and review remain frozen.

Owned changes are this report and the isolated experiment. No production, shared-ledger, Cargo, target, native, commit or push changes. Root granted a bounded std-only compiler lease; it is released. This is a candidate contract supported by a finite-model experiment, not shipped Studio grammar, full data/transition conformance or release acceptance.

Recommendation

Keep exact byte-pinned package closures, immutable imports, editable materialized patterns, exact last-adopted typed bases, explicit current correspondence and three-way updates. Add verified same-origin typed contract equivalence for supported definition use sites. Archive identity, reference identity and use compatibility are different relations. A compatible revision does not rewrite an existing reference, merge imported identities, advance a pin, or make historical records current.

Use the hybrid representation for the next production slice: qualified references for neutral quantity/unit/calculation definitions, immutable mapped local records for layered data/interface definitions, ordinary local records for pattern instances. Require one shared contract resolver and a scoped field/operation correspondence wherever a consumer uses a compatible mounted revision. Preserve layer distinctions. A transition must explicitly bind an exact target-layer package export or create an editable local derivative with historical origin and independent maintenance.

The experiment demonstrates a real advantage over strict revision-only compatibility: the selected left instance advances while the right instance, outside duration budget and typed receiver retain their exact records. Explicit checked bridges also work but require two additional pair-specific declarations for this example. Stable vocabulary dependencies avoid the pattern-only revision problem when their exact pin stays unchanged; they do not answer vocabulary evolution. Recommend stable vocabulary packages as an authoring convenience, not a mandatory escape from bundled libraries.

The representation comparison does not establish that hybrid mounts are intrinsically easier to implement. Layered qualified references have the same compatibility and transition obligations in this example. The reason to retain the hybrid is that it supports the required independent, editable OA/SA derivatives while keeping the existing layered local-graph meaning. A neutral cross-layer catalog changes that meaning; it must be selected as a separate domain decision if actual engineering workflows require one shared data identity across OA and SA. Reopen this choice if the scoped resolver cannot cover the actual consumers without special cases escaping into each adapter.

1. Evidence and exact scope

Current implementation evidence matters to the consumer boundary:

• crates/oa-core/src/data.rs:129 and :138 satisfy an item/interface through local identity ancestry. Two new mount maps with different local IDs do not acquire compatibility from having similar payloads.
• crates/oa-core/src/data.rs:4 defines a carried field by its item, path and field identities. Mapping only the top-level item is insufficient.
• crates/oa-core/src/model.rs:520 preserves message field paths; OperationUse at :530 contains the exact interface-item allocation reference. The proposal must preserve the distinction between operations that carry the same item. An item-name match cannot replace allocation identity.
• crates/oa-core/src/transitions.rs:203 maps the existing data/interface classes in both directions. Its closure at :504 follows references, owned allocations and required fields; independent data associations travel when both endpoint types are already required. It does not discover a subjectless analysis case by following an activity's children.

The standalone Rust experiment implements a closed finite dialect. Its final packages explicitly contain every prototype record, definition, export selection and role used by the scenario. It parses concise source requests, materializes two independent instances, writes complete portable source plus base/map/lineage files, applies a local edit and an explicit selective update, and reopens from those files. A complete independently specified expected document is compared with the update result; the oracle does not call the update/materialization planner to supply expected changed records.

Final results: 120 assertions passed, warning-free rustc -D warnings, process exit 0. A separate process reopened the result: 15 live records, revision 3, 1,650 ms, satisfied. Independent PowerShell SHA-256 reads matched all 11 files of the updated document against both the full expected document and the fresh-process reopened document. EVIDENCE.json records all 81 final fixture files and their hashes.

Artifact	Final SHA-256
Experiment source	bc31bacf250f3711758717f18a3104696ed941c3c9b89817caa6a96e6540062a
Isolated executable	652a15a96bd9b0cf2aa732c2273ec5e651c18e9d11d668a1ae5f214d120bb310
D1, complete prototype at 1.0.0	28df5ea3447918dfee3c6ed4243d8f986c689f93a54d89c6181b47d6c2f39b33
D2, cosmetic revision at 1.0.1	a35102e04b9f6822ab409ab43f83eded33edd0a3a3c1f589245bb7b123ce4779
D3, changed field multiplicity at 2.0.0	4b05d6a15115448e318d0c5d567ebb0bb9e0ab6438bd238e5f3a0716c7db1ee8

The probe uses opaque symbolic identities rather than UUIDs, one package per import rather than transitive package graphs, a restricted typed AST and exact integer-millisecond arithmetic. Its archive digest is over its exact finite-dialect file. It does not implement the production manifest-framing proposal, package dependency solver, UUID allocator, complete Studio constructor validation, field-path engine, source7 parser, REST or native application. The target transition records are a finite contract model, not an execution of Studio's complete transition planner. The program's SHA-256 outputs are independently checked with PowerShell; no production cryptographic-library choice follows from its small implementation.

An initial compile needed an explicit Rust map type. A preliminary dialect supplied fixed prototype constructor values from the interpreter; that was inadequate evidence for a byte-complete reusable package. The final version moved all of those records into the package bytes and reran every check. Only generated-final/ is final evidence. The older generated/ is labeled superseded: automatic approval review rejected its removal as “blocked by policy.”

2. Three identities and one verified contract relation

The production contract retains the original exact package pin:

PackagePin = (PackageId, exact version label, package format, archive digest)
DefinitionRef = Local(DefinitionId)
              | Imported(ImportId, PackageId, MemberId)
Origin = (PackageId, MemberId, record class, declared layer or Neutral)

Resolving an imported reference returns its exact pin and supplied transitive closure. Two aliases resolving to identical pins/members denote the same foreign definition. Two different exact pins remain different references even when the following compatibility relation succeeds. Alias/name spelling never establishes either relation.

Define a versioned, class-specific CanonicalContract(root, verified_environment) as a finite rooted graph:

1. Parse and admit the exact archive bytes and dependencies. Derive the graph from those admitted records. Reject caller-supplied parsed payloads, semantic hashes or verified flags that disagree with the bytes.
2. Include the root and every definition required to interpret its typed contract. Include owned fields, inherited definitions, interface-item allocations, operation identities and other contract-bearing owned records even when an ordinary outgoing-reference visitor would miss them. For associations, specify the same explicit ownership/boundary treatment used by the export; do not pull an unrelated dictionary accidentally.
3. Label each node by stable nominal origin and class/layer. Replace local mount handles and import aliases in typed edges with those origins. Resolve all relevant dependency revisions before removing revision labels from this comparison graph.
4. Include every interpretation-bearing field: scalar/record/enum distinctions, quantity dimension and algebra/coordinate convention, affine difference-kind dependency, exact unit scale/offset, defaults and constraints, inheritance, field type/multiplicity/direction, exchange mechanism, operation allocation identity and contractual ordering, and typed calculation parameters/result/body/dependencies. Preserve semantically ordered collections. Unknown classes/fields/profile versions refuse this proof.
5. Omit only presentation data whose schema meaning is explicitly non-contractual: source whitespace/comments and display aliases/names/descriptions. If a future wire name, discriminator or expression lookup uses such a string semantically, that field must be included. Do not infer equivalence from prose saying a change is cosmetic.
6. Canonicalize field labels and graph-node order; preserve typed AST structure and stable parameter/member identity. Do not prove algebraic equivalence of different expressions or coalesce separately identified fields. Recursive data graphs terminate by visited node identity and serialize as finite graphs, not recursive tree expansion. Unsupported or over-budget graphs refuse compatibility without changing the model.

The nominal key is:

CompatibilityKey = (contract profile version, Origin, CanonicalContract)
compatible(a, b) iff CompatibilityKey(a) == CompatibilityKey(b)

An implementation may index this graph by an internally computed digest; the formal criterion is the verified canonical graph, not a publisher's digest assertion. Equal keys form an equivalence relation. Roots from another PackageId or MemberId never become equal through structural coincidence. Energy and Torque remain distinct even with equal dimensions. Reusing an existing member identity for a different engineering concept violates the publisher's nominal-identity contract; a verifier cannot discover an unstated change of intent from identical typed content. Mint a new member identity for that change.

For quantities, the resolved internal KindCompatibilityKey is the key above for the quantity kind and its relevant definition closure. It must retain an identical canonical coordinate/algebra meaning. Arithmetic can combine matching keys while the authored AST retains each exact reference. Public property/call results use their declared output definition reference and key, and report all captured input/definition provenance. Operand order does not choose one package revision as the public result identity. A different coordinate basis requires a checked migration/coercion contract, not this equality rule.

Units also have their own contracts. A changed unit scale changes that unit's meaning and literal evaluation; it does not automatically change an otherwise identical quantity kind. Keeping exact literal/unit references and exact three-way facets is therefore necessary even when kind compatibility succeeds. No AsKind(Energy, TorqueValue) is introduced by this design.

Compatibility never relaxes package-resolution rules. A missing exact archive, wrong digest, unsupported format, hidden dependency, cycle, or two pins of one PackageId in one root closure still rejects. Two contents claiming the same PackageId/version with different digests still conflict. Separate imports can retain different permitted revisions. A semantically compatible dependency is not a substitute for the exact dependency a package declared.

3. A scoped data-consumer proof, not a global ID rewrite

A mount has immutable (ImportId, ExportId, MemberId -> LocalId) maps. Its derived payload must equal the exact pinned export under that map. Updating selected uses creates a new import and new mount; old local IDs remain where their users still require them.

The common resolver provides:

match_contract(actual_root, expected_root, usage_context)
    -> ExactMatch | CompatibleMatch { expected_member/path -> actual_member/path }
    | Incompatible { located typed differences }

For an ordinary local type, keep existing identity/ancestry rules. For a verified mount, compatibility may satisfy an expected contract when a carried/provided root, or the appropriate ancestor, has the same verified key. It must still pass the use site's class, direction, mechanism and layer rules. Do not invent inheritance edges between mounts.

The mapping is scoped by both root handles and their verified origin graphs. Translate each expected field-path component and final field to the corresponding actual member. Translate exact interface-item allocation identity in the same scope; two allocations carrying the same item are not interchangeable. Preserve repeated nested field paths and repeated operation occurrences. Ambiguous, omitted, out-of-root or noninjective maps reject. The actual record remains the actual record, including its actual parent and exact pin.

This mapping is used for compatibility/lookup at the relevant contract boundary. It does not remap architectural occurrence identities, reply correlations, outside source records, local history, trace baselines or UUID-looking strings. A client's read result exposes expected and actual origins so it can inspect why the contract was accepted. Message values authored against the current exchange keep current actual path identities; an unchanged outside consumer can retain its old expected path and receive the scoped correspondence during resolution.

In the experiment, the unchanged outside receiver requires data1/Interface, its exact data1/Operation, and data1/Code. After the selected exchange carries data2/Alarm, the derived correspondence includes:

data1/Interface -> data2/Interface
data1/Operation -> data2/Operation
data1/Alarm     -> data2/Alarm
data1/Code      -> data2/Code
data1/Flag      -> data2/Flag

The outside record stays byte-identical. Changing Code.maximum from 1 to 2 changes the rooted interface contract and rejects the selective candidate. Updating only item_satisfies would be an incomplete implementation: field/operation resolution, port satisfaction, interface contracts, message-value validation and their history/query projections must consume the same proof.

4. R1: source-only requests and fully explicit accepted state

Distinguish pending author requests, prepared changes, and accepted declarative source. Concise requests are not incomplete accepted instances.

Proposed public workflow, with spelling/schema version still to be assigned:

1. The directory explicitly declares its entry source, ordinary includes and digest-addressed package entries. The package loader reads only declared bounded paths and supplies a complete envelope. No GUI, open project, registry lookup or ambient cache is needed.
2. source prepare accepts the current envelope plus authored library create/update/detach requests. It resolves exact packages, allocates/reserves new IDs once, materializes members, computes exact typed baselines/maps/lineage, and returns an explicit portable prepared directory with the complete candidate, request identity, original file hashes/document revision and located diagnostics. Preview itself changes no accepted source/history.
3. For an update, the prepared result contains every conflict and outside impact. A text client writes explicit decisions against stable instance/member/facet identities, e.g. left/P.base = KeepLocal. It can author a replacement value/order where admitted. A conflict file is not a trusted command batch; the core recomputes the candidate from the request, exact base and choices.
4. source accept-prepared checks the original source/package hashes, revision, reserved IDs and plan fingerprint, then adopts the complete candidate once through the same document transaction as GUI/API. An already accepted identical operation is inert; a reused request ID with different content rejects. A stale or incomplete request preserves the accepted directory/document.
5. Accepted source contains ordinary editable materialized records plus explicit management includes/handles. Pending request forms have been replaced by their accepted records and receipt. Ordinary compilation does not replay them or allocate again. Pure compilation of an unnormalized pending request reports pending_source_operation; it never silently creates a managed model on a read.

The exact accepted management state is portable, published source grammar, version controlled and included in canonical export. One possible directory organization is:

project.arcadia                       ordinary imports/includes/instance handles
architecture/*.arcadia                ordinary editable local instance records
analysis/*.arcadia                    ordinary editable properties/cases/checks
libraries/contents.arcadia            exact pins and declared package paths
libraries/packages/<digest>/...       exact manifest and prototype SourceBundle
libraries/mounts/<mount-id>.arcadia    immutable foreign-member/local-ID map
libraries/instances/<id>/base.arcadia exact pin/export/policy/bindings/original map/typed base
libraries/instances/<id>/map.arcadia  live correspondence or reserved deletion per member
libraries/instances/<id>/lineage.arcadia explicit original-to-current identity correspondence
libraries/operations.arcadia          accepted operation identities and source provenance

File separation is optional; the data are not. The directory entry declares every file used. A single-file canonical spelling and the REST envelope can carry the same values. A source client may author the full canonical form directly, subject to the same invariants; a generated file has no privileged admission path.

The base records the exact last adopted prototype transformed by the stored original local IDs, bindings, aliases/names and materialization policy. Derive it from those data and the old pinned bytes when verifying; never derive it from today's live values, current alias availability or name similarity. The original map and base remain historical until an accepted update replaces that base. Current reidentification composes a separate typed lineage and current correspondence, leaving the old base untouched. Missing required management files yield located errors; repair must use exact recorded inputs or an explicit detach/re-adopt operation that acknowledges losing that managed history.

Admission against an existing document also enforces legal management transitions; editing a sidecar is not permission to retroactively replace an old base. Opening a self-contained portable document verifies its internal derivation and identity invariants. It establishes reproducible correspondence, not cryptographic proof that a particular human performed each historical action. No hidden desktop history is required to read the document.

Diagnostics identify the authored request/record and the exact management/package location responsible. A malformed sidecar must not strand the author in a GUI-only repair path. Native/API/source operations share this preparation and admission service, rather than each implementing a different normalization rule.

The complete executed requests and outputs are linked below; none omit the management body with a placeholder comment:

• Blank-directory authored creation request; complete initial normalized directory entry.
• One local edit request; complete edited state.
• Selective update with exact old pin, revision and explicit choice; complete accepted updated state.
• Full left base, current map, lineage, and full independent expected directory.

The finite initial request has 11 lines; the package has 24. Its normalized complete initial document is 9 files, 92 lines, 4,056 bytes; the edited document is 9 files, 93 lines, 4,098 bytes; the updated document is 11 files, 125 lines, 5,708 bytes. These figures include management and package files for one document, not just the pleasant author-facing snippet. They use symbolic identities and a tiny grammar, so they are not predictions of production UUID source size or human task times. They show that the required bookkeeping has actually been emitted and reopened.

5. Full before/after meaning of the selective update

D1 defines nominal Duration, Energy and Torque, ms/s, an OA Boolean field/item/interface/operation graph, and a monitor pattern. Its prototype includes Activity A, Interaction E to external receiver H, property P with base 750 ms, subjectless case C overriding P to 1250 ms, and shared root check K P <= 1000 ms. An unrelated prototype case G mentions P and outside property Q. The explicit export selects A/E plus analysis P/K/C; H is a role, Q/G are outside. These records are in the exact D1 package.

Alpha begins entirely from the request and supplied package. It creates two receiving activities, one immutable OA mount, and two instances with disjoint A/E/P/C/K maps. An outside budget reads left/P + right/P <= 2000 ms; an outside typed consumer observes left/E; an unrelated local subjectless global case overrides left/P to 3000 ms. There is no AnalysisBaseline element. ModelBaseline reads the properties' own base bindings, and a named case replaces its explicit entries. K is shared across explicitly requested contexts.

State	Left current property	Left stored base	Right current/base	Outside budget	Outside receiver
Initial revision 1	type D1.Duration, 750 D1.ms	exact D1, 750 D1.ms	exact D1, 750 D1.ms	1,500 ms, satisfied	expected/actual data1
Local edit, revision 2	type D1.Duration, 900 D1.ms	unchanged exact D1, 750 D1.ms	unchanged	1,650 ms, satisfied	unchanged
Selected cosmetic update, revision 3	type D2.Duration, retained AST 900 D1.ms	exact D2, 750 D2.ms	unchanged exact D1	1,650 ms, satisfied	expected data1, actual data2, verified correspondence

D2 changes only the version label and a source documentation line. Its typed definitions and prototype are unchanged. The selected update still changes exact imported references in the new materialized baseline. Because the local literal changed its magnitude and the incoming literal changes its exact unit reference, the conservative typed expression facet conflicts. The explicit KeepLocal choice preserves the whole 900 D1.ms literal; it is not silently respelled 900 D2.ms. The property type itself advances to D2 because its old and local facets matched. Verified kind compatibility admits the retained literal and outside budget.

This is an instance based on D2 with a local D1-referenced expression override, not a claim that every current dependency now comes from D2. Its base is wholly and exactly the selected D2 materialization. Both archives remain present, and exact source/references expose the distinction. Right-instance state, outside budget/receiver/global-case records and all surviving local IDs are unchanged. Left C/K advance their exact neutral references normally. K evaluates to true for ModelBaseline (900 ms), false for Case(left/C) (1,250 ms), and false for the unchanged global case (3,000 ms).

The whole-document oracle compares all 15 records, both package payloads, both mounts, both instance bases, original/current maps, lineages, receipt sequence and document revision. Additional counterexamples prove that a local property name/subject edit is not lost while resolving only its base-expression conflict; a same-named local extension is retained without adoption; current reidentify preserves old base/package bytes; deleted or historically reidentified identities cannot be reused; dangling outside references, forged parsed packages/bases/maps, missing bytes and conflicting package/version labels reject.

The experiment's update operation deliberately refuses unresolved deleted-member decisions. The production deletion contract is the explicit matrix below, not automatic resurrection inferred from this simpler implementation.

6. R3: explicit analysis export and transition selection

Use the coordinated baseline contract: each property owns a required literal/formula/Unbound base binding; ModelBaseline is an explicit captured context; Case(id) has one level of property overrides; checks are shared root predicates independent of case ownership. No baseline UUID is created or remapped.

Every pattern publication and OA/SA transition request has an explicit AnalysisSelection { properties, checks, whole_cases } facet alongside architectural selection:

1. Start with only the explicitly selected property/check/case identities. Selecting an architecture subject may suggest attached analysis for review but does not select it by an inverse traversal.
2. Selecting a case retains its entire override map, including Unbound entries. Include the targets and typed dependencies needed to interpret those overrides. Do not silently slice a case to properties whose subjects happen to be selected.
3. Selecting a property includes its declared type/unit and base expression dependencies. Selecting a check includes its complete predicate dependencies and any explicit documented-constraint/subject boundary. Traverse all statically referenced branches, not only the last successful evaluation path.
4. Each required architectural subject or property outside the selected membership must have an explicit typed external role/binding or be included through an explicit selection decision. A role carries expected class/layer/type compatibility and contextual predicates. A selected global case therefore exposes its outside dependencies; it does not pull their whole architecture automatically.
5. Neutral prototype-local definitions become the intended qualified same-package/dependency references when exported and materialized. They do not pass through the ordinary architectural local-ID map. An explicit CopyLocalDefinitionClosure policy can instead create fresh editable local definitions; it must copy/map the full required definition closure and mark that independent origin. A hidden private definition without a declared export/copy policy rejects publication.
6. Materialized properties/cases/checks receive distinct local identities per instance and their typed references are mapped. Case's ModelBaseline selector becomes the consumer project's captured model context, not a mapped phantom baseline record. All required local property definitions/bindings must therefore be present or explicitly bound.
7. Preview reports omitted attached properties and cases/checks that mention selected properties. These are useful scope diagnostics, not automatic membership. It distinguishes an intentionally architecture-only selection from a complete selected analysis facet.

In the finite closure check, selecting P alone yields exactly {P}. Selecting P/K/C yields exactly {P,K,C} even though C is subjectless. G is not pulled in. Selecting G without a boundary for Q returns an unresolved decision; selecting G with an explicit external property Q retains the whole case and closes P. The admitted instance contains C's value and K's predicate, and the unrelated host case remains unchanged.

The same explicit selection applies in both transition directions. Selected property subjects, case override targets and check expressions map to target-layer records; neutral definition pins remain exact. ModelBaseline/Case selection is explicit in evaluation after transition. Omitted cases stay in their original layer. A freeze is separate: the baseline contract captures the complete immutable accepted Project/SourceBundle and all exact package bytes/definition environment, plus selected context/targets and validated derived provenance. Library compatibility must not replace a captured package with a later compatible revision.

7. R5: exact mounted-item transition dispositions

An OA mount is immutable OA data. No transition may change its layer, mutate its map/payload or attach that OA record directly to an SA-only contract. Neutral quantity/unit/calculation definitions can remain exact references across a transition; the properties/checks using them remain layer-owned.

For every required layered-definition closure, the plan offers these explicit choices:

Choice	Accepted target	Persisted origin and future update behavior
BindPinnedTarget	A supplied, exact-pinned export in the target layer, with a complete explicit source/target member correspondence satisfying all demanded target uses.	Target remains an immutable target-layer mount with its own import pin. A transition correspondence records the source/target pins and members. Source-package updates do not advance the target mount.
CreateLocalDerivative	A complete target-layer local data/interface graph with fresh local IDs, mapped owned fields/allocations/associations and all dependencies resolved explicitly.	Historical origin records the exact source pin/export/member map, transition choice and target IDs. The target graph is ordinary editable local content; it is neither a mount nor a managed library instance. Later source-library updates do not change it.
No valid choice	Located unresolved disposition, with all required roots and external uses shown.	No candidate adoption or partial transition.

BindPinnedTarget does not make different OA/SA origin keys globally equivalent. The engineer explicitly selects a counterpart and the transition verifies its full mapping and demanded contracts. The conservative first rule permits identical typed data contracts under the declared member/layer transformation. A refinement/migration that changes payload meaning requires explicit additional semantics and use-site validation, not a name match or an unverified counterpart flag. Incomplete paths, wrong class/layer, dropped fields, unmatched allocation identity and inadequate target contracts reject.

The finite target package is supplied as exact SA bytes. It has distinct package/member identity. The full transition states contain the complete five-record dictionary, source/target pin/correspondence, mutability disposition, two target functions, their output/input ports and the target functional exchange. For the pinned choice the exchange carries sa_mount/SA/Alarm; for the local derivative it carries editable SA/Alarm. Wrong-layer items and an incomplete field map reject.

The original OA project and all its imports/instances are unchanged by either target construction. The local derivative can change SA/Code.maximum independently. A reverse request that explicitly binds the unchanged original OA mount succeeds only while the complete inverse-transformed demanded contract still matches. After that refinement, it cannot write the changed field into the immutable original mount: select another valid pinned OA export, explicitly create an OA derivative, or leave the decision unresolved. Ordinary transition traces may record architectural correspondence/review; they do not confer library update management on the derivative.

A later source revision D3 with a changed multiplicity does not silently edit either target. The pinned SA export stays at its target pin; the derivative stays at its recorded current local content. An explicit semantic transition comparison may propose further changes, but must use the target's actual mutability and current edits. A package-origin note cannot masquerade as an exact three-way library base.

8. Alternative policies tested against the same consumers

Policy	Cosmetic selected update + outside budget	Outside item/operation/field consumer	Vocabulary change and transition consequence
Strict exact revision only	Initial budget works; selected old/new references fail.	Initial exact IDs work; new mount fails old contract.	Requires broader explicit migration or keeping old dependency references. Protects integrity but does not complete the selective-update task.
Verified same-origin typed equivalence	1,650 ms remains satisfied with exact old/new references retained.	A complete scoped correspondence admits the unchanged receiver.	Changed rooted contracts reject. OA/SA still needs an explicit target disposition. Recommended.
Strict identity plus explicit checked direct bridges	Same result after adding the Duration D1/D2 witness. Empty witness set fails.	Works after adding the Interface D1/D2 witness with its complete member map.	Witnesses are exact-pair/profile scoped and independently verified. No implicit transitive bridge search; recompute a direct proof for another pair. Changed contracts and Energy/Torque bridge requests fail. Viable explicit policy with additional authoring/management state.
Stable vocabulary dependency V	Pattern P1/P2 can both retain the same exact V pin, so no kind bridge is needed.	Same exact vocabulary mount can serve both.	This identity advantage is verified in the finite pin model, not a full transitive-package execution. A change to V still needs compatibility/migration. Useful packaging convention, insufficient universal policy.

An identity bridge whose checker proves the same same-origin contract equality has the same semantic safety condition as the recommended policy. Requiring a declaration for it can be a deliberate project policy; it does not make differing structures safe. A real migration for changed contracts must define its transformation, exact endpoints, selection, all affected consumers and complete admission. Automatically composing arbitrary bridges or permitting equal-dimensional named-kind casts is outside this contract.

For representation, the finite comparison checks both materialized handles and qualified data roots against the same contract rule. Qualified layered definitions still reject an OA item used as SA and still need target correspondences/derivatives. Removing mount storage alone does not solve that problem. Qualified neutral definitions permit a shared cross-layer root only by changing the layer contract; that may be useful, but it is not an equivalent representation of the existing semantics. Neither comparison uses touched-file counts as evidence.

9. Deterministic admission, reference and deletion rules

All adapters must pass the same pure before/after document admission. Preparation returns a complete candidate and an inspection plan; acceptance never trusts serialized plan commands or parsed imported payloads supplied by a client. It checks original revision/source/closure fingerprints and recomputes the selected choices. A failed/cancelled preview does not advance a base, reserve accepted history, mutate source or evaluate against a partially changed graph.

Reference category	Reidentify/delete/update rule
Live local architecture/analysis references	Apply the existing typed visitor extended to property subjects, expression property references, case keys and shared checks. Never search strings for UUIDs. Ordinary live-reference/layer admission remains mandatory.
Current instance correspondence and current bindings	Update through typed bookkeeping operations; compose actual original-to-current lineage. Surviving members retain current IDs. Do not match by display name, source order or shape.
Foreign package/export/member/parameter identity	Never rewrite because a local UUID has equal bits. Package bytes remain exact. Compatibility keys do not authorize identity changes.
Historical base/original map	Keep exact old typed records and old original references. Compare through explicit lineage; missing current objects are allowed historical facts. A new source revision does not rewrite the old snapshot.
Qualified definition use / mounted handle	Explicit rebind changes the chosen live use; alias rename changes spelling only. A compatible contract never performs that rebind automatically.
Scoped expected/actual contract map	Derived from both verified roots for a use site. Not a document-wide replacement map and not a stored historical observation.
Existing OA/SA semantic-history references	Keep the existing documented historical remap policy. Do not broaden it to package bases or neutral foreign member IDs.
Descriptions, artifact URI/revision/fragment, comments and literal source	Preserve exact content unless that literal is explicitly edited.

Three-way comparison remains typed and exact over B/L/N after applying only established local identity correspondence. Compatibility keys do not replace facet equality. If L=B take N; if N=B keep L; if L=N they converge; otherwise require a specific valid choice. Constructor changes and dependent fields are coupled. Ordered arrays use explicit complete-order conflicts until a reviewed stronger ordering algebra exists. Resolving one facet cannot discard a different local edit.

Change	Required outcome
Upstream removes unchanged member	Eligible deletion only after every live outside reference/cascade is shown and explicitly resolved. No hidden deletion of an outside analysis term or consumer.
Upstream removes locally edited/referenced member	Explicitly keep and detach it, or delete/rebind the full reviewed impact. No silent discard.
Local deletion and upstream edit/reintroduction	Preserve a reserved identity and explicit absence. Require keep-deleted/recreate choice; no same-named automatic adoption.
Both sides delete	Converged absence, with enough provenance for the next update.
Local addition	Keep as local extension unless explicitly selected for another operation. It cannot become an upstream member by matching its name.
Ordinary mutation/cascade touches a mount	Reject unchanged unless an explicit valid fork/rebind/removal operation replaces the whole affected immutable disposition. Nested Batch, Replace, source and REST obey the same rule.
Remove mount/import	Refuse while live uses, active bases or other required metadata need it. Historical origin is not a live cascade edge; retain its exact archive where historical inspection/recovery promises require it.
Detach managed instance	Keep current local IDs/content/layout, remove active update management, explicitly release absent-member reservations as specified, and preserve a non-live origin note. Other instances/shared mounts remain managed.
Fork/transition derivative	Fresh independent local graph plus explicit rebind selection and historical origin. No active library base is fabricated.

Reservations include active deleted-member identities and historical original identities still required by an active lineage, preventing a later local object from ambiguously reusing them. Maps are injective and class-preserving; separate instances' live maps and mounts are disjoint. Reidentify follows actual declared correspondence, never a chain inferred from reused names. An accepted new base records the exact map at that adoption; previous bases remain in document history/recovery as exact old snapshots.

10. Conditions before production ratification

The concrete contradictions in R1/R2/R3/R5 now have a coherent candidate answer and falsifiable source files. Remaining work must not be hidden by the finite pass:

1. Specify the complete contract profile for all actual data definitions, association closure, defaults, inheritance, operation allocation order and contextual message paths. Audit every real consumer. Prove that no interpretation-bearing field was classified as cosmetic. The experiment covers only one Boolean item/interface path.
2. Implement the shared resolver/admission adapter against actual Project, the current source index/updater and transition planner. Test repeated nested paths, two operations carrying the same item, subclass contracts, concurrent versions, historical references, Replace/nested Batch, role changes and deletion impacts. If compatibility requires ad hoc rewriting outside the scoped resolver, revisit the hybrid before UI/API expansion.
3. Implement real transitive archive framing/closure validation, dependency diamonds/cycles/version conflicts, aggregate limits and offline missing-content recovery. Semantic compatibility must never bypass exact resolution. Numeric bounds and production canonical graph limits remain to be benchmarked.
4. Finalize public source/request/sidecar grammar and atomic directory adoption/recovery with existing comment/ID stabilization. Verify UUID reservations, exact source preservation, no-op compile, crash recovery, Undo/Redo and stale source/package rejection in the real document/history service. The fixture's symbolic IDs and finite parser do not establish that behavior.
5. Integrate the coordinated property-owned baseline/check model and explicit analysis selection in both transition directions. Evaluate complete contexts after the merge, including cases outside the instance whose results depend on changed property baselines. Freeze retains actual bytes even when later versions are compatible.
6. Implement and test actual target-layer pinned selection and local derivative creation with complete existing port/operation/trace semantics. The finite target graph is evidence for the disposition contract, not a substitute for full core/GUI transition acceptance.
7. Measure ordinary text and native user tasks: initial package/instance creation, local edit, cosmetic selected update, semantic vocabulary change, case selection, transition and repair from source. Count semantic choices separately from unavoidable identity/management state. Expose origin/compatibility and outside effects without expanding every member into an undifferentiated list. No human timings or native usability claims are made here.

Root owns semantic ratification, production integration, exact-byte Git attributes, shared ledgers/Wiki synthesis and release acceptance. Preserve harness/experiments/library-compatibility-20260911/** without newline conversion before publication; every final fixture and the program are hash-bound by the evidence manifest.