Appendix N. v1.3 to v1.4 corrective migration and errata
Version 1.4 is additive for the semantic vehicle model and corrective for operational runtime profiles. It does not renumber or redigest v1.3 RecordCore objects, receipts, proofs, events, or artifacts. It seals legacy operational histories and begins new…
Version 1.4 is additive for the semantic vehicle model and corrective for operational runtime profiles. It does not renumber or redigest v1.3 RecordCore objects, receipts, proofs, events, or artifacts. It seals legacy operational histories and begins new profile epochs with explicit bridges.
#N1. Corrected contradictions and precedence
| v1.3 surface | Defect | v1.4 correction | Compatibility |
|---|---|---|---|
| 26.2, 30.2–30.6, 34.1–34.5, Appendix D1 | Tenant ledger_seq, shardPosition, stream receipt tail, and shard receipt chain describe competing order models. | commitSequence is gap-free per logical shard epoch; ShardHead owns the receipt tail; shardPosition is legacy storage metadata. | writer migration required; historical bytes preserved |
| 43.5 event topic table | Admission events partition by semantic stream while checkpoints advance by shard. | Canonical admission lane partitions by tenant + logicalShardId + chainEpoch and publishes commitSequence order. | consumer and broker migration required |
| 25.4, 33.4, 33.6, Appendix D2 | Required signer/suite/time/key fields are not all inside one signed target. | ProofTargetV1_4 signs the complete proof intent under one domain-separated digest; protected headers must match. | proof verifiers support both profiles |
| 34.3, 43.2 | Request digest does not exactly bind semantic headers and detached proof set; unknown-result lookup is absent. | RequestDigestInput is exact and /v1/idempotency:resolve is authenticated and scoped. | SDK/API addition; existing bindings preserved |
| 44.5 recovery | Empty projections may start from restored nonzero checkpoints. | Restore matching state+checkpoint or empty state+genesis only. | runbook correction |
| H-42, 34.6, T-076 | Absolute rebuildability conflicts with lawful payload/key destruction. | ErasureReceipt and ReplayTombstone yield NON_REPRODUCIBLE_BY_POLICY where required bytes no longer exist. | projection status addition |
| 39.1–39.2 | Bare monotonic lease time is not comparable across arbiters or reboot-safe. | AuthorityClockRef binds arbiter, clock, boot, tick rate, authority epoch, and anti-rollback state. | control profile migration required |
| 41.4, H2 | One-time dispatch nonce has no atomic consumption boundary. | ActionDispatchEnvelope and DISPATCHING append consume the nonce before provider I/O. | action broker migration required |
| documentation generator | Version/path literals, unstable block IDs, invalid Markdown tables, partial search, and incomplete manifests. | Exact immutable releases, identity registry, valid tables, body search, migration/deprecation records, artifact hashes, and schema publication. | documentation client update |
Where an old illustrative shape conflicts with an exact v1.4 profile, the v1.4 profile governs. Appendix D is retained as historical design context and MUST be interpreted through Appendix O for new implementations.
#N2. Ledger cutover procedure
Freeze each v1.3 logical shard’s writer and record the cutover policy, time, writer epochs, registry locks, and software digests. 2. Audit all legacy rows, per-stream sequence continuity, receipt links, proof availability, referenced artifacts, and outbox completeness. Any unexplained discrepancy blocks promotion and opens an incident. 3. Emit an immutable LegacyShardSeal over legacy receipt digests in legacy committed order. Preserve the exact ordering rule and any known gaps or ambiguities inside the seal. 4. Never renumber or redigest v1.3 records, proofs, receipts, events, cursors, or artifacts. 5. Create v1.4 chainEpoch 1 with commitSequence 1 and genesisPreviousDigest equal to the accepted LegacyShardSeal digest. 6. Preserve idempotency bindings and their original receipts. A retry resolves to the original profile unless a new intended operation is explicitly created. 7. Invalidate v1.3 query cursors at cutover. Do not translate private cursor state across cryptographic profiles. 8. Expire and fence all v1.3 control leases and in-flight commands. New AuthorityClockRef and authority epoch are required before arming. 9. Dual-read legacy and new profiles, shadow-verify v1.4 writes, then cut over writers. Derived projections expose their mixed-source checkpoint vector. 10. Sign and publish a MigrationReceipt containing seals, new genesis/epoch values, validation results, fixture bundle digest, responsible principals, and release manifest digest.
#N3. Stable identity migration
All 56 v1.3 section stable IDs remain registered. Modified sections include 25, 26, 30, 32, 33, 34, 39, 41, 43, 44, and Appendix D because their operational precedence or shapes change. Sections 45–55 and Appendices K–Q are added. No stable ID is removed or reused. Every existing fixture ID T-001 through T-256 remains unique; fixtures T-257 through T-328 are added.
#N4. Compatibility status
| Consumer | v1.4 behavior |
|---|---|
| semantic RecordCore reader | may continue reading 1.3 bytes unchanged |
| proof verifier | verifies only the profile declared by the proof; never auto-upgrades |
| ledger writer | must implement ShardHead, gap-free commitSequence, exact receipt profile, and bridge cutover |
| event consumer | must distinguish canonical admission lane from derived topics and checkpoint only canonical commitSequence |
| projection rebuilder | must declare replay mode, registry/code/policy locks, and erasure behavior |
| control runtime | must reject legacy bare-clock leases after cutover |
| agent/SDK | resolves exact release manifest and profile versions; does not infer latest semantics from an unversioned page |