Appendicesnormative v1.4.0bundle v1.4.137 blocks

Appendix I. One hundred thirty-two additional implementation conformance fixtures

Together with Appendix E, this raises the release-gate corpus to 256 cases. Each case requires canonical machine-readable inputs, expected disposition/code, before/after state for transactional cases and replay evidence. A passing UI screenshot is not a…

Concept & directionLNK

#I1. Quantities, frames, and numerical representation

ID	Scenario	Expected semantic result
T-125	Convert exactly 1 lbf·ft to 1.3558179483314004 N·m	Accept the exact declared conversion; retain source representation, unit definitions and transform receipt.
T-126	Add 20 °C and 10 °C as two absolute temperatures	Reject affine-unit misuse; only an absolute temperature plus a temperature interval is dimensionally legal.
T-127	Receive a NaN bit pattern from a normalized sensor channel	Preserve exact raw IEEE bits with invalid quality; never emit a factual QuantityValue.
T-128	Supply a covariance matrix with a materially negative eigenvalue	Reject the uncertainty object as not positive semidefinite under the locked tolerance.
T-129	Supply quaternions q and -q for the same pose	Treat rotations as equivalent and serialize the profile's deterministic canonical sign.
T-130	Close a transform loop with 0.5 m residual under a 1 mm tolerance	Mark the frame graph inconsistent and prohibit fused pose; retain residual as calibration evidence.

#I2. Time, telemetry, and segment integrity

ID	Scenario	Expected semantic result
T-131	A 32-bit microsecond producer tick wraps once under a declared wrap model	Reconstruct monotonic device time only inside the same bootId and increase mapped-time uncertainty.
T-132	Two observations' time intervals overlap after uncertainty expansion	Report physical order unknown; do not break the tie with database arrival time.
T-133	Channel datatype changes halfway through a telemetry segment	Reject or split exactly at the change; one manifest cannot silently reinterpret rows.
T-134	Plaintext digest matches but encoded ciphertext digest fails	Quarantine storage/transmission corruption even though semantic plaintext identity is known.
T-135	Compressed telemetry exceeds the 100:1 expansion limit	Terminate bounded decoding before full allocation and reject/quarantine by policy.
T-136	A late segment fills a previously declared gap	Append completeness correction and invalidate/recompute every affected metric; do not edit the old assessment.

#I3. Configuration and capability computation

ID	Scenario	Expected semantic result
T-137	Fan bicycle has wheel support and an air-thrust fan	Realize locomotion without requiring driven wheels; preserve support/propulsion separation.
T-138	Blimp has adequate buoyancy but a failed propulsion battery	Support remains available; controlled translation is unavailable; payload action may be separately evaluated.
T-139	Propeller is installed but has no continuous energy path	Configuration may be structurally valid while propulsion capability evaluates false with a broken-path proof.
T-140	Voltage ranges intersect but connector polarity conflicts	Reject the realized electrical connection despite numeric range intersection.
T-141	Resource graph contains an algebraic loop without a registered solver	Return compiler ERROR with loop proof; never coerce to unavailable or available.
T-142	A critical effectivity input is not known at the evaluation checkpoint	Return UNKNOWN and prohibit operation authorization dependent on that capability.

#I4. Control authority, arbitration, and safety

ID	Scenario	Expected semantic result
T-143	Command arrives under the previous authority epoch	Reject before actuator dispatch and append stale-authority disposition.
T-144	Equal-priority controllers issue incompatible steering commands	Declare conflict and invoke the registered fallback; do not average without a blend contract.
T-145	Handover commits but the new controller never produces acknowledged command	Trigger the handover deadline fallback and retain both controller/barrier receipts.
T-146	Remote closed-loop link is lost	Execute the local asset/domain-specific minimum-risk response within the declared deadline.
T-147	Emergency stop is followed by an ordinary arm command	Reject until authorized recovery check clears the latched state.
T-148	Position command has correct units but the wrong coordinate frame	Reject; never infer or silently transform the command frame.

#I5. Models, tests, dyno, and maintenance

ID	Scenario	Expected semantic result
T-149	Estimator inputs leave the model's validation domain	Mark output OUT_OF_DOMAIN and prohibit control/safety use; retain as qualified analysis if policy permits.
T-150	Wheel-dyno and crank-bench runs show equal headline power	Classify as different measurement boundaries and not directly comparable.
T-151	Static-thrust test shows thrust but zero useful translational power	Accept without invented propulsive efficiency or division by zero.
T-152	Normalized innovation remains above threshold for the required window	Mark the digital twin DIVERGED and invoke its reset/fallback policy.
T-153	RUL model receives a duty cycle outside validated population	Return unknown distribution/application status instead of extrapolated remaining life.
T-154	A calibration is retracted after metric publication	Append invalidation, traverse dependency graph, recompute and publish correction lineage.

#I6. Cross-domain physical semantics

ID	Scenario	Expected semantic result
T-155	A 1:8 RC model is geometrically similar but Reynolds number differs	Reject full dynamic-similarity claim; report geometric and aerodynamic fidelity separately.
T-156	Amphibious craft crosses shore with wheel and marine constraints simultaneously active	Require an explicit hybrid transition mode with guards, hazards and reset map.
T-157	Underwater glider advances by buoyancy cycling without propeller	Realize locomotion through variable buoyancy plus hydrodynamic lift.
T-158	Spacecraft vectors share numbers but differ in frame and epoch	Prohibit comparison until exact transform/propagation and uncertainty are supplied.
T-159	Tether solver produces compressive negative tension	Enter slack-tether mode; clamping the force while retaining taut equations is forbidden.
T-160	Rail consist loses one brake controller	Recompute consist and route-specific braking envelope rather than marking the train generically broken.

#I7. Principal identity and credentials

ID	Scenario	Expected semantic result
T-161	User attempts authentication with KUN's VIN	Reject and create no AuthenticatedContext.
T-162	Stolen access token is presented without its DPoP/mTLS key	Reject proof-of-possession and record safe authentication failure.
T-163	Valid signature uses a key after compromise-effective time	Reject current authority and mark affected historical evidence for trust re-evaluation.
T-164	Untrusted external credential claims ownership	Retain as issuer assertion; grant no internal authority.
T-165	Workload presents a token for a human-facing audience	Reject audience/actor mismatch.
T-166	Old token is used after principal epoch advancement	Reject stale epoch even if token signature and expiry are otherwise valid.
T-167	One recovery delegate attempts a two-member R4 recovery	Reject until quorum and required authenticators are satisfied.
T-168	Authentication assurance drops between proposal and dispatch	Reevaluate and deny or issue a new challenge; old positive decision is unusable.

#I8. Grants, relationships, and policy

ID	Scenario	Expected semantic result
T-169	Sale grant uses an unbounded resource wildcard	Reject the R4 grant as non-attenuated/non-specific.
T-170	Ownership exists but may_list_for_sale is absent	Deny listing; never infer sale authority from title interest.
T-171	Required relationship expires one second before dispatch	Deny after immediate valid-time reevaluation.
T-172	One policy permits while another explicitly denies	Deny and name the controlling prohibition without disclosing private policy data.
T-173	Jurisdiction is indeterminate for a binding sale	Return indeterminate and enforce deny.
T-174	Policy engine is unavailable for an R3 action	Fail closed; do not reuse an unbounded stale positive cache.
T-175	Cached permit is presented after grant revocation	Reject by epoch/checkpoint mismatch.
T-176	Required audit duty cannot be durably committed	Do not dispatch the external effect.

ID	Scenario	Expected semantic result
T-177	Maintenance-purpose consent is reused for advertising	Deny purpose mismatch.
T-178	Consent is withdrawn while campaign content is scheduled	Freeze publication/campaign, invalidate caches and start lineage remediation.
T-179	Data under legal hold is requested for unrelated marketing	Retain under hold but deny the use.
T-180	A legal hold selects every tenant record without scoped authority	Reject or require exceptional separately governed approval.
T-181	Minor-associated media lacks required consent/guardian basis	Deny publication and retain only under applicable evidence/retention policy.
T-182	Withdrawn data contributed to a derived model	Block new dependent use and open lineage-based remediation; do not erase audit history.
T-183	Disclosure record omits recipient or purpose	Reject it before any bytes leave the boundary.
T-184	Adding a private vehicle changes a public result count	Fail the public projection non-interference test.

#I10. Agent, content, voice, and connector isolation

ID	Scenario	Expected semantic result
T-185	Service note says to ignore policy and transfer money	Store as inert evidence; create no tool call, memory promotion or authority change.
T-186	Retrieved page requests fetching an arbitrary URL	Block direct fetch; only an independently authorized allowlisted fetch proposal may proceed.
T-187	Model output requests a generic HTTP tool	Reject unknown tool/schema at the post-model enforcement point.
T-188	Post states unsupported horsepower as fact	Block publication or require an exact evidence-backed qualifier.
T-189	KUN says it felt proud	Permit only as disclosed persona/creative expression, never observed affect.
T-190	Voice right expires before scheduled publication	Freeze output and require renewed rights/approval.
T-191	Platform transcoding strips embedded media provenance	Preserve visible disclosure and sidecar provenance/lineage or withhold publication.
T-192	Model provider retention terms conflict with source policy	Route to an approved provider/runtime or deny generation.

#I11. Spotting, advertising, and recruitment abuse

ID	Scenario	Expected semantic result
T-193	Spotting image reveals a home driveway	Keep private or deny; home/storage inference is not publicly projected.
T-194	Visible map is coarse but image EXIF contains precise coordinates	Strip/transform EXIF before any publication.
T-195	Repeated coarse sightings permit route triangulation	Suppress or increase time delay/spatial coarsening using aggregate abuse analysis.
T-196	Reporter probes whether vehicle is on suppression list	Return the same generic non-revealing response as other unresolved cases.
T-197	Plate text exactly matches one profile	Create a candidate with calibrated evidence; do not merge identity or reveal private profile.
T-198	Ad model infers owner income or health from vehicle data	Deny and record a policy incident.
T-199	Defect telemetry is offered to insurer without exact authority	Deny disclosure and targeting.
T-200	Follower popularity is used to reject an applicant	Prohibit the feature and invalidate the recruitment decision process.

#I12. Auctions and settlement

ID	Scenario	Expected semantic result
T-201	One bid digit changes after exact confirmation	Reject proposal/terms digest mismatch.
T-202	Same bid key and same bytes are retried	Return the original admission receipt; create no duplicate bid.
T-203	Same bid key arrives with different bytes	Quarantine/report equivocation and admit at most the original.
T-204	Bid arrives after close with earlier client timestamp	Reject; trusted receive time controls eligibility.
T-205	Equal bids arrive sequentially	Apply the locked tie rule using admission sequence or other predeclared deterministic input.
T-206	Seller or prohibited related party bids	Exclude under locked eligibility policy and retain evidence.
T-207	Seller changes reserve after auction opens	Reject the mutation; cancel/relist only through explicit allowed process.
T-208	Bid lands exactly at anti-sniping lower boundary	Apply the locked inclusive lower/strict close-boundary expression exactly.
T-209	Close and bid admission race	Serializable ordering permits exactly one outcome around the close fence.
T-210	Payment succeeds but title review fails	Do not transfer; suspend and compensate/refund/dispute per settlement profile.
T-211	Escrow status comes from an unregistered provider	Do not mark funds in escrow; retain as untrusted assertion.
T-212	Later higher offer arrives after close	Winner and close price remain unchanged.

#I13. Accounting, mandates, and unknown effects

ID	Scenario	Expected semantic result
T-213	Journal differs by one minor currency unit	Reject posting; no rounding tolerance.
T-214	EUR and CZK balance only when combined	Reject; each currency group must balance independently.
T-215	Refund attempts to edit original capture entry	Reject mutation; append refund/reversal batch.
T-216	Two concurrent EUR 60 actions use a EUR 100 mandate	Atomic reservation permits at most one.
T-217	Payment request times out after possible dispatch	Enter UNKNOWN_EFFECT and retain budget reservation.
T-218	Unsigned webhook reports payment success	Quarantine; do not settle, entitle or post journal.
T-219	Provider poll proves success after timeout	Settle exactly once and consume the existing reservation.
T-220	Non-idempotent provider returns ambiguous not-found	Require operator resolution and prohibit automatic retry.

#I14. Transfer, compromise, and audit

ID	Scenario	Expected semantic result
T-221	Title transfers while persona rights remain with seller	Freeze, fork, retire or explicitly relicense persona; no silent continuity.
T-222	Old provider token remains active after transfer	Fail succession conformance; revoke/rotate and advance relevant epoch.
T-223	Key compromise is discovered retroactively	Append compromise interval and re-evaluate dependent proofs without rewriting records.
T-224	Audit inclusion proof disagrees with signed checkpoint	Raise tamper incident and reject the evidence bundle.

#I15. Wire grammar and digest separation

ID	Scenario	Expected semantic result
T-225	New entity root is minted as UUIDv7	Reject profile mismatch; durable roots use opaque UUIDv4 while events/records use UUIDv7.
T-226	Record UUID is uppercase or nil	Reject lexical form before digesting.
T-227	Open interval encodes end:null	Reject; omit end for open interval.
T-228	Parser receives duplicate profile members	Reject before materializing object.
T-229	Proof is added to an existing RecordCore	Record digest remains unchanged; ProofRecord/proof-set digest changes.
T-230	Same RecordCore is admitted into another tenant	Portable record digest remains equal; admission receipt digest changes.
T-231	Projection changes audience/redaction only	Projection digest/ETag changes; record and receipt digests remain stable.
T-232	Transport retry count is inserted into canonical EventData	Reject event schema; retry metadata stays outside canonical event.

#I16. Ledger, registry, migration, and supply chain

ID	Scenario	Expected semantic result
T-233	Two first-time requests race on an absent idempotency row	INSERT ON CONFLICT then lock produces one binding and deterministic duplicate/equivocation handling.
T-234	Append transaction aborts before ShardHead commit	No commitSequence is consumed; stream and shard heads remain unchanged.
T-235	Writer presents a stale writer epoch	Reject even when expected sequence is correct.
T-236	Outbox row publishes twice after crash	Consumer applies once by eventId and atomically stored checkpoint.
T-237	Registry import references mutable latest schema	Reject; require immutable ID/version/digest lock.
T-238	Migration changes a historical RecordCore in place	Reject; emit new record plus MigrationReceipt and lineage.
T-239	Revoked pack is required to verify old evidence	Allow verification under incident policy; prohibit new authoring/compilation.
T-240	Deployment artifact digest differs from signed provenance	Stop promotion/activation and record supply-chain incident.

#I17. HTTP, query, events, SDK, and federation

ID	Scenario	Expected semantic result
T-241	Client retries timeout with a new idempotency key	SDK conformance fails; query old key/result before any new intended effect.
T-242	Canonical GET returns a projection ETag	Fail API contract; canonical ETag must bind record digest.
T-243	Cursor is replayed under another principal or policy	Reject signature/binding and start a new query.
T-244	Query requests arbitrary SQL or unbounded recursive relationship path	Reject typed-query validation.
T-245	Consumer commits view state but not event checkpoint atomically	Fail event conformance; crash test demonstrates duplicate/skip risk.
T-246	SDK maps unknown enum to default AVAILABLE	Reject generated SDK; unknown value remains typed unknown/unsupported.
T-247	Offline device uploads same sample identity with different bytes	Quarantine equivocation; do not use last-write-wins.
T-248	Federated Follow is treated as private dossier access	Deny; social relationship carries no data/action grant.

#I18. Operations, recovery, scale, and release

ID	Scenario	Expected semantic result
T-249	Ledger overload returns success after only queueing bytes	Fail correctness; success requires durable committed receipt.
T-250	Public projection cache omits checkpoint and policy digest	Reject cache entry/response as non-reproducible.
T-251	Redis loss removes auction leader or mandate balance	Architecture conformance fails; disposable cache cannot be authoritative.
T-252	Backup restores database but referenced object digest is missing	Recovery remains failed; do not issue RecoveryAttestation.
T-253	Projection rebuild from same checkpoint produces different digest	Stop release/recovery and investigate code, registry or nondeterminism.
T-254	Policy cache remains positive after revocation propagation delay	Dispatch-time epoch check denies despite cache.
T-255	Canary changes canonical bytes across language implementations	Stop rollout; canonical corpus requires byte equality.
T-256	Error budget is exhausted while invariant tests stay green	Freeze risky availability changes and prioritize reliability; do not weaken invariants.