2.1 Records and statements

Let \mathcal{V} be a finite nonempty set of deployments. For each v\in\mathcal{V}, let D_v=(L_v,Q_v,I_v,A_v) contain four append-only sequences. An append-only sequence retains earlier entries when a later entry records a correction or withdrawal. Here L_v is the local institutional record, Q_v is the authority-and-policy history, I_v is the issuance record, and A_v is the acceptance record. The whole state is \Sigma=\left((D_v)_{v\in\mathcal{V}},\mathcal{G},\mathcal{R},\mathcal{K}\right). \mathcal{G} records transport and route derivations. Write \mathcal{R}=\bigsqcup_{v\in\mathcal{V}}R_v, \qquad \mathcal{K}=\bigsqcup_{v\in\mathcal{V}}K_v. The rights and cash records are constitutive local registers. Each R_v records creation, current holding, transfer, and extinguishment under the authority of v. Each K_v records an instruction and the evidence that a named provider completed or reversed it. A K_v entry records the institution’s determination. The provider’s rulebook and governing law determine cash movement and legal effect. No event in \mathcal{G} can write either register.

A delegation explains why a particular signer may act for an institution. Its starting point is a constitutive authority: power conferred by the institution’s governing basis, from which the recorded delegations descend. The model takes that basis as an institutional premise.

The chain begins at a local root. A foreign statement can satisfy an evidence rule but cannot create a constitutive authority at its destination.

The authority record distinguishes the competent institution, its delegated decision maker, and its technical operator. Infrastructure credentials identify the operator. The governing instrument determines the decision power. An instrument profile binds its retained bytes, applicable law, competent office, permitted acts, conditions, and adoption rule. Each profile records legal effective time separately from recording time. A policy amendment uses the authority fixed by its predecessor profile.

The statement must identify exactly what was asserted and for which use. A cryptographic digest identifies its encoded bytes. A digital signature authenticates that digest under a signing key. Canonical encoding gives those fields one specified byte representation.

South must approve the rule connecting the foreign statement to its own question. Different destinations can give the same statement different treatment.

Evidence may reach South through an intermediate institution. South then needs the complete sequence of recognition rules, including the authority for each one. A route derivation retains that sequence.

2.2 Historical verification and present use

The later presentation in the registry example requires two checks: whether North made the earlier assertion, and whether South may rely on it now. Every assertion retains its original act identifier and signed validity interval. Each later receipt identifies that assertion and the receiving institution’s treatment. A receipt preserves the source interval. Reuse under delegation can run automatically while retaining the original act and its current-use conditions.

Write t_a for an act’s occurrence time and t for the proposed use time. Write k for the evidence cutoff. An authority or policy fact records its effective interval and recording time. The view at cutoff k uses only facts recorded by k. A later correction appends its authority, effective time, and predecessor. It preserves the evidence view used for the earlier decision.

For request q, a verifier returns four separate results: (\mathsf{Bytes}(m,k),\mathsf{History}(s,t_a,k), \mathsf{Reliance}(s,q,t,k),\mathsf{Act}(q,t,k)). The first result reports \mathsf{Available}, \mathsf{Missing}, or \mathsf{Corrupt} for the required retained bytes. Historical verification checks the original signature and authority under the recorded evidence view. Reliance applies the destination’s current purpose, policy, source-validity, and authority-use conditions. Operational authorization checks the distinct local act and its named execution stage.

A historical result distinguishes verified, refuted, and unresolved premises. Reliance and operational authorization distinguish admissible, refused, and pending results. Missing required bytes or an incomplete authority feed produces pending, with the exact unresolved dependency. A known expired-use interval produces refusal for that use. Neither result erases the authenticated earlier assertion.

Verification requires the original byte string, called a retained preimage. Its recorded digest alone cannot supply those bytes. A retained-preimage manifest m names every required object’s digest, encoding, byte length, authorized retrieval locations, retention interval, and responsible custodian. It covers source statements, signatures, authority instruments, policies, status evidence, and derivation inputs. A verifier retrieves the permitted bytes and checks their digests. Content-addressed references locate evidence without certifying its retrieval. A completeness witness binds the authority-source scope, status head, observation cutoff, and applicable currentness rule.

For example, an assertion issued at time 2 has a use interval [2,5]. At time 7, its retained signature can verify historically. That assertion cannot satisfy a current-use rule requiring membership in [2,5]. A later recognition receipt leaves the interval unchanged. Restoring missing bytes permits the suspended check to resume with its original request and dependencies.

2.3 Events

A deployment changes its records through authorized events. An event constructor fixes one kind of change, its sole target record, and its admission conditions. Its guard is the collection of conditions that must hold before that change is admitted. The current head identifies the record’s latest committed state. A new event names that head as its predecessor, so it cannot silently replace an intervening change.

The event set \mathcal{E} is the disjoint union of the following classes: \begin{align*} \mathcal{E}_Q &={\{\mathsf{Grant},\mathsf{Revoke},\mathsf{Publish},\mathsf{Withdraw}\}},\\ \mathcal{E}_I &={\{\mathsf{Issue}\}},\\ \mathcal{E}_G &={\{\mathsf{Transport},\mathsf{RouteExtend}\}},\\ \mathcal{E}_A &={\{\mathsf{Accept},\mathsf{Reject}\}},\\ \mathcal{E}_L &={\{\mathsf{LocalCommit}\}},\\ \mathcal{E}_R &={\{\mathsf{RightCreate},\mathsf{RightTransfer},\mathsf{RightExtinguish}\}},\\ \mathcal{E}_K &={\{\mathsf{CashInstruct},\mathsf{CashConfirm},\mathsf{CashReverse}\}}. \end{align*} Every event carries a unique identifier, time, predecessor head, scope, subject, purpose, payload, authority chain, digest, and signature. Its constructor fixes the sole target record. A successful event appends one immutable entry.

South can check a recognition rule immediately before another authorized event withdraws it. Protecting the branch record alone would miss that change. The signed guard witness therefore binds every mutable input to the constructor. These inputs include authority, policy, route, acceptance, revocation, and resource records. Absence and range queries bind collection or index heads. The witness also binds rule versions and the records that determine dependency owners and participants. Instrumented guard reads enforce this dependency set.

An operation can be authorized locally before it is dispatched or accepted by a provider. The governing rule determines when the relevant authority must hold. An authority-use contract names the act and the stage at which authority is required. It distinguishes three obligations. Historical validity establishes authority for a recorded earlier act. Consumed authorization establishes a specific effect at its named consumption stage under the governing instrument. Continuing authority must hold through a named later stage, such as dispatch or provider acceptance. Each contract binds its legal basis, scope, subject, purpose, interval, and exact command. A software status alone cannot make authorization irrevocable.

The following clauses define the guarded transition relation. For cash events, an occurrence is the provider event recorded by the evidence. An allocation attributes an amount from that occurrence to an instruction. The unpaid amount is the part still due. A reservation retains the capacity that an unresolved command can still use.

\mathsf{Grant}

Append to Q_v. Create one delegated authority whose scopes, subjects, purposes, and validity interval are contained in its active parent grant.

\mathsf{Revoke}

Append to Q_v. End one active non-constitutive grant prospectively. Preserve the grant and every earlier use.

\mathsf{Publish}

Append to Q_v. Create one policy version under the predecessor’s adoption authority. A directed version binds source, subject relation, purpose, predicate, required questions, treatment, and interval. A governance version binds its instrument profile, permitted transition, exact predecessor, conditions, and institutional authority. Its adoption follows the rule already in force.

\mathsf{Withdraw}

Append to Q_v. End future use of one active policy version signed by v. Preserve earlier uses.

\mathsf{Issue}

Append to I_v. Create the statement digest and signature after checking the issuer’s scope, subject, purpose, predicate, and interval.

\mathsf{Transport}

Append to \mathcal{G}. Start a route for the exact issued-statement digest. Change no institutional, rights, or cash record.

\mathsf{RouteExtend}

Append to \mathcal{G}. Extend only the current route by one active directed-policy digest that matches the same statement, subject, purpose, and predicate.

\mathsf{Accept}

Append to A_v. Bind the statement digest, original act, complete route, active destination policy, request, required answers, treatment, and decision authority. Bind the retained-preimage manifest, evidence cutoff, historical result, and current reliance result.

\mathsf{Reject}

Append to A_v. Bind the same objects as acceptance and add the destination’s signed reason for refusal.

\mathsf{LocalCommit}

Append to L_v. Every local rule lists its required evidence predicates. The event must cite exactly one current acceptance for each required predicate, with the same subject and purpose, and must carry a separate local authority witness.

\mathsf{RightCreate}

Append to R_v. Require an absent right identifier, an initial holder, a legal basis, and an authority for that right and purpose.

\mathsf{RightTransfer}

Append to R_v. Require an active right, the recorded current holder as transferor, a distinct transferee, and matching authority.

\mathsf{RightExtinguish}

Append to R_v. Require an active right, its recorded current holder, and matching extinguishment authority. Mark that right extinguished.

\mathsf{CashInstruct}

Append to K_v. Require a new instruction identifier, payer, payee, positive amount, currency, provider reference, and matching authority. Mark the instruction open.

\mathsf{CashConfirm}

Append to K_v. Record an authenticated provider occurrence for the instruction’s payer, payee, and currency. Bind its positive amount, canonical occurrence identity, and admitted allocation. A correction form binds that occurrence, its predecessor assertion, and correction authority. It can revise the asserted amount to zero without a new occurrence. Update supported performance, unpaid amount, and reservation together. Partial performance leaves the remainder explicit.

\mathsf{CashReverse}

Append to K_v. Record an authenticated return or reversal occurrence linked to the earlier payment. Bind its amount, reason, and attribution to prior performance. A correction form revises that occurrence’s assertion under correction authority and binds its predecessor assertion. Correction does not require another physical reversal. Update net support, unpaid amount, and reservation together. Preserve the earlier occurrence and its history.

Acceptance can change only A_v. A local rule can require that acceptance, but \mathsf{LocalCommit} remains a new authorized event. Rights and cash have their own constructors, current-state guards, and authorities. No type conversion crosses these records.

A cash occurrence uses the provider namespace, record kind, and stable reference, with separate identities for assertions and allocations. Repeated evidence for one occurrence adds no performance. The allocation authority bounds each attributed amount by the instruction’s unpaid amount and the occurrence’s available support. Its complete guard spans every competing allocation.

For instruction amount z, let p be supported allocated performance and u=z-p its unpaid amount. Funding status is open, partial, or complete according as p=0, 0<p<z, or p=z. A reversal’s attributed amount cannot exceed the unreversed prior allocation. Excess observed payment or debit remains recorded for reconciliation. It supplies no unsupported discharge.

Command closure remains separate from funding status. Partial performance does not prove that the original command cannot perform its remainder. Uncertain command capacity retains its reservation. Release requires terminal remainder evidence or a provider-enforced transfer of that capacity. A reversal supplies no new dispatch authority.

An authoritative correction changes the assertion about its existing occurrence. The cash record retains the assertion history and resulting support deficit. A correction is distinct from a physical return or reversal. Current cash and claim projections use the same corrected allocation state.

2.4 Validity conditions

Each admitted event must respect its target, authority, current dependencies, and retained history under the following conditions. A transaction applies its changes together or leaves them unapplied. Strict serializability gives concurrent transactions the effect of one order consistent with completed real-time precedence. A finite history h=e_1\cdots e_n is valid when every prefix satisfies six conditions.

N1.

Complete partition. Every state change has one of the sixteen constructors and the unique target fixed by that constructor.

N2.

Effect locality. An event changes only its declared target record. No evidence event changes L_v, \mathcal{R}, or \mathcal{K}.

N3.

Witnessed authority and bytes. The authority chain begins at a constitutive root and ends at the signer. Every delegation covers the event’s scope, subject, purpose, and time. The canonical digest covers every event field, and the signature verifies that digest.

N4.

Constructor guard and current reliance. Every constructor satisfies its clause above. Acceptance verifies the exact statement digest, issuance, subject, purpose, predicate, route, active policy, required answers, and applicable revocation information. A local commit cites every required acceptance and checks each authority-use contract at its named stage. Historical issuance validity remains distinct from current permission to rely on the statement. A rights event names the current holder. A cash event matches the instruction fields and its required external witness. Revocation and withdrawal bar subsequent uses that require the affected current authority. A lawfully consumed authorization retains only the effect and scope fixed by its governing instrument.

N5.

Dependency-complete guarded append. One strictly serializable transaction validates the target predecessor and every declared mutable dependency version. It supplies one consistent dependency state and event time to the applicable semantic checks. N4 determines constructor admissibility. N5 protects the observed versions until the entry and new head become durable together. A conflicting version change causes reevaluation or rejection.

N6.

Ordered immutable history. Event times do not decrease within a record. Recorded identifiers, payloads, digests, signatures, and policy versions never change.

These conditions constrain each transition without assuming the conclusions below. Replay and attribution quantify over the resulting histories.

Condition N5 protects the complete guard read set while changing one target record. A local transaction covers locally owned dependencies. Current dependencies owned elsewhere require their owners’ participation under Section 6.1. A signed snapshot proves its recorded contents. Its continued current-use validity follows the authority-use contract. Atomic institutional records retain the distinct completion and finality rules of external providers.

3.1 Four independent necessity witnesses

Each construction removes one condition and retains the other five. The prefix may contain several events. The violating extension is one transition.

1. Without N1, allow a right transfer outside the event partition. The right changes while every projection remains unchanged, so replay fails.

2. Without N2, let one acceptance event append to both A_v and L_u. An event foreign to L_u changes it, so local replay fails.

3. Without N3, record an otherwise admissible issuance with a corrupted source signature. Transport and acceptance use its exact recorded digest, active route, and destination rule. N1, N2, N4, N5, and N6 hold, but source attribution fails.

4. Without N4, correctly issue, transport, and route a statement. Withdraw the destination policy, then present a separately signed acceptance at a later time. Bind the current acceptance head and complete dependency versions, including the withdrawn policy record. Serialize observation and append under N5. With N4 removed, semantic rejection of the withdrawn policy is absent. N1, N2, N3, N5, and N6 hold, while time safety and prospective revocation fail.

These histories establish necessity for N1–N4 relative to the stated conclusions. We do not supply necessity witnesses for N5 or N6. They are sufficient conditions used by the theorem, not claimed minimal assumptions.

A finite sequential two-deployment event model exercises all sixteen constructors in one valid trace. It also enumerates all 1{,}120 interleavings of independent rights, cash, withdrawal, and revocation tails that preserve their internal orders. It rejects 37 mutations covering the constructor partition, target locality, authority scope and chain, subject-purpose binding, canonical digest, signature, predecessor, time, required evidence, current holder, and cash-state guards. These finite calculations corroborate the definitions. They do not prove Theorem 3.1 for unbounded histories.

4.1 A complete interface for recognition

To support the identity and licensing example, a complete interface carries the source file, the local question, and every duty that its use creates. The carrying set alone determines none of those duties.

A source cell is one attributed source observation with its scope and evidence. An obligation body records what must be done, by whom, and under which trigger. An effect plan identifies the acts that a permission allows. Their occurrence, and the duties they activate, require the corresponding events.

The common corridor record retains the independent carrying and fresh fields. The fresh mask is the domain projection of its local-evaluation obligations. Import prerequisites determine when evidence may enter. Imported evidence can supply inputs to questions that remain pending until their owning destination decides them under its own rule. An obligation reaches completion only through its named completion rule. Higher grades leave reporting and payment duties intact. Admission checks the prerequisites of its named stage. A later reporting duty can remain outstanding after the authorized act that creates it. Traversal identity is separate from policy identity. An exact traversal retry retains its result. A new traversal can reuse the same policy.

An evidence grade and an applicability judgment answer different questions. Their product pairs an applicable grade with a set of applicability markers. In increasing order, the applicable grades are NonCompliant, Pending, and Compliant, with an additional empty-fold top. This top is the identity for aggregation when no applicable grade has been supplied. It does not assert a compliant observation. The markers are NotApplicable and Exempt. Each family aggregates applicable grades by minimum and markers by union. Thus NonCompliant from one authority and NotApplicable from another retain both observations. The receiver admits the source cells before calculating this summary. A local five-label display alone cannot reconstruct their separate scope judgments.

This normalization concerns admitted records. The receiving instrument supplies the legal basis for their use. A transport summary is a projection of the record, with the corresponding restricted meaning.

4.2 Replacing a running route

An institution may replace an existing route while requests or duties remain outstanding. Equal final grades can conceal different reports, deadlines, or permitted disclosures. Route substitution therefore uses the observation contract of the relying institution. Each observation contains its verdict, authority attribution, evidence treatment, effect plan, outstanding obligations, deadlines, disclosure, and continuation status.

For a bounded model, represent a route by a finite deterministic total machine over admitted evidence, local-answer, policy, and time events. An event produces an observation and a successor state. The observation contract specifies everything the relying institution treats as relevant. A finite input word is a finite sequence of these events. Refused and unresolved events have explicit outcomes. To compare two machines, explore their reachable state-pair graph. At every pair, compare the observations for every input and retain any distinguishing input word.

The comparison can accept machines with different internal cache states. It rejects two Allow outcomes that impose different reports or deadlines. Omitting those fields would change the observation contract and its conclusion. The finite comparison proves the behavior of the encoded machines. Instrument adoption, actual evaluator refinement, and unbounded or nondeterministic environments retain their separate proof obligations.

4.3 Route cost

Route delay and impediment risk require estimates beyond behavioral equivalence. For a declared use, the following expression measures impediment risk under specified probability assumptions. Corridors are directed. \mathcal P_{uv} and \mathcal P_{vu} may differ in carrying sets, fresh questions, maps, authority, and interval. A path u=v_0,\ldots,v_k=v has route friction \Phi(u\leadsto v)=1-\prod_{i=1}^{k}(1-\rho_i). Here \rho_i\in[0,1] is the independently estimated friction of edge i for this use. To interpret the expression as the probability of at least one impediment, each estimate must refer to its specified edge event. The product assumes independent edge risks. Correlated edges require a joint model. The maximum is not equivalent.

4.4 The compliance passport

A compliance passport is a portable package of statements, derivations, and the retained evidence needed to check them. Its recognition receipts retain the complete carried contents and duties. The passport carries this evidence to a destination whose own policy governs its use. The genesis record is the initial trusted record from which the presented chain begins. Before using the passport, a destination performs six checks:

1. Validate the passport schema and every content digest.

2. Verify the chain from the declared genesis record to the presented head.

3. Verify each source signature and issuance-authority witness at issuance time.

4. Verify every corridor edge, immutable policy version, and destination authority in the route.

5. Check the retained manifest, source intervals, evidence cutoff, status completeness, and named authority-use stage.

6. Apply the local domain mapping, reserved-domain rule, evidentiary treatment, and decision authority.

These checks return the separate historical, reliance, and operational results from Section 2.2. Retained packages support offline historical verification at their recorded cutoff. Current use requires the applicable authority-source contract. Selective presentation proves the disclosed relation while leaving omitted required premises pending. The source and destination remain accountable for their respective assertions and decisions.

4.5 Corridor receipts

A recognition receipt describes what a route carries. An acceptance receipt records the destination’s signed decision to admit a statement from that package. Its digests identify the statement, route policies, and retained manifest used for that decision. An acceptance receipt contains \begin{split} (&\mathsf{issuer},\mathsf{destination},\mathsf{subject}, \mathsf{statementDigest},\mathsf{route},\\ &\mathsf{originalAct},\mathsf{originalValidity}, \mathsf{policyDigests},\mathsf{sourceAuthorityDigest},\\ &\mathsf{destinationDecisionAuthority},\mathsf{manifestDigest}, \mathsf{evidenceCutoff},\mathsf{useStage},\\ &\mathsf{localTreatment},\mathsf{acceptedAt}, \mathsf{priorReceiptDigest},\mathsf{signature}). \end{split} The signature covers canonical bytes of every preceding field, including the predecessor link. A mismatched link rejects extension. JSON Canonicalization Scheme fixes the JSON byte representation while leaving institutional meaning to the governing rules (Reference [10]).

5.1 Durable admission for concurrent requests

Two requests can each pass against one history and fail when combined. After releasing A+B, both B+C and A+C pass separately. Admitting both would disclose A,B,C. Each coalition therefore uses one authoritative disclosure store for the fixed snapshot and protection profile. Every admitted release participates in its serial order.

The local disclosure store uses an immediate transaction in the SQLite database. It reads the committed history, checks current grants, composes the new rows, and performs exact rational elimination. On success, it records the command, query, result, source lineage, grant digests, and predecessor. Only the committed transaction can return numeric results. A retry binds the same command to the same artifact, purpose, audience, and retention deadline. Before returning that result, it checks current release permission.

A crash before commitment releases nothing through this interface. A crash after commitment preserves the disclosure in the history even when delivery remains uncertain. Retrying then returns its recorded value. This conservative treatment prevents a failed acknowledgment from restoring permission to disclose an incompatible query. Deleting an output under its retention rule also preserves the rows needed to account for what a recipient may remember.

The store protects its stated coalition and snapshot. Separate stores need a common admission authority before their outputs can compose under this result. Later auxiliary knowledge and changed protection rules require a new comparison against all existing observations. Trusted storage, complete mediation, authenticated coalition membership, and current authority evidence remain explicit implementation premises.

5.2 Public state changes and one observation history

Suppose the source initially contains (A,B) and releases y_0=A+B. A public operation doubles its first coordinate. Releasing the next sum gives y_1=2A+B. The recipient computes A=y_1-y_0,\qquad B=2y_0-y_1. For A=7 and B=13, the answers are 20 and 27. Each snapshot supplies one aggregate. Together, the observations determine both initial coordinates.

The numerical model restricts x only through the retained linear equations. Earlier private-dependent outputs can impose further constraints, which require the full observation model below.

An observation record retains the source and stage identifiers, (\Phi_t,c_t), the proposed matrix R_t, and the answer y_t=R_tx_t. It also retains the profile, permission records, and predecessor history. Its normalization is \widetilde R_t=R_t\Phi_t,\qquad \widetilde y_t=y_t-R_tc_t. Stack every retained \widetilde R_t below H_0 to obtain M_T. Stack the corresponding \widetilde y_t below b_0 to obtain z_T. The full compatible latent set is \{x:M_Tx=z_T\}. Public evolution x_{t+1}=A_tx_t+d_t supplies \Phi_{t+1}=A_t\Phi_t,\qquad c_{t+1}=A_tc_t+d_t. These identities follow by substitution. Their record retains every evolution act and the authority for its source interpretation.

Admission therefore supplies the existing rank guard with all normalized history rows, proposed rows R_t\Phi_t, and normalized protected rows. The admitting transaction binds the complete profile and predecessor before releasing any answer component. Proposition 5.3 then applies to this common coordinate history. A later snapshot identifier cannot reset it.

Changed maps, protected quantities, or auxiliary knowledge require rechecking the inherited history before further admission. A normalized protected row can already lie in that span, including the zero row for a publicly constant quantity. An unobserved innovation needs an admitted additional latent coordinate and a matching embedding of every retained row and protected quantity. Unknown innovations cannot be inserted as public offsets. Nonlinear evolution, constrained source domains, and incomplete lineage require their corresponding compatible-state construction.

Treating every committed result as observed gives conservative admission when delivery is uncertain. Exact identification then refers to that declared worst-case transcript.

5.3 Every visible result updates the public belief

The observation model must also include refusals: a refusal can identify the protected value. Let the possible values be 0,1,2. A query returns 0 at value 0, and 1 at values 1,2. A gate that answers only when the actual answer leaves two possibilities refuses precisely at value 0. Its refusal identifies that value.

Fix a finite nonempty world set W. A world specifies a complete possible source and environment history within the declared horizon. The model, the observer’s initial knowledge, and all decision rules are public. A public belief B_h\subseteq W contains exactly the worlds compatible with the observer’s full transcript h. Each protected attribute is a function s_j:W\to S_j with a prescribed integer ambiguity floor k_j\geq2. For nonempty B, define \mathsf{Amb}(B)\quad\Longleftrightarrow\quad |s_j(B)|\geq k_j\quad\text{for every }j. This condition counts distinct protected values. Duplicate world records add nothing to that count, which supplies no probabilities or uncertainty interval. The belief must represent the observer’s actual admitted knowledge. Including impossible alternatives can falsely satisfy the ambiguity test. A belief already below its floor cannot recover through refusal.

At history h, a deterministic output function F_h:B_h\to Y_h describes everything visible to the named observer. Its finite output vocabulary includes answers, refusal and pending statuses, reasons, query and profile identifiers, and visible effects. It also includes every timing observation admitted by the model. For example, a timing bucket is one specified interval that the observer can distinguish. Exact unbounded timing requires a larger model. The output fibre at y is the set of worlds producing y. After seeing y, the exact update is B_{hy}=\{w\in B_h:F_h(w)=y\}. Private query selection, permission evaluation, and evidence availability must enter F_h when their outcomes are visible.

This equivalence concerns permission to release the entire answer map. A censored mechanism checks the fibres of its actual output function. For example, take W=\{0,1,2,3\}, s(w)=w, and k=2. A raw query has fibres \{0\}, \{1\}, and \{2,3\}. The whole query fails the test. A mechanism that emits one refusal for \{0,1\} and one common answer for \{2,3\} satisfies it. Different refusal reasons or timing at worlds 0 and 1 would split the refusal fibre and violate the same condition. Coarsening a complete safe output preserves ambiguity: each resulting nonempty fibre is a union of safe fibres. This argument applies when the complete new output factors through the old output. A private gate that varies inside an old fibre need not factor through the old output.

Source permissions can publicly veto the whole query. A permission decision that depends on private state requires its actual output-fibre check, including the refusal and pending branches. The rank invariant alone supplies no such check. For worlds (s,u)\in\{0,1\}^2, the raw answer u leaves both values of s possible. Answering only when s=0 and otherwise refusing makes every actual output identify s. The finite use assessments of Definition 4.6 retain exact reasons for authorized evaluation. Their projection to a different observer must pass this complete output test before disclosure. Any required disclosure that fails it produces an incompatibility between that requirement and the chosen privacy profile. Required audit evidence and duty records remain intact.

The admission record binds B_h, the source and observation profiles, the protected attributes, F_h, its checked fibres, and the predecessor. All visible outputs must follow that admission boundary, including errors and interrupted or pending responses. An interface with additional observable behavior needs a refinement proof for those observations. The history authority must preserve an independently trusted predecessor and prevent complete-history rollback. Internal digest consistency alone does not establish that protection. The theorem assumes complete worlds, exact beliefs, and complete mediation. Authenticating the admitted source model and establishing those implementation premises remain separate obligations.

5.4 Permissions of derived artifacts

The cumulative disclosure test checks whether a release reconstructs a protected value. Source permissions govern which acts may produce or use that result. Computation, disclosure, model training, and commercial use are distinct acts. A source grant names its instrument, source, act, purpose, audience, validity interval, and retention bounds. The host admits the instrument and its authority evidence. The construction retains that evidence, whose legal adequacy remains an institutional premise.

An immutable operation plan binds the exact input artifacts, public transformation, operation class, and classification authority. Execution accepts that plan identifier and obtains the operation class from the admitted record. The caller cannot relabel a training plan as computation. The competent authority still determines the licensed meaning of an act. The same matrix can serve different purposes, so its coefficients alone cannot establish the act classification.

Represent an artifact by (T,L), where its values are Tx and L contains all source obligations inherited from its parents. For a public linear transformation U, derivation produces (UT,L). Several parents contribute their stacked rows and the union of their source obligations. A zero coefficient preserves the obligation of a source used in that derivation. A different, independently authorized computation can use a smaller set of inputs.

Grant composition takes an intersection across source obligations. A separately issued training grant changes the training decision only within its own scope. Disclosure and commercial use retain their own grants. Effective revocations govern each subsequent use while the earlier grant and its historical use remain recorded.

An aggregate can consequently support local research while its training request remains refused. With separately admitted training grants, a public full-column-rank design X yields the least-squares coefficient map (X^{\mathsf T}X)^{-1}X^{\mathsf T}. This map acts on the admitted response artifacts and preserves their source obligations. Releasing its coefficients passes through the same cumulative disclosure test. An intercept-only fit releases a mean when its history permits it. A saturated fit can determine the original responses and is refused by the exact reconstruction rule.

The same bounded reference checker tests the exact row-span guard and the action-specific grant intersection with rational arithmetic. Its self-test accepts the first two pairwise sums, refuses the reconstructing third sum, permits a research computation, and refuses model training until a separate training grant is present. It does not model process races, enforced deletion, undisclosed recipient knowledge, general statistical learning, or actual instrument authority. Those properties need separate evidence. Disclosing a permitted computation still requires source rights and admission against accumulated observations.

5.5 Actions available under source knowledge and exact privacy

The selected action must satisfy source permissions and the observer’s privacy requirement. The actor must be able to select it from permitted observations. Fix a finite world set W at one decision interface. It contains every world compatible with the admitted preceding history. Let O:W\to I give the actor’s complete permitted observation history, including available source evidence, local state, and admitted clocks. The verifier’s hidden world identifier is absent from O.

Let \mathcal A be a finite nonempty set of exact actions. In this profile the privacy observer distinguishes each action and its complete visible output. Any varying reason, timing, or effect therefore requires its own action record. For each w, let L(w)\subseteq\mathcal A contain the permitted actions and let S(w)\subseteq\mathcal A contain the actions achieving the named success condition. Put G(w)=L(w)\cap S(w). An action includes its request, route, purpose, audience, authority-use stage, retention bounds, and effect plan. The source-grant intersection above supplies its source permissions. Current use assessments supply its destination prerequisites. The declared success contract separately supplies any required resource, continuation, and provider premises. A pending act is absent from G(w) when success requires its completion.

Write w\sim_O v when O(w)=O(v). Let \sim_P be the declared equivalence relation whose worlds must produce exactly the same visible action for privacy. The joined relation \approx is the smallest equivalence relation containing both relations. Its classes are the connected components of the graph containing their edges. A deterministic policy \pi:W\to\mathcal A is locally implementable when \pi=g\circ O for a function g on the observation values. It satisfies exact privacy when it is constant on each \sim_P class. Exact privacy here specifies equal outputs. The ambiguity condition in Section 5.3 specifies retained alternatives.

For an explicit obstruction, use worlds 00,01,10,11. The actor observes the first bit, and privacy requires equality across worlds with the same second bit. In that order, let the permitted-success sets be \{a,c\},\quad\{a,d\},\quad\{b,c\},\quad\{b,d\}. Observation alone permits the row choices a,b. Privacy alone permits the column choices c,d. The joined graph is connected, but the four sets have empty intersection. A separately admitted action e in all four sets supplies a joint selector. Its permission, funding, and success still require their actual contracts.

The admission authority binds the world set, O, \sim_P, the complete action vocabulary, and every permission and success contract. It retains the component table with either a selector or excluding-world witnesses. To execute an admitted selector, the actor indexes the table by its own observation. Route comparison under Section 4.2 must preserve these observations and action meanings when replacing that implementation. Neither a candidate policy nor a query can omit an unfavorable world or choose a weaker profile. Hidden action choices with identical visible outputs require a separate action-to-observation map. Distributed actors require their individual observation maps and an implementation of their joint decisions.

5.6 Learning from accepted evidence

The disclosure and source-permission rules govern reuse of accepted observations for later route selection. An acceptance can place its observation and receipt in one atomic entry. The observation records statement class, treatment, route, decision time, and outcome. Authorized aggregates can estimate route reliability, latency, revocation frequency, and domain friction.

Only authorized aggregates cross corridors, while raw records remain local unless policy admits them. Coarsening alone gives no quantitative aggregate-privacy bound because small groups, linked releases, and auxiliary data can identify subjects. Such a bound needs its aggregate mechanism and adversary model. The finite output and route results above retain their separately declared observations and privacy definitions.

Attributed observations can improve estimates and identify weak routes. Repetition can diminish their marginal value, but the paper states no quantitative growth law. Authority remains with its source institution. Repeated foreign statements create no local power, and connectivity creates no network owner.

6.1 Realizing complete guard transactions

The implementation must discover everything a decision reads, including the records that determine further dependencies. An ownership rule can identify a different authority and another required participant. Those ownership, authority, and participant records must also remain fixed. An authority-resolution root identifies the admitted record from which authority lookup starts. A participant-selection root similarly determines whose agreement the transaction requires.

For event e with target X_e, let \mathcal{D}_e contain every mutable input to its guard. Its witness contains \rho_e=\{(Y,\operatorname{head}(Y)):Y\in\mathcal{D}_e\cup\{X_e\}\}. The set includes indirect reads through rules, accepted evidence, and authority chains. It also includes corridor, authority-resolution, membership, and participant-selection roots. Collection heads protect absence and range queries. Instrumented reads enforce completeness. A conservative implementation can bind the complete protected-state head.

A reservation prevents conflicting changes while a decision is unresolved. Read mode protects a required value, while write mode also reserves the record for change. The witness fixes every resource and its reservation mode before acquisition. The constructor’s known target has write mode. Every other dependency has read mode. Repeated resource identifiers coalesce at the strongest required mode. The target therefore acquires write mode on its first reservation.

Within one deployment, a commit mutex and one durable transaction suffice. Every protected-state writer uses that mutex, including administrative and revocation paths. The boundary validates \rho_e, evaluates the guard, and appends before releasing it. It reads the admitted clock at the actual durable event. Clock-error bounds must make interval acceptance conservative. A proposal timestamp cannot establish authority at a later commit. Immutable signature checks can run beforehand when the boundary binds their exact input bytes.

Strict read and write reservations can replace the mutex if they protect the complete dependency set through durable append. Separate validation followed by an unprotected append permits revocation between the two operations. Checking only the target head also permits that history.

6.2 Capacity with local dependencies

Complete dependencies also identify which decisions can proceed independently. A service domain is a unit with an exclusion or capacity constraint, such as a record owner or provider. Service domains differ from the compliance domains used to classify evidence. A network can add execution capacity through additional independently served domains. Their complete dependencies determine which domains can work concurrently. A command’s service footprint includes storage, decision journals, authority checks, communication, workers, and required provider stages. Shared services count even when their names are absent from the business request.

Fix a batch of m\geq1 ready commands using N active service domains. Every command has a nonempty footprint. Each domain represents an exclusion or capacity constraint. Two commands conflict when their footprints intersect. This conservative rule can serialize compatible reads. It gives a sufficient schedule without assuming free service capacity.

Readiness includes exact requests, valid authority-use contracts, and separately available funding or resource allocations. Every remaining command must remain feasible after each admitted batch prefix. Fresh attempts rebind current heads and check their guards. Commands that need another command’s output belong to a later readiness phase.

The bound scales with active domains when k,h,\tau, and S remain bounded. Idle deployments contribute no throughput floor. A repeated schedule can amortize its construction cost. Each reuse still checks the current authority, dependencies, and reserved capacity. A central scheduler whose work grows with the entire batch must include that cost in S.

The bounded service premise is stronger than eventual communication and recovery. A partition can retain safe reservations while suspending completion. A shared decision journal, universal provider, authority-resolution service, or resource owner can increase h or \tau. A larger network alone does not remove those constraints.

Dependent workflows retain their required order. For L successive ready phases with uniform k,h,S,\tau, a sufficient completion bound is L\{S+[k(h-1)+1]\tau\}. A chain of independently funded commands requiring predecessor completion receipts can require L=m. Each command changes its own hosted token and appends its receipt. The next command checks that immutable receipt. Each command then touches at most two local services. Funding conflicts can likewise defeat persistent feasibility. The runtime must construct feasible phases, rather than infer them from small footprints.

A positive construction partitions N=kg domains into g independent corridor groups. Give each group h funded commands with stable authority and disjoint allocations. One command per group executes in each of h waves. The gh commands finish in service time at most h\tau. Their service rate is at least N/(k\tau). Both endpoints and any required provider services belong to their group’s counted footprint.

7.1 Partitions and healing

After communication returns, the endpoints compare signed records.

1. An endpoint can decline preparation when its deadline passes. Local absence of a second lock or certificate proves no global absence. A prepared transaction requests abort through the unique durable terminal decision. It retains its reservations while the outcome remains unknown.

2. With two matching locks, either endpoint can assemble the authorization certificate during the validity interval. It submits that certificate to the agreed terminal-decision protocol.

3. With a certificate at one endpoint, the other verifies the certificate and the durable terminal decision before applying the outcome.

4. Competing signed digests satisfy no commit rule. Their signed conflict attributes the disagreement and supplies a blame witness for the dispute route.

The construction guarantees attributable evidence of agreement. Availability during partitions, certificate replication, and recovery to a common terminal outcome depend on communication and honest recovery.

8.1 Lifecycle

A corridor version records its lifecycle stage in the following typestate: \begin{split} \mathsf{Draft}&\rightarrow\mathsf{PendingEndpointRatification} \rightarrow\mathsf{PendingRouteNotice}\\ &\rightarrow\mathsf{RatifiedPendingWindow}\rightarrow\mathsf{Active}. \end{split} The \mathsf{Active} state has six outgoing branches. The stopping states are \mathsf{Halted}, \mathsf{Suspended}, and \mathsf{Revoked}. The record states are \mathsf{SupersededDraining}, \mathsf{Retired}, and \mathsf{DisputedOverlay}. The pending states retain the ratifications, notices, or activation window still required. SupersededDraining retains unresolved work under a replaced version. Retired records the end of that version’s use. Every transition names its authority, scope, effective time, predecessor, and notices. \mathsf{DisputedOverlay} records a commenced proceeding over the base state without replacing it.

A watcher observes a deployment’s signed records and reports what it has checked. Its observation can supply evidence for an authorized decision. Four rules preserve the authority boundary.

1. Watchers observe, sign observations, and attribute disagreement. They do not amend law or corridor policy.

2. A registration change uses the named registration authority and its instrument-defined conditions. A bond draw uses a separate custodian mandate, liability decision, and funded bond record. A blame certificate supplies evidence for those decisions.

3. A destination authority may tighten its recognition treatment prospectively under its local rule.

4. Loosening recognition requires endpoint ratification, route notice, and passport checks. Shared sanctions reliance also requires a current shared-authority certificate and revocation check.

The accession of new participants is a separate construction, developed in Accession Networks (Reference [4]). Disputes about terminal disagreement, emergency relief, and the \mathsf{DisputedOverlay} proceeding belong to the dispute layer (Reference [5]).

8.2 Watcher evidence

Several signatures can come from keys under one controller. The receiver therefore needs evidence about who signed and which signers can fail together. An epoch is the fixed configuration under which those signatures are compared. A watcher epoch binds the principal registry, control graph, graph policy, certificate policy, and authenticated time anchor. The registry maps each signing key to one stable watcher principal. Multiple keys for that principal count once. A key cannot name two principals.

The control graph records ownership, decision power, operating authority, and signing-key administration. Each relationship binds its source, effective interval, evidence date, and responsible attestor. Under its threat model, the graph policy selects relationships that represent common compromise, including indirect control. Their connected components form the admitted control blocs, grouping principals linked by the selected common-control relationships.

Separate policies can assess observation integrity and service availability from the graph’s different relationship types. Shared hosting, for example, can create an availability dependency without granting signing authority. An unresolved control record contributes no certified diversity. Its principal can still supply an observation. Unknown controllers cannot form a separately countable bloc.

For epoch e and certificate c, let S_e(c) contain its distinct eligible signing principals. Let \mathcal B_e partition the principals covered by admitted control evidence. The certificate requires |S_e(c)|\geq\theta_e,\qquad \bigl|\{B\in\mathcal B_e:B\cap S_e(c)\neq\varnothing\}\bigr| \geq K_e. The first threshold counts principals. The second counts covered control blocs. Every signature binds the same corridor, observation digest, slot, epoch, registry, graph, policy, purpose, and time anchor. Its signer wrapper binds the principal identity. Versions from different epochs cannot form one certificate.

The signing predicate requires receipt of the complete named observation, its deployment signature, and its contextual bindings. An honest watcher signs only after those checks.

The second bound counts every bloc containing a dishonest signer, including partial compromise. It requires coverage of all dishonest signing principals by the admitted graph. Graph components are a deterministic property of the evidence. Their institutional meaning depends on accurate and complete control evidence. They establish neither statistical independence nor the truth of each observed institutional assertion.

A fault configuration such as n_e\geq3f_e+1 selects a budget. Here the first count is the number of eligible principals in the epoch. Actual deployment evidence must support that budget. For weighted counting, the signing weight must exceed the assumed dishonest weight. Bonded weight supplies no organizational diversity. Consensus and availability require their separate protocol premises.

A controller change publishes a successor graph epoch. Current-use admission rechecks the applicable graph and registry versions under N5. The old certificate retains its historical signatures but loses current eligibility where the classification changed. Discovery of concealed historical control corrects the historical diversity assessment while preserving signature authenticity. The incorrect control assumption no longer supports the assessment.

Key rotation retains principal identity and both counts. A signer-supplied earlier timestamp cannot revive a revoked key. A successor certificate can qualify automatically when its eligible signers satisfy the current policies. Evidentiary ineligibility remains separate from registration sanctions and bond liability.

For example, with \theta_e=K_e=3, three covered principals in distinct blocs can certify one observation. Three keys for one principal count once. Three principals sharing a selected signing controller count as one bloc. A common hosting dependency can affect their availability assessment independently.

Two valid deployment-signed observations at the same corridor, epoch, and height form a fork witness when their digests differ. Different heights ordinarily show record growth.

8.3 Institutional instruments

An instrument profile connects a machine transition to the institution empowered to give it effect. Its common fields are \begin{split} (&\mathsf{instrumentDigest},\mathsf{jurisdiction}, \mathsf{competentOffice},\mathsf{delegatedRole},\\ &\mathsf{technicalOperator},\mathsf{acts},\mathsf{scope}, \mathsf{conditions},\mathsf{effectiveInterval},\\ &\mathsf{recordedAt},\mathsf{adoptionRule},\mathsf{noticeRule}, \mathsf{challengeRule},\mathsf{terminationRule}). \end{split} The instrument’s retained text and authentic adoption evidence support these fields, and its profile states the operative clauses for each transition. A mapping determination has its own competent issuer, scope, effective interval, and retained basis. Reusable determinations can support repeated automatic checks under their use contracts.

Three typed extensions supply the required governance acts.

Emergency mandate.

Name the trigger predicate, evidentiary threshold, affected acts, start rule, duration, countermand office, resumption office, notice channel, and challenge route. Each timing rule derives from the instrument.

Succession instrument.

Name predecessor and successor offices, surviving competence, effective time, adoption authority, record custodian, and explicit dispositions of rights and duties. Bind the prepared-transaction inventory, retained manifest, continuation rules, and authority-feed endpoints. A split allocates each competence explicitly. Joint competence names its joint decision rule.

Bond mandate.

Name the obligor, beneficiary, custodian, funded account, currency, pledged amount, permitted liability decisions, draw conditions, amount limit, notice, challenge, and release rule. Bind the provider’s payment and reversal contract. A liability assessment and available bond funding have separate fields.

Admission checks the predecessor authority profile, exact act, operative clause, conditions, use stage, and required signatures. Every required preimage must be available. A missing mandate yields a pending transition with the exact missing authority dependency. An authorized standing mandate lets subsequent conforming acts proceed automatically.

Governance versions enter Q_v through \mathsf{Publish} under the existing adoption rule. Their immutable payloads bind the instrument profile and transition conditions. \mathsf{Grant}, \mathsf{Revoke}, and \mathsf{Withdraw} retain their scoped effects. Constitutive change requires the independently effective institutional instrument specified by the predecessor authority structure. A technical operator cannot create that basis through publication.

8.4 Emergency power and countermand

Each destination’s emergency mandate determines its available halt and countermand powers. A halt identifies the affected acts, effective interval, trigger evidence, and governing clause. An immediate halt uses the mandate’s immediate-effect rule. A notice or countermand window applies only where the instrument requires it. The directive binds a single-use identifier and the exact scope. New reliance follows the halt state while existing acceptances and unresolved obligations remain recorded.

Countermand checks the relationship between the named offices under the same mandate. Resumption checks its designated authority and release conditions. The runtime can perform a delegated automatic halt when authenticated evidence satisfies a preauthorized trigger. A discretionary trigger requires its authorized determination. Joint action uses the corresponding participant decision protocol. Delivery, key custody, and clock premises remain explicit.

An emergency-relief order directs parties only within its jurisdiction and authority. It displaces a sovereign halt only under a rule adopted by the halting authority (Reference [5]).

8.5 Jurisdiction continuity

The jurisdiction lifecycle map records creation, active competence, termination, merger, split, and scope amendment. The succession instrument determines the lawful transitions between those states. The runtime first validates that instrument and binds the affected authority-resolution roots.

A continuation package contains the old record heads, retained-preimage manifest, effective authority map, outstanding obligations, and every unresolved prepared transaction. The successor acknowledges custody and reconstructs those reservations before conflicting writes. Existing terminal decisions retain their exact event and command identities. A configuration change authorizes neither abort nor a second dispatch.

Activation uses the existing adoption rule and the applicable guard transaction. It changes future authority resolution only for the instrument’s assigned scope. Dependent destinations apply their own recognition policies to the continuation package. Historical source acts keep their original issuers. An express adoption can authorize continued use without forging a replacement source act.

A valid split can route two disjoint competences to different successors and let both continue their permitted operations. Shared obligations retain their named common decision authority. A missing continuity instrument leaves the affected use pending while unrelated authority scopes continue.

8.6 Bond enforcement

A bond decision names its governing clause, liability basis, claimant, liable party, amount, currency, and decision authority. A watcher observation or fork witness can satisfy an evidentiary condition. The bond instrument determines the liability and draw power.

For a funded bond balance B, let r be prior reservations and e prior encumbrances. Define f=\max(B-r-e,0),\qquad d=\max(r+e-B,0). Then B+d=f+r+e. A new draw x requires 0<x\leq f and the mandate’s amount limit. Admission reserves x under the guard transaction before dispatch. An assessed receivable remains separate from B. A decrease in B records the resulting deficit without erasing prior reservations or liability.

The custodian executes the exact admitted command under its named authority-use contract. Confirmation requires its occurrence evidence. A paid debit reduces the funded balance and the command’s funded reservation in the same accounting update. Each debit applies once. Partial performance preserves the unpaid amount and remaining execution reservation. A return or reversal has its own occurrence and correction transition. Authorized release requires the instrument’s release conditions and resolution of outstanding command capacity.

8.7 Entrenched floor

Ordinary policy amendment must respect any clauses whose amendment authority was fixed outside that policy. We call those protected clauses an entrenched floor. The following result states what enforcing the existing signature requirement guarantees, assuming that requirement has its stated institutional basis.

Let F be a fixed set of floor clauses and E_F their required signature set. The validator changes F only when E_F signs the exact replacement.

Hart, Ross, and Suber study the distinction between ordinary rules and amendment authority (References [32]–[34]). The proposition states only the cryptographic consequence of fixing E_F externally.

8.8 Cryptographic continuity and trust boundary

Retained evidence may need to remain verifiable after a signing scheme is retired. An archival profile specifies the signatures required for acceptance and how successor evidence preserves the old record. One such profile can require an AND envelope of Ed25519, ML-DSA-65, and SLH-DSA-SHA2-128s. Each component signs the same canonical bytes and suite tag. Verification requires all three. Its signature field is 64+3{,}309+7{,}856=11{,}229\ \text{bytes}. The count excludes keys, tags, and encoding. RFC 8032 and NIST FIPS 204 and 205 give the component sizes (References [28]–[30]). Accepted forgery requires every verification relation to pass. This claim assumes component unforgeability, secure key binding, and correct verification.

Before retirement, the archive appends a successor-scheme witness over the prior digest while the old profile remains trusted. Re-anchoring preserves the historical entry. Later verification follows the witness chain specified by RFC 4998 (Reference [31]).

Colluding evaluators can sign false statements, and a defective authorized policy can return a wrong conclusion. Cryptographic verification alone establishes neither evaluator fidelity nor policy correctness. Seniority and independence therefore require evidence beyond signatures. The control-evidence policy states which controllers must differ and which correlated failures remain in its threat model.

9.1 Allocation under a current execution grant

Consider physical credit already admitted to the record and an existing payable obligation. The operation below allocates specified slices of that credit to specified portions of the obligation under a current execution grant. Its receipt and dependency checks retain the earlier distinctions between provider occurrence, evidence, and allocation. The authority check must account for changes to the records used to identify the allocation. Route ownership or credit-alias resolution can change, and an indirect rule can cease to permit the act.

The construction checks authority at a logical point within one local transaction. It concerns allocation of admitted credit, with no new payment execution. Authority at actual durable commitment remains a stronger, separate requirement.

Fix a finite allocation grammar. A request q names an immutable command, an obligation route, a credit route, an exact amount, an evidence package, and its original request time. Evaluation resolves the routes and records the exact payable portions and physical slices to be used. It also retains the historical recognition context at evaluation time t_0. That context includes the original request, local decisions, source evidence, obligations, and their admitted resolutions. Imported evidence must still satisfy the separately authorized local decision.

Conditional claims.

The one-writer realization requires T1–T4. Route-friction multiplication requires independent edge risks. Watcher, hybrid-signature, countermand, and post-partition conclusions require the assumptions stated in their sections.

Heuristic claims.

The control graph records specified common causes rather than statistical independence. Route-friction estimates require identified edge probabilities and dependence. Diminishing marginal evidence value remains a qualitative account.

Open questions.

Establishing minimality of N5 or N6 requires a history that preserves the other conditions and breaks a named conclusion when that condition is removed. Byzantine progress requires its communication, quorum, and recovery premises. Privacy beyond the declared affine and finite observation models requires the corresponding source domain, adversary, and interactive release mechanism.

Implementations must establish complete observation refinement, admitted sampling, history integrity, and current source permissions. Instrument profiles require authentic adoption evidence from the competent institutions. Concrete deployments must supply those profiles, current control evidence, retained bytes, and provider mandates.