35. Schema, vocabulary, domain-pack, and migration control plane

Content-addressed registry artifact
RegistryArtifact {
  artifactId, artifactKind, namespace, name, semanticVersion,
  contentDigest, canonicalProfile, mediaType, byteLength,
  dependencyConstraints[], resolvedDependencyLocks[],
  compatibilityClaims[], supersedes[], deprecates[],
  publisherPrincipalId, reviewerDecisionRefs[],
  sourceRevision, buildProvenanceRef, signatureRefs[],
  state, activatedAt?, deprecatedAt?, revokedAt?,
  testVectorManifestDigest, resourceBudget, licenseRef
}

artifactKind in {
  jsonSchema, vocabulary, graphShape, typeRecipe, domainPack,
  policyBundle, canonicalProfile, migrationProgram, testCorpus, sdkPackage
}

Deterministic dependency resolver and validation sandbox
resolve(rootArtifacts, registrySnapshot):
  candidates = exact content-addressed versions in snapshot only
  solve semantic-version constraints deterministically:
    1. exact lock wins
    2. otherwise highest non-revoked version satisfying every constraint
    3. tie-break by bytewise artifactId
  reject cycles except vocabulary cross-reference groups explicitly marked cyclic
  reject namespace ownership conflict and duplicate term definitions
  emit RegistryLockfile(sorted artifacts, snapshotDigest, resolverVersion)

validate(pack):
  no network, filesystem, clock, randomness or process access
  bounded AST nodes, recursion depth, input graph size, output findings and CPU
  stratified deterministic rules only; no write or authorization side effects
  timeout/error => INDETERMINATE and fail closed for required safety/policy checks

Append-only schema migration
MigrationProgram {
  migrationId, fromSchemaLock, toSchemaLock, programDigest,
  engineProfile, preconditions[], mappingRules[],
  informationLossClasses[], defaultSources[],
  expectedFindingCodes[], goldenVectorsDigest,
  reviewerDecisionRefs[], activationWindow
}

MigrationReceipt {
  sourceRecordId, sourceDigest, targetRecordId, targetDigest,
  migrationId, programDigest, executedAt, executorWorkload,
  findings[], lossManifest[], validationResult, rollbackRelation
}

Rules:
- Historical RecordCore is never rewritten.
- Upcast creates a derived replacement record and explicit relation.
- A supplied default names its source and epistemic lane.
- A lossy transform cannot claim semantic equivalence.
- Bulk activation requires corpus scan counts and quarantine thresholds.