16. Non-negotiable invariants, conformance tests, and rollout

#16.1 Forty substrate invariants

1. Internal entity identity is opaque, immutable and never keyed by VIN, serial, registration, plate, name, MAC, transponder, owner or account.
2. Design, revision, variant, lot/batch, physical instance, material, feature, software and calibration are distinct.
3. Physical asset, temporary assembly, configuration, component, persona, digital twin, legal party and agent remain distinct.
4. A person or animal is never an ownable component; capability or labor does not erase rights.
5. Self-propulsion is not an admission gate; zero, one or many propulsion paths are valid.
6. Support/lift, propulsion, steering/stopping/stability, useful action and control are separate graphs.
7. Force generator and reaction medium are independent: an air propeller may move a ground or water vehicle.
8. Scale is a quantitative relationship; a model remains an independent real asset and never inherits the referent’s identity.
9. Classification is multi-valued, attributed, configuration/operation-aware and time/jurisdiction/version-bound.
10. A public TypeRecipe is derived from facets; no recipe label alone proves safety, legality, value or fitness.
11. Unknown, absent, not observed, not measured, withheld, disputed and not applicable remain distinct.
12. Every published vocabulary identifier is stable and never repurposed.
13. Unknown namespaces and pack data round-trip without silent coercion or loss.
14. Domain packs extend but cannot redefine kernel identity, time, provenance, evidence, rights or privacy semantics.
15. Every record is typed, schema-versioned and immutable; corrections supersede or retract.
16. Occurred/valid time and recorded time are separate.
17. Every material assertion has a source; important claims link evidence and verification state.
18. Conflicting sourced assertions can coexist until resolved; later does not automatically mean truer.
19. Configurations are immutable, content-addressed and linked by typed diffs.
20. Operations, telemetry, tests, incidents and modifications reference the exact as-operated/as-tested configuration when known.
21. A serialized component retains identity, meters, condition and history when removed, transferred, overhauled or reused.
22. A component cannot occupy exclusive slots over overlapping valid intervals unless explicitly allowed.
23. Composition is acyclic in one snapshot; registered flow/control networks may contain cycles.
24. Every realized connection identifies compatible ports, state, effectivity, tests and evidence.
25. Every physical quantity has quantity kind, unit, source precision, method, reference conditions and uncertainty/frame where meaningful.
26. Derived values retain formula, inputs, algorithm/software version and uncertainty treatment.
27. Autonomy is recorded per function, phase, configuration and operating envelope—not as one vehicle field.
28. Designed, realized, available, authorized, engaged and executed capability are separate states.
29. Momentary protective intervention is not silently classified as sustained automation.
30. Handover is a recorded event with offer, acceptance, functions, timing, fallback and evidence.
31. Physical, publishing, persona, data, market, booking and spending authorities are independent, scoped and revocable.
32. Every consequential action has an authority grant and action receipt.
33. A modification separates reusable design from embodiment and records before/after configuration, actual work, impacts, tests and release.
34. Reverting a change creates another configuration; it never deletes the change history.
35. Defect, damage, fault, failure mode, mechanism, cause, effect and consequence remain distinct.
36. Maintenance due dates and health scores are projections with algorithm, inputs, time and uncertainty—not permanent truth fields.
37. Software identity includes artifact digest, build provenance, dependencies, target compatibility, deployment and rollback state.
38. Creative content cannot self-certify as telemetry, maintenance, ownership, accident, registry or performance evidence.
39. Sensitive identifiers, documents, precise location, raw telemetry and human identity fail private and are filtered server-side.
40. Public, owner, technician, regulator, race, market and twin views are rebuildable projections—not authoritative storage.

#16.2 Required conformance fixtures

#16.3 Build sequence

#16.4 First implementation decisions

• Adopt EmbodiedAsset plus multi-role projections instead of one giant Vehicle inheritance tree?
• Adopt TypeRecipe as a versioned constraint set over facet assertions rather than a required single vehicle_type value?
• Lock support, propulsion, action and control as separate graph families?
• Lock immutable configurations and append-only typed records before building more profile fields?
• Select canonical units/quantity vocabulary, JSON signing form and semantic export strategy?
• Approve the first six domain packs and the golden fixtures above?
• Assign vocabulary and schema governance so public terms never drift silently?
• Make the public vehicle profile only one policy-filtered projection over the universal substrate?

Closing proposition
RTracer does not win by naming every vehicle once. It wins by becoming the place where any machine—familiar, niche, hybrid or not yet invented—can acquire a durable identity, exact configuration, whole-life memory, community, voice and governed ability to act.