Appendicesnormative v1.4.0bundle v1.4.127 blocks

Appendix E. One hundred twenty-four implementation conformance fixtures

These fixtures are release-gate requirements for the implementation-depth profile. Each must have a machine-readable input, expected acceptance/rejection and canonical finding code; stateful cases also require before/after ledger, stream-head, projection…

Concept & directionLNK

#E1. Envelope, parsing, and canonicalization

ID	Scenario	Expected semantic result
T-001	JSON object repeats a key with two values	Reject during parsing; no digest, proof or idempotency binding is created.
T-002	Equivalent object arrives with different key order and whitespace	Canonical bytes and record digest match exactly.
T-003	Number 1.0 is sent where the schema requires an exact decimal string	Reject the wire form; never silently coerce binary floating point.
T-004	Unicode identifier uses a visually confusable character	Preserve exact source, apply declared normalization only to indexed alias, and flag confusable risk.
T-005	Unknown top-level field appears outside the extension container	Reject under the locked schema version; do not drop it silently.
T-006	Known extension namespace contains an unknown future member	Preserve and round-trip according to extension policy without claiming understanding.
T-007	Payload exceeds the record-class byte/depth limit	Reject before full allocation and return a safe structured limit error.
T-008	Content-Type names schema v3 while schemaRef names v2	Reject before canonicalization as an envelope/schema mismatch.
T-009	Canonical CBOR and canonical JSON encode the same conceptual claim	Treat as distinct signed representations unless a declared cross-format semantic digest profile applies.
T-010	Client signs pretty JSON instead of canonical RecordCore bytes	Proof verification fails with the exact signature-target profile identified.

#E2. Identity, references, and bitemporal semantics

ID	Scenario	Expected semantic result
T-011	VIN is submitted as the internal entity primary key	Reject model misuse; create an opaque entity ID and a scoped identifier assertion.
T-012	Two physical assets present the same plate number at different valid times	Retain both scoped assertions; no entity merge follows from the plate alone.
T-013	One tracker MAC address is moved from KUN to another truck	Close the installation relationship; preserve device identity and both configuration histories.
T-014	A record references a part not yet present locally	Admit a typed unresolved reference if policy allows; projection marks incomplete instead of inventing the part.
T-015	Later evidence says two entity roots are the same	Append a merge/same-as decision with authority and reversible projection; never rewrite old record subjects.
T-016	A mistaken merge is discovered after social followers accumulated	Append split correction, reproject provenance-aware followers/content, and expose continuity decisions.
T-017	Maintenance occurred Monday but was recorded Friday	validTime represents Monday; recordedAt remains Friday and cannot be backdated.
T-018	A registry fact was valid in 2024 but first learned in 2026	As-valid and as-known queries return different, explainable results.
T-019	Valid intervals overlap with mutually exclusive custody assertions	Retain both claims, emit conflict assessment, and avoid a fabricated single owner.
T-020	Entity is deleted from public view	Public projection disappears under policy while non-public append-only evidence follows lawful retention/deletion rules.

#E3. Claims, evidence, quantities, and coordinates

ID	Scenario	Expected semantic result
T-021	Signed owner statement says mileage is 80,000 km	Authenticate the issuer/source; do not upgrade the value to measured truth.
T-022	Two odometers disagree with different calibration histories	Retain both observations, uncertainties and calibration refs; derive a qualified assessment.
T-023	Power value lacks measurement location	Reject or mark incomplete; engine, wheel and shaft power cannot be compared implicitly.
T-024	Dyno result omits correction standard and atmosphere	Retain raw artifact as evidence but prohibit normalized comparison claim.
T-025	Torque series uses N·m and lbf·ft	Convert only through exact unit definitions while preserving original values and uncertainty.
T-026	Mass is given as 2.5 without unit	Reject as semantically incomplete; field-name convention does not supply a hidden unit.
T-027	GNSS point omits datum/frame	Mark coordinate uninterpretable for precision use; no silent WGS84 assumption.
T-028	Pose uses quaternion with norm far from one	Reject or normalize only under an explicit transform receipt with error bound.
T-029	Derived lap time has no input segment IDs	Reject as an authoritative metric; keep as ungrounded analysis if allowed.
T-030	Correction retracts one evidence item used by a published claim	Recompute assessment/projections and issue correction obligations without deleting original lineage.

#E4. Configuration, topology, parts, and lifecycle

ID	Scenario	Expected semantic result
T-031	Configuration contains the same serialized battery instance twice	Reject duplicate occupancy unless the model explicitly represents a composite/alias.
T-032	Fuel hose is connected to an electrical power inlet	Reject graph validation by port family, medium and direction constraints.
T-033	Mechanical shaft connection exceeds declared speed/torque envelope	Reject verified-ready state or require an explicit engineering waiver.
T-034	Propeller is mounted but no energy/conversion path reaches it	Configuration may exist physically; propulsion capability evaluates false/indeterminate with explanation.
T-035	RC battery is swapped between heats	Create a new configuration snapshot/diff while preserving the same vehicle root.
T-036	Software update changes autonomous behavior with no hardware change	Record software/calibration configuration diff and re-evaluate control capabilities.
T-037	Part is removed for service then reinstalled	Represent two installation intervals; do not clone or reset the part identity.
T-038	Replacement component has unknown serial	Create a bounded anonymous item instance linked to source evidence and later reconciliation.
T-039	Modification record has after-state but no before configuration	Reject completion or mark change lineage incomplete; current state cannot prove the delta.
T-040	Wash photos are timestamped but not tied to configuration/condition	Store media, but condition and appearance projections remain qualified until contextual links exist.

#E5. Schema registry, proofs, idempotency, and projections

ID	Scenario	Expected semantic result
T-041	Schema reference resolves to mutable latest URL	Reject canonical admission; require immutable version and digest lock.
T-042	Registry serves bytes whose digest differs from lock	Quarantine registry integrity failure and halt dependent validation.
T-043	Signing key was valid at proof creation but is revoked now	Verify historical key status at proof time and expose current revocation separately.
T-044	Proof signs a record digest using an unapproved algorithm	Reject proof profile while retaining the unsigned record according to admission policy.
T-045	Exact idempotent retry arrives after client timeout	Return the original immutable result and receipt without a second append.
T-046	Same idempotency key carries different request digest	Quarantine equivocation and never choose one payload silently.
T-047	Projection replay uses the same inputs and lock set	Output canonical digest and checkpoint match the golden result.
T-048	Projection code changes but version remains unchanged	Release gate fails; code digest/version must change before activation.
T-049	Poison event causes repeated consumer crash	Quarantine the projection generation, expose degraded state, and prohibit silent skip.
T-050	Explanation contains a private source edge for a public view	Redact the edge and prove non-interference while preserving internal derivation.

#E6. Ledger concurrency, outbox, and replay failure

ID	Scenario	Expected semantic result
T-051	Two writers append with the same expected stream sequence	Exactly one commits; the other receives a concurrency conflict and new tail.
T-052	Old cell resumes after failover with expired writer epoch	Fence and reject every append regardless of its local lease belief.
T-053	Process crashes after ledger insert but before commit	Transaction rolls back record, head and outbox together.
T-054	Process crashes after commit before publishing outbox	Publisher later emits the durable outbox row; no semantic write is lost.
T-055	Broker delivers the same change event five times	Consumer applies one deterministic result and advances checkpoint once.
T-056	Events from independent streams arrive in different orders	Each stream remains valid; cross-stream projection exposes contributing checkpoints.
T-057	Event N+1 arrives before N within an ordered partition	Buffer/retry until gap resolves or enter declared degraded state; never invent N.
T-058	Hash-chain predecessor digest does not match stream head	Reject append and raise integrity incident.
T-059	Backup restore omits one committed ledger segment	Digest/sequence scrub detects gap before service promotion.
T-060	Full replay differs from incremental projection	Fail release/recovery gate and preserve both outputs for deterministic root-cause analysis.

#E7. Telemetry, media, clocks, and derived data

ID	Scenario	Expected semantic result
T-061	Telemetry segment sequence range overlaps prior segment	Detect duplicate/overlap; deduplicate only by declared sample identity and retain finding.
T-062	Device clock wraps mid-capture	Apply declared wrap rule and preserve mapping uncertainty.
T-063	GNSS clock jumps backward after loss of fix	Split time mapping or flag discontinuity; never force monotonic observed time silently.
T-064	Channel schema digest changes inside one segment	Reject segment or split at the change; one manifest binds one schema.
T-065	Upload byte digest differs from manifest	Reject admission, retain safe failure receipt, and prohibit derived metrics.
T-066	Sample count is correct but sequence contains gaps	Admit under policy with explicit gap ranges and quality disposition.
T-067	Sensor saturates during dyno peak	Flag invalid/censored interval; peak result cannot be presented as fully observed.
T-068	Photo EXIF conflicts with trusted capture receipt	Retain both sources and conflict; do not overwrite one timestamp.
T-069	AI-generated car image is posted as documentary evidence	Require synthetic lineage and creative-lane label; exclude from factual condition proof.
T-070	Derived braking metric uses a retracted calibration	Invalidate/recompute affected derivation and propagate correction to public claims.

#E8. Tenancy, cache, search, deletion, and disaster recovery

ID	Scenario	Expected semantic result
T-071	Artifact bytes deduplicate across tenants	Share physical bytes only if designed, but keep independent authorization, encryption and lifecycle envelopes.
T-072	Public cache key omits audience disclosure class	Security test fails; cache construction is rejected.
T-073	Search count changes when a private vehicle is added	Non-interference test fails; private existence must not leak through count/ranking/timing.
T-074	Profile request asks for checkpoint newer than projection	Wait within budget, route to authoritative read or return explicit staleness—not false freshness.
T-075	Owner revokes precise-location sharing	Priority propagation removes/replaces precise views and invalidates affected caches.
T-076	Retention expires raw telemetry used by a public summary	Delete/dispose as required and mark future reproducibility limits on the retained summary.
T-077	Legal hold is applied to one incident interval	Preserve only scoped records/artifacts under separate authority and review date.
T-078	Regional replica violates residency policy	Block replication and emit governance/security incident.
T-079	Key backup cannot decrypt restored artifact	Recovery test fails even if object bytes and digest are intact.
T-080	Tenant export is restored on a clean implementation	Schemas, packs, records, proofs, artifacts and checkpoints reproduce portable dossier semantics.

#E9. Principals, grants, policy, and action execution

ID	Scenario	Expected semantic result
T-081	Profile administrator tries to sell the vehicle	Deny: profile administration does not imply sale authority.
T-082	Owner grant expired one second before dispatch	Reevaluation denies dispatch despite earlier proposal approval.
T-083	Confirmed ticket price changes before purchase	Invalidate confirmation and require a new exact-terms decision.
T-084	Agent changes one bid digit after confirmation	Proposal digest mismatch denies execution and records attempted mutation.
T-085	Grant permits merch purchase but connector requests ticket scope	Deny least-privilege scope mismatch.
T-086	Mandate allows EUR 100 per action; cart totals EUR 100.01	Deny before provider dispatch.
T-087	Principal revokes grant while provider reservation is open	Stop new effects and follow declared release/settlement reconciliation for existing reservation.
T-088	Agent text contains a steering command	Treat as inert content; no route exists to safety-control actuators.
T-089	Policy engine is unavailable for R3 action	Fail closed and preserve proposal; do not use cached allow beyond its binding/validity.
T-090	Connector timeout follows possible payment capture	Enter UNKNOWN_EFFECT and reconcile by stable provider operation ID before retry.

#E10. Persona, content, rights, spotting, and privacy

ID	Scenario	Expected semantic result
T-091	Vehicle agent states an unverified horsepower figure as fact	Grounding gate blocks or qualifies it with evidence state and source.
T-092	Creative post lets KUN narrate feelings	Permit as declared persona fiction; never convert it into a mechanical condition claim.
T-093	Sponsor requests undisclosed promotional speech	Deny or require explicit paid-content labeling and campaign receipt.
T-094	Persona voice license expires while scheduled posts remain	Freeze affected voice outputs and require a valid replacement right.
T-095	Truck is sold but persona rights remain licensed to seller	Separate asset transfer from persona succession and deactivate/re-scope representation.
T-096	Spotter photo contains a visible child and plate	Apply people/plate privacy, rights and location policy before any public candidate profile.
T-097	Image similarity finds two plausible famous cars	Keep candidate set and confidence; no automatic merge or owner notification claim.
T-098	Invitation claimant proves custody but not ownership	Grant only the custody/profile functions justified by proof; do not assert title.
T-099	Private interview source approves one excerpt only	Publish only the approved excerpt/context; retain source recording under scoped access.
T-100	Advertisement model infers sensitive owner trait from vehicle	Prohibit inference and targeting; vehicle interest is not consent to human sensitive profiling.

#E11. Listings, auctions, fraud, and settlement

ID	Scenario	Expected semantic result
T-101	Asking price is displayed as highest bid	Reject projection-type substitution and retain distinct value objects.
T-102	Bid is received after trusted close time but client timestamp is earlier	Reject eligibility based on trusted admission time while retaining audit evidence.
T-103	Two equal bids arrive in one serialized auction stream	Apply declared deterministic tie rule using immutable bid receipts.
T-104	Seller changes reserve after opening without allowed policy	Reject change or close/relist under explicit restart rules and bidder notice.
T-105	Highest monetary bid is from an ineligible bidder	Exclude with finding and apply close policy to remaining eligible set.
T-106	Fraud system flags account after bid admission but before close	Evaluate current eligibility under declared policy and preserve both admission and exclusion evidence.
T-107	Feed ranking places a lower bid first	No effect on close; feed order is not auction order.
T-108	Payment succeeds but title check fails	Settlement saga pauses/compensates according to escrow and refund terms; no asset transfer.
T-109	Custody transfers while persona rights do not	Record independent custody/title/persona dispositions and avoid a bundled continuity fiction.
T-110	Chargeback occurs after beneficiary payout	Append dispute, receivable/liability and recovery entries; posted journal history remains unchanged.

#E12. Commerce, accounting, recruitment, and control isolation

ID	Scenario	Expected semantic result
T-111	Journal entry debits and credits differ by one minor unit	Reject posting; no tolerance or floating-point rounding is permitted.
T-112	One entry balances only after mixing EUR and CZK	Reject; balance independently per currency and record explicit FX transactions.
T-113	Refund edits the original capture row	Reject mutation; append reversal/refund entries linked to the source.
T-114	Vehicle revenue report treats escrow cash as earnings	Accounting projection fails classification; escrow liability remains separate.
T-115	Revenue share omits fee and tax basis	Reject settlement calculation as under-specified.
T-116	Event seat reservation expires before purchase	Reconcile release and require a new quote/reservation; do not capture stale terms.
T-117	Merch provider sends duplicate fulfillment webhook	Deduplicate by provider event identity and preserve attempt metadata.
T-118	Agent recommends internship using private telemetry contribution	Deny unless contributor consent and recruitment purpose explicitly cover the evidence.
T-119	Vehicle popularity score is used to reject an engineering applicant	Prohibit high-impact decision from social rank; require dedicated human-reviewed process.
T-120	Social runtime obtains network reachability to a CAN actuation gateway	Architecture/security conformance fails; planes must be isolated by capability and network boundary.

#E13. Cross-domain capstone fixtures

ID	Scenario	Expected semantic result
T-121	Fan-propelled bicycle has wheel support, air-thrust propulsion and human steering	Match the composed recipe without misclassifying fan as support or wheel as propulsion.
T-122	Amphibious RC model leaves water, deploys wheels and swaps control mode	Bind each observation/action to configuration, medium, operation and function-scoped authority intervals.
T-123	Blimp carries a robotic gripper while tethered, then flies remotely	Represent buoyant support, tether constraint, propulsive flight, manipulation utility and two operational configurations.
T-124	KUN completes acquisition, wash, telemetry, service, modification, dyno, media, event purchase, sponsorship, auction and transfer	Every projection traces to immutable records; rights, money, persona and title transitions remain independent and replayable.