diff --git a/.github/workflows/pr-gate.yml b/.github/workflows/pr-gate.yml
index 69f1a78..2aefbb4 100644
--- a/.github/workflows/pr-gate.yml
+++ b/.github/workflows/pr-gate.yml
@@ -35,7 +35,7 @@ jobs:
           if ($LASTEXITCODE) { throw 'Invalid package version.' }
           "value=$version" >> $env:GITHUB_OUTPUT
   managed-packages:
-    needs: [allocate-version, native, secret-scan, repository-hooks]
+    needs: [allocate-version, native, secret-scan, repository-hooks, design-policy]
     uses: ./.github/workflows/package-validation.yml
     with:
       version: ${{ needs.allocate-version.outputs.version }}
@@ -71,9 +71,32 @@ jobs:
       - name: Run repository hooks
         run: pre-commit run --all-files --show-diff-on-failure --color=always
 
+  design-policy:
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, windows-latest]
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+      - name: Reject source, export, citation and dependency drift
+        run: python -m unittest discover -s eng -p test_design_policy.py -v
+      - name: Verify exports against an isolated immutable Design checkout
+        run: python eng/design_policy.py
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        if: always()
+        with:
+          name: design-policy-${{ matrix.os }}-${{ github.run_id }}-${{ github.run_attempt }}
+          path: artifacts/evidence/design-policy.json
+          if-no-files-found: error
+          retention-days: 30
+
   ci:
     if: always()
-    needs: [allocate-version, managed-packages, native, secret-scan, repository-hooks]
+    needs: [allocate-version, managed-packages, native, secret-scan, repository-hooks, design-policy]
     runs-on: ubuntu-latest
     env:
       CI_NEEDS: ${{ toJSON(needs) }}
diff --git a/README.md b/README.md
index 2c92e92..56a35e7 100644
--- a/README.md
+++ b/README.md
@@ -17,6 +17,23 @@ Product applications and services build independently from published packages.
 See [extraction scope and evidence](docs/platform-bootstrap.md). The accepted product family design is
 maintained in [ArcForges-Design](https://github.com/ArcForges/ArcForges-Design).
 
+## Design policy data
+
+`eng/policy` contains generated glossary and invariant data from the exact Design
+commit in `design-source.json`. The portable checker compares fresh exports and
+validates document links, scoped citations, occurrence classifications and the
+work-package graph. CI requires these checks on Windows and Linux before packaging.
+
+```text
+python -m unittest discover -s eng -p test_design_policy.py -v
+python eng/design_policy.py
+```
+
+The second command fetches only the pinned public documentation into a temporary
+checkout and retains a report under `artifacts/evidence/design-policy.json`. It
+does not execute Design code examples. For reviewed source changes and read-only
+pre-merge checks, see [policy maintenance and evidence](docs/design-policy.md).
+
 ## Build and verify
 
 Install the .NET SDK selected by `global.json` and Python 3.11 or newer. No Mobile/Web workloads are needed.
diff --git a/docs/design-policy.md b/docs/design-policy.md
new file mode 100644
index 0000000..12ba58a
--- /dev/null
+++ b/docs/design-policy.md
@@ -0,0 +1,76 @@
+# WP00.01: Design policy exports and continuing integrity
+
+Design remains the authored authority. [P2-016](https://github.com/ArcForges/ArcForges-Design/blob/1607374e81955f0a47f319cd6cc8ba1c6e254157/docs/decisions/phase-2-specification-decisions.md#rule-p2-016)
+assigns this AGPL exporter, derived data and CI check to DesktopPlatform. Consumers
+can read the checked-in JSON without a Design checkout. These files are policy data;
+distribution through build packages belongs to WP02/WP05, and this change adds no
+packable capability or product source dependency.
+
+The reviewed pin is `1607374e81955f0a47f319cd6cc8ba1c6e254157`. Collection and
+negative fixtures found missing scoped anchors, ambiguous and compound citations,
+sentence-final citations, an omitted reverse dependency and stale mechanism totals.
+Design PRs [15](https://github.com/ArcForges/ArcForges-Design/pull/15),
+[16](https://github.com/ArcForges/ArcForges-Design/pull/16) and
+[17](https://github.com/ArcForges/ArcForges-Design/pull/17) repair those at their owner.
+
+The exported 135 term rows preserve 148 marked names, five explicit spaces and all
+16 contextual forbidden-alias rows. The 429 invariant records retain both catalogue
+and coverage locations, statements, architecture homes, mechanisms, planned
+verification, owning packages and completion gates. Three retired rows keep their
+absence tests. `verificationState: planned-only` does not close PG-11 or prove runtime
+behavior. Contracts recognizes only the digest-bound forbidden-alias array at its
+registered path; all remaining values and files stay subject to naming scans.
+
+The checker reads 172 current Markdown documents while excluding deprecated input
+bodies before reading. The current receipt indexes 7,601 document-scoped rules and
+9,436 explicit rule citations, checks 11,411 local links and validates 165 exact
+occurrence classifications covering 171 occurrences. It compares both forward
+graphs, every active package header/dependency section and the exact reverse graph:
+51 active nodes and 158 edges. It checks topological order, unique numbered sections,
+mandatory package sections and the owned `.90` evidence row. Future/retired packages
+have no active edges. The commerce substep ordering remains explicit.
+
+## Source updates and review
+
+For a proposed Design worktree, run the read-only preview before its documentation
+PR merges. Its report includes commit/dirty state and cannot be used as an immutable
+export result:
+
+```text
+python eng/design_policy.py --design-root /absolute/path/to/design-worktree --preview --report artifacts/evidence/design-preview.json
+```
+
+After reviewing and merging the Design change, update the exact commit and source
+hashes in `eng/policy/design-source.json` on a DesktopPlatform worktree. Source hashes
+use UTF-8 text with normalized LF newlines, matching Git's text content on Windows
+and Linux. The corpus digest covers the sorted array of document path and text digest
+pairs using compact JSON with sorted keys and unescaped UTF-8. Obtain these values
+from the reviewed preview, then generate and independently verify the exports:
+
+```text
+python eng/design_policy.py --refresh
+python eng/design_policy.py
+```
+
+A supplied `--design-root` must be the canonical repository, clean and at the exact
+pin for immutable mode. The default obtains a fresh isolated public checkout at that
+commit, with checkout hooks disabled. It runs no source programs and never advances
+to a branch tip. A source change also requires Contracts to update its exact derived
+declaration registration before the family scan accepts the new glossary identity.
+
+## Verification and limits
+
+The 15 test groups use independent small documents and real temporary Git repositories.
+They remove, duplicate, reorder and edit export records; alter source statements,
+spaces, owners and architecture homes; corrupt links, anchors and classification
+counts/hashes; and break every graph representation, node ordering and evidence rows.
+They exercise dirty/wrong-pin refusal, preview immutability, deprecated-body exclusion,
+sentence punctuation, same-spelled rules in different documents and the CLI's real
+failure exit/report. A current-corpus pass alone is insufficient.
+
+Both CI platforms run the fixtures and fetch/verify the pinned real corpus before
+package creation. Their full reports are retained as `design-policy-*` artifacts.
+Existing native, managed, independent package-consumer and publication gates remain
+required. Local immutable export verification passed; PR CI, merge and publication
+remain pending until the corresponding run artifacts are reviewed. Policy checks
+establish no provider, device, product behavior or commercial activation evidence.
diff --git a/eng/design_corpus.py b/eng/design_corpus.py
new file mode 100644
index 0000000..88e30bf
--- /dev/null
+++ b/eng/design_corpus.py
@@ -0,0 +1,159 @@
+# SPDX-License-Identifier: AGPL-3.0-only
+"""Document-scoped Markdown integrity checks; no historical programs are executed."""
+
+import collections
+import html
+import posixpath
+import re
+import subprocess
+from urllib.parse import unquote, urlsplit
+
+ID = re.compile(r'(?<![\w-])(?:WP-\d{2}(?:\.\d{2})?|P2-\d{3}|F-[A-Z]{2}-[1-9]\d*|[A-Z][A-Z0-9]{0,5}-(?:[A-Z]\d{1,3}|\d{2,3}[a-z]?))(?![\w-]|\.\d)')
+LINK = re.compile(r'\[([^\]\n]+)\]\(([^)\n]+)\)')
+ANCHOR = re.compile(r'<a\s+id="([^"]+)"\s*>\s*</a>')
+STANDARD = {'SHA-256', 'SHA-512', 'UTF-16', 'UTF-32', 'IEEE-754', 'P-256'}
+
+def visible(s):
+    return re.sub(r'[`*~]', '', html.unescape(LINK.sub(lambda m: m[1], re.sub(r'<[^>]*>', '', s))))
+
+def cells(line):
+    return [c.strip() for c in re.split(r'(?<!\\)\|', line.strip())[1:-1]]
+
+def lines(text):
+    fence = None
+    for n, line in enumerate(text.splitlines(), 1):
+        match = re.match(r'^\s{0,3}(`{3,}|~{3,})(.*)$', line)
+        if match:
+            if fence is None:
+                fence = match[1]
+            elif match[1][0] == fence[0] and len(match[1]) >= len(fence) and not match[2].strip():
+                fence = None
+            continue
+        if fence is None:
+            yield n, line
+    if fence:
+        raise ValueError('unclosed code fence')
+
+def heading_slug(text):
+    return re.sub(r'[^\w\- ]', '', visible(text).lower()).replace(' ', '-')
+
+def anchor_identifier(anchor):
+    if not anchor.startswith('rule-'):
+        return None
+    candidate = anchor[5:].upper()
+    if ID.fullmatch(candidate):
+        return candidate
+    candidate = candidate[:-1] + candidate[-1:].lower()
+    return candidate if ID.fullmatch(candidate) else None
+
+def definition(line):
+    if line.startswith('|'):
+        cs = cells(line)
+        if not cs or LINK.search(cs[0]):
+            return None
+        value = visible(cs[0]).strip()
+    else:
+        m = re.match(r'^#{1,6} (.+)$|^- (.+)$|^(\*\*[A-Z].+)$', line)
+        if not m:
+            return None
+        value = visible(m[1] or m[2] or m[3]).strip()
+        if LINK.match((m[1] or m[2] or m[3]).lstrip('*')): return None
+    m = ID.match(value)
+    if m and (len(value) == len(m[0]) or re.match(r'\s*[—:·]', value[len(m[0]):])):
+        return m[0]
+    return None
+
+def load(root):
+    entries = subprocess.check_output(['git', 'ls-files', '--stage', '-z'], cwd=root).decode().split('\0')
+    paths = []
+    for entry in filter(None, entries):
+        metadata, path = entry.split('\t', 1)
+        mode, _, stage = metadata.split()
+        if mode not in {'100644', '100755'} or stage != '0':
+            raise ValueError(f'unsupported Git source entry: {path}')
+        paths.append(path)
+    paths += subprocess.check_output(['git','ls-files','--others','--exclude-standard','-z'],cwd=root).decode().split('\0')
+    paths = sorted(set(p for p in paths if p.endswith('.md') and not (p.startswith('docs/deprecated-inputs/') and p != 'docs/deprecated-inputs/README.md')))
+    return {p: read_document(root, p) for p in paths}
+
+def read_document(root, path):
+    candidate = root / path
+    if not candidate.resolve().is_relative_to(root.resolve()):
+        raise ValueError(f'source escapes Design root: {path}')
+    for current in [candidate, *candidate.parents]:
+        if current == root:
+            break
+        if current.is_symlink() or (hasattr(current, 'is_junction') and current.is_junction()):
+            raise ValueError(f'linked source is unsupported: {path}')
+    return candidate.read_text(encoding='utf-8')
+
+def collect(root, docs=None):
+    docs = load(root) if docs is None else docs
+    anchors = {}; defs = {}; errors = []
+    for p, text in docs.items():
+        parsed = list(lines(text)); existing = {}; counts = collections.Counter(); found = {}
+        for n, line in parsed:
+            for a in ANCHOR.findall(line):
+                if a in existing: errors.append([p,n,'duplicate anchor',a])
+                existing[a] = n
+            h = re.match(r'^#{1,6} (.*)$', line)
+            if h:
+                base = heading_slug(h[1]); count = counts[base]; counts[base] += 1
+                slug = base + (f'-{count}' if count else '')
+                if slug in existing: errors.append([p,n,'duplicate anchor',slug])
+                existing[slug] = n
+            key = definition(line)
+            if key:
+                if key in found: errors.append([p,n,'duplicate definition',key])
+                found[key] = n
+        for a, n in existing.items():
+            key = anchor_identifier(a)
+            if key: found.setdefault(key,n)
+        authored = {definition(line) for _, line in parsed}
+        defs[p] = {k: {'line':n, 'anchor':'rule-'+k.lower(), 'stable':'rule-'+k.lower() in existing,
+                       'kind':'definition' if k in authored else 'preserved-anchor'} for k,n in found.items()}
+        anchors[p] = existing
+    return docs, anchors, defs, errors
+
+def audit(root, docs=None):
+    docs, anchors, defs, errors = collect(root, docs)
+    citations=[]; local_links=[]; raw=[]; missing=[]
+    homes=collections.defaultdict(list)
+    for p, dd in defs.items():
+        for key, d in dd.items():
+            homes[key].append(p)
+            if not d['stable']: missing.append([p,d['line'],key])
+    for p, text in docs.items():
+        for n, line in lines(text):
+            prose = re.sub(r'`+[^`]*`+', '', line)
+            if re.search(r'\[[^\]]+\]\[[^\]]*\]|^\s*\[[^\]]+\]:', prose):
+                errors.append([p,n,'unsupported reference-link syntax'])
+            for match in LINK.finditer(line):
+                uri=match[2].strip('<>')
+                label_ids = [key for key in ID.findall(visible(match[1])) if key not in STANDARD]
+                if urlsplit(uri).scheme or uri.startswith('//'):
+                    if label_ids: errors.append([p,n,'external rule home',uri,label_ids])
+                    continue
+                name, _, fragment=uri.partition('#')
+                target=posixpath.normpath(posixpath.join(posixpath.dirname(p),unquote(name))) if name else p
+                local_links.append(dict(document=p, line=n, label=match[1], target=target, anchor=unquote(fragment)))
+                if target.startswith('/') or target == '..' or target.startswith('../'):
+                    errors.append([p,n,'link escapes Design root',uri])
+                    continue
+                if not (root/target).exists(): errors.append([p,n,'missing target',uri])
+                elif fragment and unquote(fragment) not in anchors.get(target,{}): errors.append([p,n,'missing fragment',uri])
+                for label in label_ids:
+                    if fragment!='rule-'+label.lower():errors.append([p,n,'wrong rule anchor',uri,label])
+                    if label not in defs.get(target,{}):errors.append([p,n,'missing rule definition',uri,label])
+                    citations.append([p,n,label,target,fragment])
+            spans=[m.span() for m in LINK.finditer(line)]+[m.span() for m in ANCHOR.finditer(line)]
+            defid=definition(line)
+            firstdef=True
+            for m in ID.finditer(line):
+                key=m[0]
+                if any(a<=m.start()<b for a,b in spans) or key in STANDARD:continue
+                if key==defid and firstdef:firstdef=False;continue
+                raw.append([p,n,key,homes[key],line])
+    return dict(documents=len(docs), links=len(local_links), localLinks=local_links, definitions=sum(map(len,defs.values())),
+                index=[dict(document=p, identifier=k, **v) for p,dd in defs.items() for k,v in dd.items()],
+                missingAnchors=missing, errors=errors, citations=citations, raw=raw)
diff --git a/eng/design_graph.py b/eng/design_graph.py
new file mode 100644
index 0000000..045074f
--- /dev/null
+++ b/eng/design_graph.py
@@ -0,0 +1,81 @@
+# SPDX-License-Identifier: AGPL-3.0-only
+"""Compare every current work-package graph representation and its schedule."""
+
+from design_corpus import cells, lines, load
+import re
+
+INACTIVE = {'20', '27', '29'}
+
+def graph(root, docs=None):
+    docs=load(root) if docs is None else docs
+    errors=[]
+    index=docs['docs/planning/work-packages/README.md']
+    sequence=docs['docs/planning/implementation-sequence.md']
+    forward={};phase={};reverse={};packages={}
+    ids=lambda value:set(re.findall(r'`(\d{2})`',value))
+    for line in sequence.split('## 9. ',1)[1].splitlines():
+        m=re.match(r'^\| (\d{2}) \| (.*) \|$',line)
+        if m:
+            if m[1] in forward:errors.append(['duplicate forward',m[1]])
+            forward[m[1]]=ids(m[2])
+    for line in index.split('## Downstream dependency index',1)[0].splitlines():
+        cs=cells(line)
+        if len(cs)==3 and re.fullmatch(r'\d{2}',cs[0]):
+            if cs[0] in INACTIVE:
+                if ids(cs[2]):errors.append(['inactive phase edges',cs[0]])
+                continue
+            if cs[0] in phase:errors.append(['duplicate phase',cs[0]])
+            phase[cs[0]]=ids(cs[2])
+    for line in index.split('## Downstream dependency index',1)[1].split('## Deferred-gate scheduling',1)[0].splitlines():
+        cs=cells(line)
+        if len(cs)==2 and re.fullmatch(r'\d{2}',cs[0]):
+            if cs[0] in reverse:errors.append(['duplicate reverse',cs[0]])
+            reverse[cs[0]]=ids(cs[1])
+    for p,text in docs.items():
+        numbers=[m[1] for n,l in lines(text) if (m:=re.match(r'^## (\d+(?:\.\d+)*)(?:\.)?\s',l))]
+        if len(numbers)!=len(set(numbers)):errors.append([p,'duplicate numbered section',numbers])
+        m=re.match(r'docs/planning/work-packages/(\d{2})-',p)
+        if not m:continue
+        if m[1] in INACTIVE:
+            for line in text.splitlines():
+                if re.match(r'^(?:> Upstream:|\*\*(?:Upstream|Downstream):\*\*)',line) and ids(line):
+                    errors.append([p,'inactive package edges'])
+            continue
+        key=m[1]
+        if key in packages:errors.append([p,'duplicate package identifier',key])
+        packages[key]=p
+        if set(numbers)!=set(str(i) for i in range(1,10)):errors.append([p,'mandatory sections',numbers])
+        header=next((l for l in text.splitlines() if l.startswith('> Upstream:')),None)
+        if not header or 'Downstream:' not in header:errors.append([p,'missing graph header']);continue
+        hu,hd=header.split('Downstream:',1)
+        try:
+            dep=text.split('## 9. ',1)[1].split('\n## ',1)[0]
+            su,sd=dep.split('**Downstream:**',1)
+            evidence=text.split('## 7. ',1)[1].split('\n## ',1)[0]
+        except (IndexError,ValueError):errors.append([p,'missing dependency/evidence section']);continue
+        up,down=ids(su),ids(sd)
+        if ids(hu)!=up or ids(hd)!=down:errors.append([p,'header/dependency mismatch'])
+        if up!=forward.get(key):errors.append([p,'forward mismatch'])
+        if down!=reverse.get(key):errors.append([p,'downstream mismatch'])
+        rows=[l for l in evidence.splitlines() if l.startswith('|') and f'#rule-wp-{key}.90)' in l]
+        if len(rows)!=1:errors.append([p,'owned .90 evidence rows',len(rows)])
+    if forward!=phase:errors.append(['forward/phase mismatch'])
+    if set(forward)!=set(packages) or set(reverse)!=set(packages):errors.append(['node sets differ'])
+    for key, deps in forward.items():
+        if not deps<=forward.keys():errors.append([key,'inactive producer'])
+        if reverse.get(key)!={k for k,v in forward.items() if key in v}:errors.append([key,'reverse is not transpose'])
+    s=re.search(r'^Serial execution: ([\d, ]+)\.',sequence,re.M)
+    order=s[1].split(', ') if s else []
+    if len(order)!=len(set(order)) or set(order)!=set(forward):errors.append(['serial node set/order'])
+    pos={v:n for n,v in enumerate(order)}
+    for k, values in forward.items():
+        for v in values:
+            if pos.get(v,999)>=pos.get(k,-1):errors.append([k,'producer ordered later',v])
+    if f'All {len(forward)} active packages' not in sequence:errors.append(['declared node count'])
+    edges=sum(map(len,forward.values()))
+    if f'Total active dependency edges: {edges}.' not in sequence:errors.append(['declared edge count'])
+    if 'WP42.11 precedes 42.10.' not in sequence:errors.append(['commerce substep order missing'])
+    return {'nodes':len(forward),'edges':edges,'order':order,
+            'forward':{k:sorted(v) for k,v in forward.items()},
+            'reverse':{k:sorted(v) for k,v in reverse.items()},
+            'packages':packages,'errors':errors}
diff --git a/eng/design_policy.py b/eng/design_policy.py
new file mode 100644
index 0000000..2042ad1
--- /dev/null
+++ b/eng/design_policy.py
@@ -0,0 +1,335 @@
+# SPDX-License-Identifier: AGPL-3.0-only
+"""Export and verify Design policy data at a reviewed immutable source commit."""
+
+from __future__ import annotations
+
+import argparse
+from collections import Counter
+from contextlib import contextmanager
+from datetime import datetime, timezone
+import hashlib
+import json
+from pathlib import Path
+import re
+import subprocess
+import sys
+import tempfile
+
+import design_corpus as corpus
+from design_graph import graph
+
+ROOT = Path(__file__).resolve().parents[1]
+POLICY = ROOT / 'eng/policy'
+REPOSITORY = 'ArcForges/ArcForges-Design'
+GLOSSARY = 'docs/requirements/01-normative-glossary-and-invariants.md'
+COVERAGE = 'docs/assurance/invariant-coverage.md'
+CLASSIFICATIONS = 'docs/assurance/citation-classifications.json'
+SPACES = {'domain', 'wire', 'UI', 'storage', 'commercial'}
+
+
+def require(condition, message):
+    if not condition:
+        raise ValueError(message)
+
+
+def closed(value, names, label):
+    require(isinstance(value, dict) and set(value) == set(names.split()), f'{label}: unexpected/missing fields')
+
+
+def unique_keys(pairs):
+    result = {}
+    for key, value in pairs:
+        require(key not in result, f'duplicate JSON key: {key}')
+        result[key] = value
+    return result
+
+
+def read_json(path):
+    return json.loads(path.read_text(encoding='utf-8'), object_pairs_hook=unique_keys)
+
+
+def encode(value):
+    return (json.dumps(value, ensure_ascii=False, indent=2) + '\n').encode('utf-8')
+
+
+def canonical_hash(value):
+    return hashlib.sha256(json.dumps(value, sort_keys=True, ensure_ascii=False,
+                                     separators=(',', ':')).encode()).hexdigest()
+
+
+def text_hash(text):
+    return hashlib.sha256(text.encode('utf-8')).hexdigest()
+
+
+def git(root, *args):
+    return subprocess.check_output(['git', *args], cwd=root).decode('utf-8').strip()
+
+
+def state(root):
+    require(Path(git(root, 'rev-parse', '--show-toplevel')).resolve() == root, 'Design root must be a Git repository root')
+    remote = git(root, 'remote', 'get-url', 'origin')
+    require(remote in {f'https://github.com/{REPOSITORY}.git', f'https://github.com/{REPOSITORY}',
+                       f'git@github.com:{REPOSITORY}.git'}, 'incorrect Design repository identity')
+    return {'commit': git(root, 'rev-parse', 'HEAD'), 'status': git(root, 'status', '--porcelain=v1')}
+
+
+@contextmanager
+def checkout(pin):
+    """Only documentation is read; no Design program or repository hook is run."""
+    with tempfile.TemporaryDirectory(prefix='arcforges-design-policy-') as directory:
+        root = Path(directory)
+        commands = [
+            ['init', '--quiet'],
+            ['remote', 'add', 'origin', f'https://github.com/{REPOSITORY}.git'],
+            ['-c', 'core.autocrlf=false', 'fetch', '--quiet', '--depth=1', 'origin', pin['commit']],
+            ['-c', 'core.autocrlf=false', '-c', 'core.hooksPath=' + str(root / 'no-hooks'),
+             'checkout', '--quiet', '--detach', 'FETCH_HEAD'],
+        ]
+        for command in commands:
+            subprocess.run(['git', *command], cwd=root, check=True)
+        yield root
+
+
+def validate_pin(pin):
+    closed(pin, 'schemaVersion license repository commit sourceHashes corpusSha256', 'Design pin')
+    require(pin['schemaVersion'] == 1 and type(pin['schemaVersion']) is int, 'unsupported pin schema')
+    require(pin['license'] == 'AGPL-3.0-only' and pin['repository'] == REPOSITORY, 'incorrect pin ownership')
+    require(isinstance(pin['commit'], str) and re.fullmatch('[0-9a-f]{40}', pin['commit']), 'invalid Design commit')
+    require(isinstance(pin['sourceHashes'], dict) and set(pin['sourceHashes']) == {GLOSSARY, COVERAGE, CLASSIFICATIONS},
+            'incomplete policy sources')
+    for value in [pin['corpusSha256'], *pin['sourceHashes'].values()]:
+        require(isinstance(value, str) and re.fullmatch('[0-9a-f]{64}', value), 'invalid Design source hash')
+    return pin
+
+
+def source_ref(path, docs, commit):
+    return {'repository': REPOSITORY, 'commit': commit, 'path': path, 'sha256': text_hash(docs[path])}
+
+
+def glossary(docs, commit):
+    terms, aliases, spaces = [], [], []
+    section = None
+    names_seen = set()
+    for number, line in corpus.lines(docs[GLOSSARY]):
+        heading = re.match(r'^#{2,3} (\d+(?:\.\d+)*)\.?\s', line)
+        if heading:
+            section = heading[1]
+        if not line.startswith('|') or section is None:
+            continue
+        cs = corpus.cells(line)
+        if not cs or all(re.fullmatch(r':?-+:?', c) for c in cs):
+            continue
+        if cs[0] in {'Term', 'Space', 'Forbidden / obsolete', '#'}:
+            continue
+        if int(section.split('.')[0]) in range(1, 6):
+            require(len(cs) == 3, f'{GLOSSARY}:{number}: term row must have three cells')
+            spellings = re.findall(r'\*\*([^*]+)\*\*|`([^`]+)`', cs[0])
+            names = [name for pair in spellings for part in pair if part for name in part.split(' / ')]
+            require(names and all(name and name == name.strip() for name in names), f'invalid term at {number}')
+            require(not (set(names) & names_seen) and len(names) == len(set(names)), f'duplicate canonical term at {number}')
+            names_seen.update(names)
+            retired = cs[1] == 'retired'
+            term_spaces = [] if retired else cs[1].split(', ')
+            require(retired or (set(term_spaces) <= SPACES and len(set(term_spaces)) == len(term_spaces)),
+                    f'invalid term spaces at {number}')
+            require(retired or term_spaces, f'missing term spaces at {number}')
+            namespaces = {name.rsplit('.', 1)[0] if '.' in name else 'shared' for name in names}
+            require(len(namespaces) == 1, f'mixed term namespaces at {number}')
+            if section.startswith('5.'):
+                require(all('.' in name for name in names), f'unqualified product term at {number}')
+            terms.append({'section': section, 'line': number, 'term': cs[0], 'names': names,
+                          'namespace': next(iter(namespaces)), 'spaces': term_spaces,
+                          'status': 'retired' if retired else 'active', 'definition': cs[2]})
+        elif section == '6':
+            require(len(cs) == 2, f'invalid space row at {number}')
+            name = corpus.visible(cs[0])
+            spaces.append({'name': name if name == 'UI' else name.lower(), 'label': cs[0], 'rule': cs[1]})
+        elif section == '8':
+            require(len(cs) == 3 and all(cs), f'invalid forbidden-alias row at {number}')
+            aliases.append({'section': section, 'line': number, 'term': cs[0], 'reason': cs[1], 'instead': cs[2]})
+    require(terms and aliases and len(spaces) == len(SPACES) and {x['name'] for x in spaces} == SPACES,
+            'missing glossary tables or term-space definitions')
+    return {'schemaVersion': 1, 'license': 'AGPL-3.0-only', 'source': source_ref(GLOSSARY, docs, commit),
+            'spaces': spaces, 'terms': terms, 'forbiddenAliases': aliases}
+
+
+def invariants(root, docs, commit, active):
+    catalogue, mapping = {}, {}
+    for number, line in corpus.lines(docs[GLOSSARY]):
+        if line.startswith('|') and (m := re.fullmatch(r'I-\d{3}', corpus.visible(corpus.cells(line)[0]).strip())):
+            key = m[0]
+            require(key not in catalogue, f'duplicate catalogue invariant {key}')
+            cs = corpus.cells(line)
+            require(len(cs) == 2, f'invalid catalogue row {key}')
+            catalogue[key] = (cs[1], number)
+    section = docs[COVERAGE].split('## 7. Item-level mapping', 1)
+    require(len(section) == 2, 'missing invariant coverage section 7')
+    body = section[1].split('\n## ', 1)[0]
+    first_line = docs[COVERAGE].split('## 7. Item-level mapping', 1)[0].count('\n') + 1
+    for coverage_line, line in enumerate(body.splitlines(), first_line):
+        if not line.startswith('|'):
+            continue
+        cs = corpus.cells(line)
+        key = corpus.visible(cs[0])
+        if not re.fullmatch(r'I-\d{3}', key):
+            continue
+        require(key not in mapping and len(cs) == 7 and all(cs), f'duplicate/incomplete mapping {key}')
+        require(key in catalogue, f'catalogue/mapping ID sets differ: missing {key} from catalogue')
+        require(corpus.visible(catalogue[key][0]) == corpus.visible(cs[1]),
+                f'catalogue/mapping statement mismatch {key}')
+        owners = {a or b for a, b in re.findall(r'WP-(\d{2})|`(\d{2})`', cs[5])}
+        require(owners and owners <= active, f'invalid invariant owner {key}: {sorted(owners)}')
+        retired = corpus.visible(cs[1]).startswith('Retired by ')
+        mechanism = corpus.visible(cs[3])
+        require(not retired or mechanism == 'Absence test', f'retired invariant lacks absence test: {key}')
+        for name in re.findall(r'`([^`]+\.md)`', cs[2]):
+            path = (root / 'docs/architecture' / name).resolve()
+            require(path.is_relative_to(root) and path.is_file(), f'missing architecture home {key}: {name}')
+        mapping[key] = {'id': key, 'status': 'retired' if retired else 'active',
+                        'section': '7', 'catalogueLine': catalogue[key][1], 'coverageLine': coverage_line,
+                        'statement': catalogue[key][0],
+                        'architectureHome': cs[2], 'mechanism': mechanism, 'plannedVerification': cs[4],
+                        'owningPackages': sorted(owners), 'ownerCell': cs[5], 'completionGate': cs[6]}
+    require(catalogue and catalogue.keys() == mapping.keys(), 'catalogue/mapping ID sets differ or are empty')
+    counts = Counter(x['mechanism'] for x in mapping.values())
+    summary = docs[COVERAGE].split('### 4.2 Mechanism distribution', 1)[1].split('\n### ', 1)[0]
+    declared = {}
+    for line in summary.splitlines():
+        cs = corpus.cells(line)
+        if len(cs) == 3 and corpus.visible(cs[1]).isdigit():
+            name = corpus.visible(cs[0]); require(name not in declared, 'duplicate mechanism summary')
+            declared[name] = int(corpus.visible(cs[1]))
+    require(declared.pop('Total', None) == len(mapping) and declared == dict(counts), 'mechanism distribution mismatch')
+    return {'schemaVersion': 1, 'license': 'AGPL-3.0-only',
+            'sources': [source_ref(p, docs, commit) for p in [GLOSSARY, COVERAGE]],
+            'verificationState': 'planned-only', 'records': list(mapping.values())}
+
+
+def classification_context(item, docs):
+    """An exact hash cannot turn a current rule into an unrelated exception kind."""
+    path, token, kind = item['path'], item['token'], item['kind']
+    require(path in docs, 'classification source missing: ' + path)
+    matching = [line for _, line in corpus.lines(docs[path]) if text_hash(line) == item['lineSha256']]
+    require(matching, 'classification line changed: ' + path)
+    if kind == 'standard-name':
+        valid = token in corpus.STANDARD
+    elif kind == 'reserved-allocation':
+        valid = (path == COVERAGE and re.fullmatch(r'I-\d{3}', token)
+                 and all(len(corpus.cells(line)) == 5 and f'`{token}`' in corpus.cells(line)[-1]
+                         for line in matching))
+    elif kind == 'historical-excerpt':
+        valid = path == 'docs/assurance/review-remediation-term-ledger.md'
+    elif kind == 'historical-review-finding':
+        valid = (path == 'docs/decisions/phase-2-specification-decisions.md'
+                 and re.fullmatch(r'IRF-\d{2}', token)
+                 and all(line in docs[path].split('## P2-013 ', 1)[-1].split('\n## ', 1)[0]
+                         for line in matching))
+    else:
+        valid = (path == 'docs/decisions/phase-1-foundation-decisions.md'
+                 and all(line.startswith('> ') for line in matching))
+    require(valid, f'invalid {kind} context: {path}: {token}')
+
+
+def classify(docs, report, register):
+    closed(register, 'schemaVersion license authority classifications', 'citation register')
+    require(type(register['schemaVersion']) is int and register['schemaVersion'] == 1
+            and register['license'] == 'AGPL-3.0-only', 'invalid citation register')
+    require(register['authority'] == 'docs/architecture/29-design-policy-export.md', 'invalid classification authority')
+    observed = Counter((p, text_hash(line), key) for p, _, key, _, line in report['raw'])
+    for p, text in docs.items():
+        for _, line in corpus.lines(text):
+            spans = [m.span() for m in corpus.LINK.finditer(line)] + [m.span() for m in corpus.ANCHOR.finditer(line)]
+            for match in corpus.ID.finditer(line):
+                if match[0] in corpus.STANDARD and not any(a <= match.start() < b for a, b in spans):
+                    observed[p, text_hash(line), match[0]] += 1
+    expected = {}
+    kinds = {'reserved-allocation', 'historical-excerpt', 'historical-review-finding', 'historical-quotation', 'standard-name'}
+    require(isinstance(register['classifications'], list), 'classification records must be an array')
+    for item in register['classifications']:
+        closed(item, 'path lineSha256 token occurrences kind reason reviewOwner reviewed', 'classification')
+        require(all(isinstance(item[k], str) and item[k].strip() for k in
+                    ('path', 'lineSha256', 'token', 'kind', 'reason', 'reviewOwner', 'reviewed')),
+                'invalid classification values')
+        require(re.fullmatch('[0-9a-f]{64}', item['lineSha256']), 'invalid classification line hash')
+        key = item['path'], item['lineSha256'], item['token']
+        require(key not in expected, 'duplicate occurrence classification')
+        require(item['kind'] in kinds and type(item['occurrences']) is int and item['occurrences'] > 0,
+                'invalid classification kind/count')
+        require(item['reason'].strip() and item['reviewOwner'].strip() and re.fullmatch(r'\d{4}-\d{2}-\d{2}', item['reviewed']),
+                'classification lacks review/rationale')
+        classification_context(item, docs)
+        expected[key] = item['occurrences']
+    require(observed == Counter(expected), 'unclassified citation or changed/unused occurrence classification: '
+            + repr(list((observed - Counter(expected)).keys())[:3]) + ' / '
+            + repr(list((Counter(expected) - observed).keys())[:3]))
+    return {'records': len(expected), 'occurrences': sum(observed.values()), 'items': register['classifications']}
+
+
+def verify(root, policy_root, *, refresh=False, preview=False):
+    pin = validate_pin(read_json(policy_root / 'design-source.json'))
+    before = state(root)
+    require(preview or (not before['status'] and before['commit'] == pin['commit']),
+            'immutable export requires the exact clean pinned Design commit')
+    docs = corpus.load(root)
+    register_text = corpus.read_document(root, CLASSIFICATIONS)
+    inputs = {GLOSSARY: text_hash(docs[GLOSSARY]), COVERAGE: text_hash(docs[COVERAGE]), CLASSIFICATIONS: text_hash(register_text)}
+    inventory = [{'path': p, 'sha256': text_hash(text)} for p, text in docs.items()]
+    digest = canonical_hash(inventory)
+    require(preview or (inputs == pin['sourceHashes'] and digest == pin['corpusSha256']), 'pinned Design source hashes differ')
+    report = corpus.audit(root, docs)
+    require(not report['errors'] and not report['missingAnchors'], 'corpus integrity failure: ' + repr((report['errors'] + report['missingAnchors'])[:5]))
+    classifications = classify(docs, report, json.loads(register_text, object_pairs_hook=unique_keys))
+    dependency = graph(root, docs)
+    require(not dependency['errors'], 'work-package graph failure: ' + repr(dependency['errors'][:5]))
+    vocabulary = glossary(docs, before['commit'])
+    mapping = invariants(root, docs, before['commit'], set(dependency['order']))
+    outputs = {'glossary-terms.json': encode(vocabulary), 'invariants.json': encode(mapping)}
+    require(state(root) == before, 'Design changed during verification')
+    if refresh:
+        require(not preview, 'preview cannot write immutable exports')
+        for name, data in outputs.items():
+            (policy_root / name).write_bytes(data)
+    elif not preview:
+        for name, data in outputs.items():
+            require((policy_root / name).is_file() and (policy_root / name).read_bytes() == data,
+                    f'export drift: {name}; regenerate only after reviewing the pinned source')
+    report.pop('raw')
+    return {'schemaVersion': 1, 'result': 'passed', 'mode': 'preview' if preview else 'immutable',
+            'source': {'repository': REPOSITORY, **before, 'corpusSha256': digest, 'sourceHashes': inputs},
+            'counts': {'terms': len(vocabulary['terms']), 'names': sum(len(x['names']) for x in vocabulary['terms']),
+                       'invariants': len(mapping['records']), 'forbiddenAliases': len(vocabulary['forbiddenAliases'])},
+            'outputs': {name: hashlib.sha256(data).hexdigest() for name, data in outputs.items()},
+            'forbiddenAliasesSha256': canonical_hash(vocabulary['forbiddenAliases']),
+            'corpus': report, 'classifications': classifications, 'graph': dependency,
+            'limitations': 'Policy and planned-verification data only; no implemented invariant or product readiness claim.'}
+
+
+def main():
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument('--design-root', type=Path, help='Read-only Git source; otherwise fetch the pinned public commit in isolation')
+    parser.add_argument('--policy-root', type=Path, default=POLICY)
+    mode = parser.add_mutually_exclusive_group()
+    mode.add_argument('--refresh', action='store_true', help='Write reviewed exports from the exact clean pin')
+    mode.add_argument('--preview', action='store_true', help='Check a proposed Design revision without updating or comparing exports')
+    parser.add_argument('--report', type=Path, default=ROOT / 'artifacts/evidence/design-policy.json')
+    args = parser.parse_args()
+    try:
+        if args.design_root:
+            report = verify(args.design_root.resolve(), args.policy_root, refresh=args.refresh, preview=args.preview)
+        else:
+            pin = validate_pin(read_json(args.policy_root / 'design-source.json'))
+            with checkout(pin) as root:
+                report = verify(root.resolve(), args.policy_root, refresh=args.refresh, preview=args.preview)
+        code = 0
+    except (ValueError, OSError, subprocess.CalledProcessError, KeyError, IndexError, TypeError) as error:
+        report = {'result': 'failed', 'error': str(error)}
+        code = 1
+    report['verifiedAt'] = datetime.now(timezone.utc).isoformat()
+    args.report.parent.mkdir(parents=True, exist_ok=True)
+    args.report.write_bytes(encode(report))
+    print(json.dumps({key: report[key] for key in ('result', 'counts', 'error') if key in report}))
+    return code
+
+
+if __name__ == '__main__':
+    sys.exit(main())
diff --git a/eng/policy/design-source.json b/eng/policy/design-source.json
new file mode 100644
index 0000000..928a479
--- /dev/null
+++ b/eng/policy/design-source.json
@@ -0,0 +1,12 @@
+{
+  "schemaVersion": 1,
+  "license": "AGPL-3.0-only",
+  "repository": "ArcForges/ArcForges-Design",
+  "commit": "1607374e81955f0a47f319cd6cc8ba1c6e254157",
+  "sourceHashes": {
+    "docs/requirements/01-normative-glossary-and-invariants.md": "fa60f160fe6c28685cd904f590f8d74ed1ead03295e4b9e42023f2a8f2b09a88",
+    "docs/assurance/invariant-coverage.md": "aa5880fc655e1e3da8f748f2c627d9c57ce1405c9b5fcb1ef7d3c2a6396e417a",
+    "docs/assurance/citation-classifications.json": "d12fbf63d0e0008e63df2fdc951a984179ff99a829c95f448174b31d2844820d"
+  },
+  "corpusSha256": "d37bea6dc9a4ff3ccaa5cc2596949337921aa054fe77c13d1e797c68c1138ca0"
+}
diff --git a/eng/policy/glossary-terms.json b/eng/policy/glossary-terms.json
new file mode 100644
index 0000000..556c567
--- /dev/null
+++ b/eng/policy/glossary-terms.json
@@ -0,0 +1,2074 @@
+{
+  "schemaVersion": 1,
+  "license": "AGPL-3.0-only",
+  "source": {
+    "repository": "ArcForges/ArcForges-Design",
+    "commit": "1607374e81955f0a47f319cd6cc8ba1c6e254157",
+    "path": "docs/requirements/01-normative-glossary-and-invariants.md",
+    "sha256": "fa60f160fe6c28685cd904f590f8d74ed1ead03295e4b9e42023f2a8f2b09a88"
+  },
+  "spaces": [
+    {
+      "name": "domain",
+      "label": "**Domain**",
+      "rule": "The product's own model. Never serialized directly; never a database row; never a view model."
+    },
+    {
+      "name": "wire",
+      "label": "**Wire**",
+      "rule": "Contract DTOs and identifiers. Never a domain entity; never persisted as-is as the canonical store."
+    },
+    {
+      "name": "UI",
+      "label": "**UI**",
+      "rule": "View state and presentation. Never a transport DTO; never a domain object."
+    },
+    {
+      "name": "storage",
+      "label": "**Storage**",
+      "rule": "Database schema, native file format, cache format. Distinct from both Domain and Wire."
+    },
+    {
+      "name": "commercial",
+      "label": "**Commercial**",
+      "rule": "Plan, Offer, Price, Entitlement, Credit, Ledger. Never a Feature Flag; never a Permission."
+    }
+  ],
+  "terms": [
+    {
+      "section": "1",
+      "line": 25,
+      "term": "**Realm**",
+      "names": [
+        "Realm"
+      ],
+      "namespace": "shared",
+      "spaces": [
+        "domain",
+        "wire"
+      ],
+      "status": "active",
+      "definition": "An independent deployment of ArcForges Cloud that is its own authority: the Official realm, or a self-hosted realm. Objects are never identical across realms even when the account email matches. Every cross-device and cross-application reference is realm-aware."
+    },
+    {
+      "section": "1",
+      "line": 26,
+      "term": "**User**",
+      "names": [
+        "User"
+      ],
+      "namespace": "shared",
+      "spaces": [
+        "domain",
+        "wire"
+      ],
+      "status": "active",
+      "definition": "A cloud account identity within a realm."
+    },
+    {
+      "section": "1",
+      "line": 27,
+      "term": "**Local Anonymous User**",
+      "names": [
+        "Local Anonymous User"
+      ],
+      "namespace": "shared",
+      "spaces": [
+        "domain"
+      ],
+      "status": "active",
+      "definition": "A signed-out native operator without a Cloud UserId. May use product-specific native functions; has no official AI access or account-free notebook service."
+    },
+    {
+      "section": "1",
+      "line": 28,
+      "term": "**Workspace**",
+      "names": [
+        "Workspace"
+      ],
+      "namespace": "shared",
+      "spaces": [
+        "domain",
+        "wire"
+      ],
+      "status": "active",
+      "definition": "A single-user Cloud data, device, sync, billing and permission boundary. One owner in a realm; never a team/member container or panel layout."
+    },
+    {
+      "section": "1",
+      "line": 29,
+      "term": "**Layout**",
+      "names": [
+        "Layout"
+      ],
+      "namespace": "shared",
+      "spaces": [
+        "UI"
+      ],
+      "status": "active",
+      "definition": "A desktop panel/window arrangement. The mandatory term for what some products elsewhere call a \"workspace\"."
+    },
+    {
+      "section": "1",
+      "line": 30,
+      "term": "**Organization**",
+      "names": [
+        "Organization"
+      ],
+      "namespace": "shared",
+      "spaces": [],
+      "status": "retired",
+      "definition": "Excluded by [P2-006](../decisions/phase-2-specification-decisions.md#rule-p2-006): no organization, team, membership, invitation or collaboration-specific schema reservation."
+    },
+    {
+      "section": "1",
+      "line": 31,
+      "term": "**Device**",
+      "names": [
+        "Device"
+      ],
+      "namespace": "shared",
+      "spaces": [
+        "domain",
+        "wire"
+      ],
+      "status": "active",
+      "definition": "A registered client machine or handset within a realm."
+    },
+    {
+      "section": "1",
+      "line": 32,
+      "term": "**Installation** / `InstallationId`",
+      "names": [
+        "Installation",
+        "InstallationId"
+      ],
+      "namespace": "shared",
+      "spaces": [
+        "domain"
+      ],
+      "status": "active",
+      "definition": "One installed copy of one product on one device. Long-lived."
+    },
+    {
+      "section": "1",
+      "line": 33,
+      "term": "**Instance** / `InstanceId`",
+      "names": [
+        "Instance",
+        "InstanceId"
+      ],
+      "namespace": "shared",
+      "spaces": [
+        "domain",
+        "wire"
+      ],
+      "status": "active",
+      "definition": "One running process of one product. Per-launch."
+    },
+    {
+      "section": "1",
+      "line": 34,
+      "term": "**App** / `AppId`, `ProductId`",
+      "names": [
+        "App",
+        "AppId",
+        "ProductId"
+      ],
+      "namespace": "shared",
+      "spaces": [
+        "domain",
+        "wire"
+      ],
+      "status": "active",
+      "definition": "The stable product identity: `arcnotes`, `arcscope`, `arcslate`, `companion`. Never a process id, never a product-scope, never a licence unit."
+    },
+    {
+      "section": "1",
+      "line": 35,
+      "term": "**Window**",
+      "names": [
+        "Window"
+      ],
+      "namespace": "shared",
+      "spaces": [
+        "UI"
+      ],
+      "status": "active",
+      "definition": "An OS window belonging to an Instance. An Instance may own several."
+    },
+    {
+      "section": "1",
+      "line": 36,
+      "term": "**Session**",
+      "names": [
+        "Session"
+      ],
+      "namespace": "shared",
+      "spaces": [
+        "domain",
+        "wire"
+      ],
+      "status": "active",
+      "definition": "An authenticated interaction lifetime. Distinct from Connection, from Device and from Subscription."
+    },
+    {
+      "section": "1",
+      "line": 37,
+      "term": "**Connection**",
+      "names": [
+        "Connection"
+      ],
+      "namespace": "shared",
+      "spaces": [
+        "wire"
+      ],
+      "status": "active",
+      "definition": "A transport-level link (Named Pipe/UDS stream, HTTP connection, realtime connection). Carries no identity of its own."
+    },
+    {
+      "section": "1",
+      "line": 38,
+      "term": "**Identity**",
+      "names": [
+        "Identity"
+      ],
+      "namespace": "shared",
+      "spaces": [
+        "domain"
+      ],
+      "status": "active",
+      "definition": "Who a principal is."
+    },
+    {
+      "section": "1",
+      "line": 39,
+      "term": "**Actor**",
+      "names": [
+        "Actor"
+      ],
+      "namespace": "shared",
+      "spaces": [
+        "domain",
+        "wire"
+      ],
+      "status": "active",
+      "definition": "On whose authority an operation runs."
+    },
+    {
+      "section": "1",
+      "line": 40,
+      "term": "**Executor**",
+      "names": [
+        "Executor"
+      ],
+      "namespace": "shared",
+      "spaces": [
+        "domain"
+      ],
+      "status": "active",
+      "definition": "What actually performs an operation."
+    },
+    {
+      "section": "1",
+      "line": 41,
+      "term": "**Caller Instance** / **Caller Process**",
+      "names": [
+        "Caller Instance",
+        "Caller Process"
+      ],
+      "namespace": "shared",
+      "spaces": [
+        "wire"
+      ],
+      "status": "active",
+      "definition": "Which process issued a call. Never a substitute for Actor."
+    },
+    {
+      "section": "1",
+      "line": 42,
+      "term": "**Principal**",
+      "names": [
+        "Principal"
+      ],
+      "namespace": "shared",
+      "spaces": [
+        "domain"
+      ],
+      "status": "active",
+      "definition": "A security subject that may hold permissions: a human User, or a scoped delegate."
+    },
+    {
+      "section": "1",
+      "line": 43,
+      "term": "**Agent Actor**",
+      "names": [
+        "Agent Actor"
+      ],
+      "namespace": "shared",
+      "spaces": [
+        "domain"
+      ],
+      "status": "active",
+      "definition": "An agent acting on behalf of a user session. Never an independent superuser identity, never a security principal in its own right."
+    },
+    {
+      "section": "1",
+      "line": 44,
+      "term": "**Local OS User**",
+      "names": [
+        "Local OS User"
+      ],
+      "namespace": "shared",
+      "spaces": [
+        "domain"
+      ],
+      "status": "active",
+      "definition": "The operating-system account that owns local IPC endpoints and secure storage."
+    },
+    {
+      "section": "2",
+      "line": 52,
+      "term": "**Resource**",
+      "names": [
+        "Resource"
+      ],
+      "namespace": "shared",
+      "spaces": [
+        "domain",
+        "wire"
+      ],
+      "status": "active",
+      "definition": "A durable business object owned by exactly one product in exactly one realm."
+    },
+    {
+      "section": "2",
+      "line": 53,
+      "term": "**ResourceRef**",
+      "names": [
+        "ResourceRef"
+      ],
+      "namespace": "shared",
+      "spaces": [
+        "wire"
+      ],
+      "status": "active",
+      "definition": "A stable, realm-aware, typed reference to a Resource: identity plus metadata. Never resource content, never a file path, never a capability token, never a permission token, never a universal domain entity, never a selection."
+    },
+    {
+      "section": "2",
+      "line": 54,
+      "term": "**ResourceId**",
+      "names": [
+        "ResourceId"
+      ],
+      "namespace": "shared",
+      "spaces": [
+        "domain",
+        "wire"
+      ],
+      "status": "active",
+      "definition": "The stable identifier inside a ResourceRef. Never reused."
+    },
+    {
+      "section": "2",
+      "line": 55,
+      "term": "**ResourceKind**",
+      "names": [
+        "ResourceKind"
+      ],
+      "namespace": "shared",
+      "spaces": [
+        "wire"
+      ],
+      "status": "active",
+      "definition": "The namespaced type of a Resource, e.g. `arcnotes.document`, `arcscope.session`, `arcslate.project`."
+    },
+    {
+      "section": "2",
+      "line": 56,
+      "term": "**External Locator**",
+      "names": [
+        "External Locator"
+      ],
+      "namespace": "shared",
+      "spaces": [
+        "storage"
+      ],
+      "status": "active",
+      "definition": "A path, URI or device address by which external content is reached. Never a Resource Identity."
+    },
+    {
+      "section": "2",
+      "line": 57,
+      "term": "**Managed Asset**",
+      "names": [
+        "Managed Asset"
+      ],
+      "namespace": "shared",
+      "spaces": [
+        "storage"
+      ],
+      "status": "active",
+      "definition": "Content whose bytes ArcForges owns and garbage-collects."
+    },
+    {
+      "section": "2",
+      "line": 58,
+      "term": "**External Reference**",
+      "names": [
+        "External Reference"
+      ],
+      "namespace": "shared",
+      "spaces": [
+        "storage"
+      ],
+      "status": "active",
+      "definition": "Content that remains under the user's own control, referenced but not owned."
+    },
+    {
+      "section": "2",
+      "line": 59,
+      "term": "**Artifact**",
+      "names": [
+        "Artifact"
+      ],
+      "namespace": "shared",
+      "spaces": [
+        "domain",
+        "wire"
+      ],
+      "status": "active",
+      "definition": "A meaningful work result produced by a Task, Agent or App — a document, report, session, rendered video, project or ordinary file. Never \"an ArcChat file\"."
+    },
+    {
+      "section": "2",
+      "line": 60,
+      "term": "**ArtifactRef**",
+      "names": [
+        "ArtifactRef"
+      ],
+      "namespace": "shared",
+      "spaces": [
+        "wire"
+      ],
+      "status": "active",
+      "definition": "A reference to an Artifact, carrying provenance and task relationship. Distinct from `ResourceRef`. Never a permission token."
+    },
+    {
+      "section": "2",
+      "line": 61,
+      "term": "**Artifact Preview**",
+      "names": [
+        "Artifact Preview"
+      ],
+      "namespace": "shared",
+      "spaces": [
+        "UI"
+      ],
+      "status": "active",
+      "definition": "A rendered or summarised view of an Artifact. Never the Artifact's authority."
+    },
+    {
+      "section": "2",
+      "line": 62,
+      "term": "**Deep Link**",
+      "names": [
+        "Deep Link"
+      ],
+      "namespace": "shared",
+      "spaces": [
+        "wire",
+        "UI"
+      ],
+      "status": "active",
+      "definition": "A user-directed navigation address into a product surface. Never a command. Never a permission token."
+    },
+    {
+      "section": "2",
+      "line": 63,
+      "term": "**Provenance**",
+      "names": [
+        "Provenance"
+      ],
+      "namespace": "shared",
+      "spaces": [
+        "domain"
+      ],
+      "status": "active",
+      "definition": "The recorded origin of a derived object: source resource, task, actor, revision."
+    },
+    {
+      "section": "3",
+      "line": 71,
+      "term": "**Capability**",
+      "names": [
+        "Capability"
+      ],
+      "namespace": "shared",
+      "spaces": [
+        "domain",
+        "wire"
+      ],
+      "status": "active",
+      "definition": "A semantic, versioned, strongly typed operation a product exposes to the platform. Identified by a `capabilityId` string used only for discovery, display, policy, tool selection, routing and audit — never as the call mechanism."
+    },
+    {
+      "section": "3",
+      "line": 72,
+      "term": "**CapabilityDescriptor**",
+      "names": [
+        "CapabilityDescriptor"
+      ],
+      "namespace": "shared",
+      "spaces": [
+        "wire"
+      ],
+      "status": "active",
+      "definition": "The declared metadata of a Capability: identity, provider app/instance, typed method identity, contract version and feature flags, input/output summary, whether it writes state, required scope, risk level, whether confirmation is mandatory, dry-run/undo/cancel support, resource size, expected duration and concurrency limits."
+    },
+    {
+      "section": "3",
+      "line": 73,
+      "term": "**Action**",
+      "names": [
+        "Action"
+      ],
+      "namespace": "shared",
+      "spaces": [
+        "domain"
+      ],
+      "status": "active",
+      "definition": "A user- or agent-visible intent that may be fulfilled by one or more Capability invocations. Not itself a Capability."
+    },
+    {
+      "section": "3",
+      "line": 74,
+      "term": "**UI Command**",
+      "names": [
+        "UI Command"
+      ],
+      "namespace": "shared",
+      "spaces": [
+        "UI"
+      ],
+      "status": "active",
+      "definition": "A menu item, button or shortcut. Never a Capability."
+    },
+    {
+      "section": "3",
+      "line": 75,
+      "term": "**Invocation** / `InvocationId`",
+      "names": [
+        "Invocation",
+        "InvocationId"
+      ],
+      "namespace": "shared",
+      "spaces": [
+        "wire"
+      ],
+      "status": "active",
+      "definition": "One call of one Capability. Distinct from `CommandId`, and distinct from a Task Step."
+    },
+    {
+      "section": "3",
+      "line": 76,
+      "term": "**CommandId**",
+      "names": [
+        "CommandId"
+      ],
+      "namespace": "shared",
+      "spaces": [
+        "wire",
+        "storage"
+      ],
+      "status": "active",
+      "definition": "The idempotency key of a write command. Distinct from `InvocationId` and from `AttemptId`."
+    },
+    {
+      "section": "3",
+      "line": 77,
+      "term": "**Context**",
+      "names": [
+        "Context"
+      ],
+      "namespace": "shared",
+      "spaces": [
+        "domain",
+        "wire"
+      ],
+      "status": "active",
+      "definition": "What the caller is currently working on. References Resources; is not itself a Resource."
+    },
+    {
+      "section": "3",
+      "line": 78,
+      "term": "**Context Provider**",
+      "names": [
+        "Context Provider"
+      ],
+      "namespace": "shared",
+      "spaces": [
+        "domain"
+      ],
+      "status": "active",
+      "definition": "A product-side component that answers \"what is the user looking at / has selected\". Not a search engine, not a resource database."
+    },
+    {
+      "section": "3",
+      "line": 79,
+      "term": "**Context Pack**",
+      "names": [
+        "Context Pack"
+      ],
+      "namespace": "shared",
+      "spaces": [
+        "wire"
+      ],
+      "status": "active",
+      "definition": "A bounded, frozen set of context handed to a run. Never an entire knowledge source, never a copy of all data."
+    },
+    {
+      "section": "3",
+      "line": 80,
+      "term": "**Current Selection**",
+      "names": [
+        "Current Selection"
+      ],
+      "namespace": "shared",
+      "spaces": [
+        "UI"
+      ],
+      "status": "active",
+      "definition": "Volatile UI state. Never a durable resource identity."
+    },
+    {
+      "section": "3",
+      "line": 81,
+      "term": "**Capability Token**",
+      "names": [
+        "Capability Token"
+      ],
+      "namespace": "shared",
+      "spaces": [
+        "wire"
+      ],
+      "status": "active",
+      "definition": "A short-lived, narrowly scoped credential authorising one controlled access. Distinct from `ResourceRef`."
+    },
+    {
+      "section": "3",
+      "line": 82,
+      "term": "**Semantic Contract**",
+      "names": [
+        "Semantic Contract"
+      ],
+      "namespace": "shared",
+      "spaces": [
+        "domain"
+      ],
+      "status": "active",
+      "definition": "The meaning and obligations of a Capability."
+    },
+    {
+      "section": "3",
+      "line": 83,
+      "term": "**Wire Contract**",
+      "names": [
+        "Wire Contract"
+      ],
+      "namespace": "shared",
+      "spaces": [
+        "wire"
+      ],
+      "status": "active",
+      "definition": "The serialized shape by which a Capability is called. Distinct from the Semantic Contract."
+    },
+    {
+      "section": "4",
+      "line": 93,
+      "term": "**Intent**",
+      "names": [
+        "Intent"
+      ],
+      "namespace": "shared",
+      "spaces": [
+        "domain"
+      ],
+      "status": "active",
+      "definition": "What the user asked for, before any plan exists."
+    },
+    {
+      "section": "4",
+      "line": 94,
+      "term": "**Task**",
+      "names": [
+        "Task"
+      ],
+      "namespace": "shared",
+      "spaces": [
+        "domain",
+        "wire"
+      ],
+      "status": "active",
+      "definition": "Durable Cloud agent work with a lifecycle and persistent record. Ordinary render, capture, import or simulation jobs are not agent Tasks."
+    },
+    {
+      "section": "4",
+      "line": 95,
+      "term": "**Run**",
+      "names": [
+        "Run"
+      ],
+      "namespace": "shared",
+      "spaces": [
+        "domain",
+        "wire"
+      ],
+      "status": "active",
+      "definition": "One execution of a Task. A Task may have several Runs."
+    },
+    {
+      "section": "4",
+      "line": 96,
+      "term": "**Step**",
+      "names": [
+        "Step"
+      ],
+      "namespace": "shared",
+      "spaces": [
+        "domain",
+        "wire"
+      ],
+      "status": "active",
+      "definition": "One planned unit inside a Run."
+    },
+    {
+      "section": "4",
+      "line": 97,
+      "term": "**Attempt** / `AttemptId`",
+      "names": [
+        "Attempt",
+        "AttemptId"
+      ],
+      "namespace": "shared",
+      "spaces": [
+        "domain",
+        "wire"
+      ],
+      "status": "active",
+      "definition": "One execution try of a Step. Distinct from `CommandId`."
+    },
+    {
+      "section": "4",
+      "line": 98,
+      "term": "**Task Owner**",
+      "names": [
+        "Task Owner"
+      ],
+      "namespace": "shared",
+      "spaces": [
+        "domain"
+      ],
+      "status": "active",
+      "definition": "The Cloud agent module holding authoritative Task/Run/Step/Attempt state. A desktop tool owner is not a Task Owner."
+    },
+    {
+      "section": "4",
+      "line": 99,
+      "term": "**Orchestrator**",
+      "names": [
+        "Orchestrator"
+      ],
+      "namespace": "shared",
+      "spaces": [
+        "domain"
+      ],
+      "status": "active",
+      "definition": "The single Cloud harness sequencing agent work and authorized tools. Each application's assistant presents its tasks and bridges only its own local tools; it does not run another orchestrator."
+    },
+    {
+      "section": "4",
+      "line": 100,
+      "term": "**Execution Location**",
+      "names": [
+        "Execution Location"
+      ],
+      "namespace": "shared",
+      "spaces": [
+        "domain"
+      ],
+      "status": "active",
+      "definition": "Cloud for the AI runtime. Desktop/Cloud/Hybrid labels on a task describe tool locality only; they never select another model loop."
+    },
+    {
+      "section": "4",
+      "line": 101,
+      "term": "**TaskHandle**",
+      "names": [
+        "TaskHandle"
+      ],
+      "namespace": "shared",
+      "spaces": [
+        "wire"
+      ],
+      "status": "active",
+      "definition": "A stable Cloud Agent Task reference for query/correlation, never an RPC connection or product job identity."
+    },
+    {
+      "section": "4",
+      "line": 102,
+      "term": "**TaskSnapshot**",
+      "names": [
+        "TaskSnapshot"
+      ],
+      "namespace": "shared",
+      "spaces": [
+        "wire"
+      ],
+      "status": "active",
+      "definition": "An authoritative point-in-time projection of Task state, retrievable over HTTP."
+    },
+    {
+      "section": "4",
+      "line": 103,
+      "term": "**Progress Event**",
+      "names": [
+        "Progress Event"
+      ],
+      "namespace": "shared",
+      "spaces": [
+        "wire"
+      ],
+      "status": "active",
+      "definition": "A best-effort realtime notification. Never task authority."
+    },
+    {
+      "section": "4",
+      "line": 104,
+      "term": "**Checkpoint**",
+      "names": [
+        "Checkpoint"
+      ],
+      "namespace": "shared",
+      "spaces": [
+        "domain",
+        "storage"
+      ],
+      "status": "active",
+      "definition": "A resumable execution marker inside a Run. Never an Undo entry; never a Recovery Journal."
+    },
+    {
+      "section": "4",
+      "line": 105,
+      "term": "**Compensation**",
+      "names": [
+        "Compensation"
+      ],
+      "namespace": "shared",
+      "spaces": [
+        "domain"
+      ],
+      "status": "active",
+      "definition": "A forward action that reverses the observable effect of a completed step. Never a transaction rollback."
+    },
+    {
+      "section": "4",
+      "line": 106,
+      "term": "**Approval**",
+      "names": [
+        "Approval"
+      ],
+      "namespace": "shared",
+      "spaces": [
+        "domain",
+        "wire"
+      ],
+      "status": "active",
+      "definition": "A bounded, parameter-bound, time-limited human authorisation of a specific pending operation. Never a persistent permission grant, never step-up authentication, never steering."
+    },
+    {
+      "section": "4",
+      "line": 107,
+      "term": "**Steering**",
+      "names": [
+        "Steering"
+      ],
+      "namespace": "shared",
+      "spaces": [
+        "domain",
+        "wire"
+      ],
+      "status": "active",
+      "definition": "A user's execution-direction update to an active Task. Never an approval, never an ordinary conversation message."
+    },
+    {
+      "section": "4",
+      "line": 108,
+      "term": "**Needs Attention**",
+      "names": [
+        "Needs Attention"
+      ],
+      "namespace": "shared",
+      "spaces": [
+        "UI"
+      ],
+      "status": "active",
+      "definition": "A derived presentation flag over one or more pending Approvals or errors. Never a Task state."
+    },
+    {
+      "section": "4",
+      "line": 109,
+      "term": "**Budget**",
+      "names": [
+        "Budget"
+      ],
+      "namespace": "shared",
+      "spaces": [
+        "domain"
+      ],
+      "status": "active",
+      "definition": "A per-task or per-automation ceiling on cost, credits, time or steps. Never an Entitlement."
+    },
+    {
+      "section": "4",
+      "line": 110,
+      "term": "**Automation**",
+      "names": [
+        "Automation"
+      ],
+      "namespace": "shared",
+      "spaces": [
+        "domain"
+      ],
+      "status": "active",
+      "definition": "A durable definition that creates Tasks when a Trigger fires. Never itself a Task."
+    },
+    {
+      "section": "4",
+      "line": 111,
+      "term": "**Automation Occurrence**",
+      "names": [
+        "Automation Occurrence"
+      ],
+      "namespace": "shared",
+      "spaces": [
+        "domain"
+      ],
+      "status": "active",
+      "definition": "One firing of an Automation. Never a Task retry."
+    },
+    {
+      "section": "4",
+      "line": 112,
+      "term": "**Trigger Definition**",
+      "names": [
+        "Trigger Definition"
+      ],
+      "namespace": "shared",
+      "spaces": [
+        "domain"
+      ],
+      "status": "active",
+      "definition": "The configured rule."
+    },
+    {
+      "section": "4",
+      "line": 113,
+      "term": "**Trigger Occurrence**",
+      "names": [
+        "Trigger Occurrence"
+      ],
+      "namespace": "shared",
+      "spaces": [
+        "domain"
+      ],
+      "status": "active",
+      "definition": "One event matching the rule."
+    },
+    {
+      "section": "4",
+      "line": 114,
+      "term": "**Operational Trace**",
+      "names": [
+        "Operational Trace"
+      ],
+      "namespace": "shared",
+      "spaces": [
+        "domain"
+      ],
+      "status": "active",
+      "definition": "The recorded sequence of steps, invocations, decisions and results for a Run, safe to show. Never model chain-of-thought; never an Audit record."
+    },
+    {
+      "section": "4.1",
+      "line": 120,
+      "term": "**Product Job / Activity**",
+      "names": [
+        "Product Job",
+        "Activity"
+      ],
+      "namespace": "shared",
+      "spaces": [
+        "domain",
+        "UI"
+      ],
+      "status": "active",
+      "definition": "Bounded non-agent work owned by a product or Cloud module: capture, render, import, indexing, simulation. It has its own progress/cancel/recovery contract, never a second model loop."
+    },
+    {
+      "section": "4.1",
+      "line": 121,
+      "term": "**ProductJobHandle**",
+      "names": [
+        "ProductJobHandle"
+      ],
+      "namespace": "shared",
+      "spaces": [
+        "wire"
+      ],
+      "status": "active",
+      "definition": "Typed, owner-qualified reference to a product job that a Cloud Task may observe through tools. Not a TaskHandle."
+    },
+    {
+      "section": "4.1",
+      "line": 122,
+      "term": "**Measured Usage**",
+      "names": [
+        "Measured Usage"
+      ],
+      "namespace": "shared",
+      "spaces": [
+        "domain",
+        "storage"
+      ],
+      "status": "active",
+      "definition": "Normalized actual provider usage per attempt/category, with provenance and settled/unknown status; not a prompt-size estimate."
+    },
+    {
+      "section": "4.1",
+      "line": 123,
+      "term": "**Supplier Cost**",
+      "names": [
+        "Supplier Cost"
+      ],
+      "namespace": "shared",
+      "spaces": [
+        "commercial"
+      ],
+      "status": "active",
+      "definition": "Actual billable provider units multiplied by the applicable supplier-rate snapshot, independently reconciled against provider charges."
+    },
+    {
+      "section": "4.1",
+      "line": 124,
+      "term": "**Customer Tariff**",
+      "names": [
+        "Customer Tariff"
+      ],
+      "namespace": "shared",
+      "spaces": [
+        "commercial"
+      ],
+      "status": "active",
+      "definition": "Versioned rates converting eligible usage to customer service units; distinct from supplier cost and payment price."
+    },
+    {
+      "section": "4.1",
+      "line": 125,
+      "term": "**Included Capacity**",
+      "names": [
+        "Included Capacity"
+      ],
+      "namespace": "shared",
+      "spaces": [
+        "commercial"
+      ],
+      "status": "active",
+      "definition": "A bounded recoverable service-unit balance replenishing during eligible service time. Not a monthly cash or purchased-credit lot."
+    },
+    {
+      "section": "4.1",
+      "line": 126,
+      "term": "**Additional Credits**",
+      "names": [
+        "Additional Credits"
+      ],
+      "namespace": "shared",
+      "spaces": [
+        "commercial"
+      ],
+      "status": "active",
+      "definition": "Separate purchased/compensation lots consumed only with explicit consent and an eligible service term. Credit ownership alone grants no official AI access."
+    },
+    {
+      "section": "4.1",
+      "line": 127,
+      "term": "**Policy Publication**",
+      "names": [
+        "Policy Publication"
+      ],
+      "namespace": "shared",
+      "spaces": [
+        "storage"
+      ],
+      "status": "active",
+      "definition": "One validated, immutable version/hash of operator deployment configuration, archived for audit; not a mutable rewrite of historical usage or paid grants."
+    },
+    {
+      "section": "5.1",
+      "line": 145,
+      "term": "`ArcChat.Conversation`",
+      "names": [
+        "ArcChat.Conversation"
+      ],
+      "namespace": "ArcChat",
+      "spaces": [
+        "domain"
+      ],
+      "status": "active",
+      "definition": "An ordered thread of Messages. Not a Task."
+    },
+    {
+      "section": "5.1",
+      "line": 146,
+      "term": "`ArcChat.Message`",
+      "names": [
+        "ArcChat.Message"
+      ],
+      "namespace": "ArcChat",
+      "spaces": [
+        "domain"
+      ],
+      "status": "active",
+      "definition": "One turn in a Conversation. Not a Tool Call."
+    },
+    {
+      "section": "5.1",
+      "line": 147,
+      "term": "`ArcChat.Project`",
+      "names": [
+        "ArcChat.Project"
+      ],
+      "namespace": "ArcChat",
+      "spaces": [
+        "domain"
+      ],
+      "status": "active",
+      "definition": "An ArcChat-scoped grouping of conversations, context references and settings. **Not** a Workspace, **not** an `ArcScope.Project`, **not** an `ArcSlate.Project`."
+    },
+    {
+      "section": "5.1",
+      "line": 148,
+      "term": "`ArcForges.Assistant.CloudProfile`",
+      "names": [
+        "ArcForges.Assistant.CloudProfile"
+      ],
+      "namespace": "ArcForges.Assistant",
+      "spaces": [
+        "domain"
+      ],
+      "status": "active",
+      "definition": "A saved configuration of model, tools, instructions and limits. Not a running agent; not a model; not a security principal."
+    },
+    {
+      "section": "5.1",
+      "line": 149,
+      "term": "`ArcChat.Skill`",
+      "names": [
+        "ArcChat.Skill"
+      ],
+      "namespace": "ArcChat",
+      "spaces": [
+        "domain"
+      ],
+      "status": "active",
+      "definition": "Reusable guidance and configuration that shapes agent behaviour. Not a Capability; not extension code; not MCP; not a permission grant."
+    },
+    {
+      "section": "5.1",
+      "line": 150,
+      "term": "`ArcChat.PersonalMemory`",
+      "names": [
+        "ArcChat.PersonalMemory"
+      ],
+      "namespace": "ArcChat",
+      "spaces": [
+        "domain"
+      ],
+      "status": "active",
+      "definition": "ArcChat-owned durable user-preference recall. Not ArcNotes knowledge; not a conversation summary."
+    },
+    {
+      "section": "5.1",
+      "line": 151,
+      "term": "`ArcForges.Capabilities`",
+      "names": [
+        "ArcForges.Capabilities"
+      ],
+      "namespace": "ArcForges",
+      "spaces": [
+        "domain"
+      ],
+      "status": "active",
+      "definition": "The local platform coordination plane hosted inside the owning professional application process."
+    },
+    {
+      "section": "5.1",
+      "line": 152,
+      "term": "`ArcChat.Artifact`",
+      "names": [
+        "ArcChat.Artifact"
+      ],
+      "namespace": "ArcChat",
+      "spaces": [
+        "domain"
+      ],
+      "status": "active",
+      "definition": "An `ArtifactRef` held by ArcChat. Never the underlying owned object."
+    },
+    {
+      "section": "5.2",
+      "line": 160,
+      "term": "`ArcNotes.Notebook`",
+      "names": [
+        "ArcNotes.Notebook"
+      ],
+      "namespace": "ArcNotes",
+      "spaces": [
+        "domain"
+      ],
+      "status": "active",
+      "definition": "The top-level ArcNotes container. **Not** a Workspace."
+    },
+    {
+      "section": "5.2",
+      "line": 161,
+      "term": "`ArcNotes.Folder`",
+      "names": [
+        "ArcNotes.Folder"
+      ],
+      "namespace": "ArcNotes",
+      "spaces": [
+        "domain"
+      ],
+      "status": "active",
+      "definition": "A hierarchical container. **Not** a Tag."
+    },
+    {
+      "section": "5.2",
+      "line": 162,
+      "term": "`ArcNotes.Document`",
+      "names": [
+        "ArcNotes.Document"
+      ],
+      "namespace": "ArcNotes",
+      "spaces": [
+        "domain"
+      ],
+      "status": "active",
+      "definition": "The canonical document object. **Not** a file; **not** a Markdown file."
+    },
+    {
+      "section": "5.2",
+      "line": 163,
+      "term": "`ArcNotes.Block`",
+      "names": [
+        "ArcNotes.Block"
+      ],
+      "namespace": "ArcNotes",
+      "spaces": [
+        "domain"
+      ],
+      "status": "active",
+      "definition": "The addressable unit inside a Document, with a stable `BlockId`. **Not** a Markdown line."
+    },
+    {
+      "section": "5.2",
+      "line": 164,
+      "term": "`ArcNotes.Property`",
+      "names": [
+        "ArcNotes.Property"
+      ],
+      "namespace": "ArcNotes",
+      "spaces": [
+        "domain"
+      ],
+      "status": "active",
+      "definition": "Typed metadata on a Document or Block. **Not** document content."
+    },
+    {
+      "section": "5.2",
+      "line": 165,
+      "term": "`ArcNotes.Tag`",
+      "names": [
+        "ArcNotes.Tag"
+      ],
+      "namespace": "ArcNotes",
+      "spaces": [
+        "domain"
+      ],
+      "status": "active",
+      "definition": "A non-hierarchical label."
+    },
+    {
+      "section": "5.2",
+      "line": 166,
+      "term": "`ArcNotes.SavedView`",
+      "names": [
+        "ArcNotes.SavedView"
+      ],
+      "namespace": "ArcNotes",
+      "spaces": [
+        "domain"
+      ],
+      "status": "active",
+      "definition": "A stored query and presentation over typed properties. Confers **no ownership** of the objects it lists."
+    },
+    {
+      "section": "5.2",
+      "line": 167,
+      "term": "`ArcNotes.Attachment`",
+      "names": [
+        "ArcNotes.Attachment"
+      ],
+      "namespace": "ArcNotes",
+      "spaces": [
+        "domain"
+      ],
+      "status": "active",
+      "definition": "A referenced binary managed by ArcNotes. Never base64 embedded in canonical content."
+    },
+    {
+      "section": "5.2",
+      "line": 168,
+      "term": "`ArcNotes.Canvas` (Edgeless)",
+      "names": [
+        "ArcNotes.Canvas"
+      ],
+      "namespace": "ArcNotes",
+      "spaces": [],
+      "status": "retired",
+      "definition": "Retired by [P2-006](../decisions/phase-2-specification-decisions.md#rule-p2-006). Edgeless, whiteboard, shape/connector/frame workspaces are excluded."
+    },
+    {
+      "section": "5.2",
+      "line": 169,
+      "term": "`ArcNotes.Database`",
+      "names": [
+        "ArcNotes.Database"
+      ],
+      "namespace": "ArcNotes",
+      "spaces": [
+        "domain"
+      ],
+      "status": "active",
+      "definition": "Bounded note organization through scalar properties, queries and table/list Saved Views; not the SQLite/D1 storage schema or a formula/relation/rollup platform."
+    },
+    {
+      "section": "5.2",
+      "line": 170,
+      "term": "`ArcNotes.Slides`",
+      "names": [
+        "ArcNotes.Slides"
+      ],
+      "namespace": "ArcNotes",
+      "spaces": [],
+      "status": "retired",
+      "definition": "Retired by [P2-006](../decisions/phase-2-specification-decisions.md#rule-p2-006). Presentations, slide generation, frame ordering and presentation navigation are excluded."
+    },
+    {
+      "section": "5.2",
+      "line": 171,
+      "term": "`ArcNotes.ChecklistItem`",
+      "names": [
+        "ArcNotes.ChecklistItem"
+      ],
+      "namespace": "ArcNotes",
+      "spaces": [
+        "domain"
+      ],
+      "status": "active",
+      "definition": "A document-local task item. **Not** an ArcChat Agent Task."
+    },
+    {
+      "section": "5.3",
+      "line": 177,
+      "term": "`ArcScope.Project`",
+      "names": [
+        "ArcScope.Project"
+      ],
+      "namespace": "ArcScope",
+      "spaces": [
+        "domain"
+      ],
+      "status": "active",
+      "definition": "An ArcScope-scoped container of sources, sessions and analyses. **Not** an ArcForges Workspace."
+    },
+    {
+      "section": "5.3",
+      "line": 178,
+      "term": "`ArcScope.Device`",
+      "names": [
+        "ArcScope.Device"
+      ],
+      "namespace": "ArcScope",
+      "spaces": [
+        "domain"
+      ],
+      "status": "active",
+      "definition": "Physical or logical hardware. **Not** a DataSource."
+    },
+    {
+      "section": "5.3",
+      "line": 179,
+      "term": "`ArcScope.DataSource`",
+      "names": [
+        "ArcScope.DataSource"
+      ],
+      "namespace": "ArcScope",
+      "spaces": [
+        "domain"
+      ],
+      "status": "active",
+      "definition": "A configured source definition."
+    },
+    {
+      "section": "5.3",
+      "line": 180,
+      "term": "`ArcScope.ConnectionProfile`",
+      "names": [
+        "ArcScope.ConnectionProfile"
+      ],
+      "namespace": "ArcScope",
+      "spaces": [
+        "domain"
+      ],
+      "status": "active",
+      "definition": "Stored connection settings. **Not** a live Connection."
+    },
+    {
+      "section": "5.3",
+      "line": 181,
+      "term": "`ArcScope.Session`",
+      "names": [
+        "ArcScope.Session"
+      ],
+      "namespace": "ArcScope",
+      "spaces": [
+        "domain"
+      ],
+      "status": "active",
+      "definition": "An observation lifetime. **Not** a Connection; **not** a Capture."
+    },
+    {
+      "section": "5.3",
+      "line": 182,
+      "term": "`ArcScope.Capture`",
+      "names": [
+        "ArcScope.Capture"
+      ],
+      "namespace": "ArcScope",
+      "spaces": [
+        "domain"
+      ],
+      "status": "active",
+      "definition": "A recorded data acquisition within a Session."
+    },
+    {
+      "section": "5.3",
+      "line": 183,
+      "term": "`ArcScope.Channel`",
+      "names": [
+        "ArcScope.Channel"
+      ],
+      "namespace": "ArcScope",
+      "spaces": [
+        "domain"
+      ],
+      "status": "active",
+      "definition": "A transport-level stream of values. **Not** a Signal."
+    },
+    {
+      "section": "5.3",
+      "line": 184,
+      "term": "`ArcScope.Signal`",
+      "names": [
+        "ArcScope.Signal"
+      ],
+      "namespace": "ArcScope",
+      "spaces": [
+        "domain"
+      ],
+      "status": "active",
+      "definition": "A semantically typed, named quantity. **Not** an Event."
+    },
+    {
+      "section": "5.3",
+      "line": 185,
+      "term": "`ArcScope.Event`",
+      "names": [
+        "ArcScope.Event"
+      ],
+      "namespace": "ArcScope",
+      "spaces": [
+        "domain"
+      ],
+      "status": "active",
+      "definition": "A discrete occurrence in time."
+    },
+    {
+      "section": "5.3",
+      "line": 186,
+      "term": "`ArcScope.RawSignal` / `ArcScope.DerivedSignal`",
+      "names": [
+        "ArcScope.RawSignal",
+        "ArcScope.DerivedSignal"
+      ],
+      "namespace": "ArcScope",
+      "spaces": [
+        "domain"
+      ],
+      "status": "active",
+      "definition": "Acquired versus computed. Never conflated."
+    },
+    {
+      "section": "5.3",
+      "line": 187,
+      "term": "`ArcScope.Measurement`",
+      "names": [
+        "ArcScope.Measurement"
+      ],
+      "namespace": "ArcScope",
+      "spaces": [
+        "domain"
+      ],
+      "status": "active",
+      "definition": "A quantified reading with units and uncertainty. **Not** an Analysis."
+    },
+    {
+      "section": "5.3",
+      "line": 188,
+      "term": "`ArcScope.Analysis`",
+      "names": [
+        "ArcScope.Analysis"
+      ],
+      "namespace": "ArcScope",
+      "spaces": [
+        "domain"
+      ],
+      "status": "active",
+      "definition": "An interpretation over measurements."
+    },
+    {
+      "section": "5.3",
+      "line": 189,
+      "term": "`ArcScope.Decoder`",
+      "names": [
+        "ArcScope.Decoder"
+      ],
+      "namespace": "ArcScope",
+      "spaces": [
+        "domain"
+      ],
+      "status": "active",
+      "definition": "A protocol interpreter producing Decoder Output. **Decoder Output ≠ Raw Data.**"
+    },
+    {
+      "section": "5.3",
+      "line": 190,
+      "term": "`ArcScope.Annotation`",
+      "names": [
+        "ArcScope.Annotation"
+      ],
+      "namespace": "ArcScope",
+      "spaces": [
+        "domain"
+      ],
+      "status": "active",
+      "definition": "A non-destructive marking. **Never** a data mutation."
+    },
+    {
+      "section": "5.3",
+      "line": 191,
+      "term": "`ArcScope.Comparison`",
+      "names": [
+        "ArcScope.Comparison"
+      ],
+      "namespace": "ArcScope",
+      "spaces": [
+        "domain"
+      ],
+      "status": "active",
+      "definition": "A side-by-side relation between sessions or captures. **Not** a merge."
+    },
+    {
+      "section": "5.3",
+      "line": 192,
+      "term": "`ArcScope.Report`",
+      "names": [
+        "ArcScope.Report"
+      ],
+      "namespace": "ArcScope",
+      "spaces": [
+        "domain"
+      ],
+      "status": "active",
+      "definition": "An ArcScope-owned report artifact. **Not** an ArcNotes Document."
+    },
+    {
+      "section": "5.3",
+      "line": 193,
+      "term": "`ArcScope.LiveView`",
+      "names": [
+        "ArcScope.LiveView"
+      ],
+      "namespace": "ArcScope",
+      "spaces": [
+        "UI"
+      ],
+      "status": "active",
+      "definition": "Display state. Pausing the view never pauses the capture."
+    },
+    {
+      "section": "5.3",
+      "line": 194,
+      "term": "`ArcScope.Recording`",
+      "names": [
+        "ArcScope.Recording"
+      ],
+      "namespace": "ArcScope",
+      "spaces": [
+        "storage"
+      ],
+      "status": "active",
+      "definition": "Persisted capture data, distinct from LiveView display state."
+    },
+    {
+      "section": "5.3",
+      "line": 195,
+      "term": "`ArcScope.DisplayDecimation`",
+      "names": [
+        "ArcScope.DisplayDecimation"
+      ],
+      "namespace": "ArcScope",
+      "spaces": [
+        "domain"
+      ],
+      "status": "active",
+      "definition": "Downsampling for rendering only. Never the measurement data."
+    },
+    {
+      "section": "5.3",
+      "line": 201,
+      "term": "`ArcScope.SimulationDefinition`",
+      "names": [
+        "ArcScope.SimulationDefinition"
+      ],
+      "namespace": "ArcScope",
+      "spaces": [
+        "domain"
+      ],
+      "status": "active",
+      "definition": "A Cloud-owned simulator definition."
+    },
+    {
+      "section": "5.3",
+      "line": 202,
+      "term": "`ArcScope.ScenarioVersion`",
+      "names": [
+        "ArcScope.ScenarioVersion"
+      ],
+      "namespace": "ArcScope",
+      "spaces": [
+        "domain"
+      ],
+      "status": "active",
+      "definition": "An immutable scenario version."
+    },
+    {
+      "section": "5.3",
+      "line": 203,
+      "term": "`ArcScope.SimulationRun`",
+      "names": [
+        "ArcScope.SimulationRun"
+      ],
+      "namespace": "ArcScope",
+      "spaces": [
+        "domain"
+      ],
+      "status": "active",
+      "definition": "A non-agent simulator product job."
+    },
+    {
+      "section": "5.3",
+      "line": 204,
+      "term": "`ArcScope.SimulationSegment`",
+      "names": [
+        "ArcScope.SimulationSegment"
+      ],
+      "namespace": "ArcScope",
+      "spaces": [
+        "domain"
+      ],
+      "status": "active",
+      "definition": "An immutable segment of a simulation result."
+    },
+    {
+      "section": "5.3",
+      "line": 205,
+      "term": "`ArcScope.SimulationEvent`",
+      "names": [
+        "ArcScope.SimulationEvent"
+      ],
+      "namespace": "ArcScope",
+      "spaces": [
+        "domain"
+      ],
+      "status": "active",
+      "definition": "An ordered event in a simulation run."
+    },
+    {
+      "section": "5.4",
+      "line": 211,
+      "term": "`ArcSlate.Project`",
+      "names": [
+        "ArcSlate.Project"
+      ],
+      "namespace": "ArcSlate",
+      "spaces": [
+        "domain"
+      ],
+      "status": "active",
+      "definition": "The editing project. **Not** a Sequence; **not** a media folder."
+    },
+    {
+      "section": "5.4",
+      "line": 212,
+      "term": "`ArcSlate.Sequence`",
+      "names": [
+        "ArcSlate.Sequence"
+      ],
+      "namespace": "ArcSlate",
+      "spaces": [
+        "domain"
+      ],
+      "status": "active",
+      "definition": "A timeline composition. **Not** a Timeline Clip."
+    },
+    {
+      "section": "5.4",
+      "line": 213,
+      "term": "`ArcSlate.Timeline`",
+      "names": [
+        "ArcSlate.Timeline"
+      ],
+      "namespace": "ArcSlate",
+      "spaces": [
+        "domain"
+      ],
+      "status": "active",
+      "definition": "The temporal arrangement inside a Sequence."
+    },
+    {
+      "section": "5.4",
+      "line": 214,
+      "term": "`ArcSlate.Track`",
+      "names": [
+        "ArcSlate.Track"
+      ],
+      "namespace": "ArcSlate",
+      "spaces": [
+        "domain"
+      ],
+      "status": "active",
+      "definition": "A lane within a Timeline."
+    },
+    {
+      "section": "5.4",
+      "line": 215,
+      "term": "`ArcSlate.Clip`",
+      "names": [
+        "ArcSlate.Clip"
+      ],
+      "namespace": "ArcSlate",
+      "spaces": [
+        "domain"
+      ],
+      "status": "active",
+      "definition": "A placed reference to source media with in/out points. **Not** the source media."
+    },
+    {
+      "section": "5.4",
+      "line": 216,
+      "term": "`ArcSlate.MediaAsset`",
+      "names": [
+        "ArcSlate.MediaAsset"
+      ],
+      "namespace": "ArcSlate",
+      "spaces": [
+        "domain"
+      ],
+      "status": "active",
+      "definition": "The managed identity of a piece of media. **Not** a file path; **not** a Clip."
+    },
+    {
+      "section": "5.4",
+      "line": 217,
+      "term": "`ArcSlate.SourceTime` / `ArcSlate.TimelineTime`",
+      "names": [
+        "ArcSlate.SourceTime",
+        "ArcSlate.TimelineTime"
+      ],
+      "namespace": "ArcSlate",
+      "spaces": [
+        "domain"
+      ],
+      "status": "active",
+      "definition": "Source-relative versus composition-relative time. Never interchangeable."
+    },
+    {
+      "section": "5.4",
+      "line": 218,
+      "term": "`ArcSlate.VideoFrameTime` / `ArcSlate.AudioSampleTime`",
+      "names": [
+        "ArcSlate.VideoFrameTime",
+        "ArcSlate.AudioSampleTime"
+      ],
+      "namespace": "ArcSlate",
+      "spaces": [
+        "domain"
+      ],
+      "status": "active",
+      "definition": "Distinct rate domains. Never the same clock."
+    },
+    {
+      "section": "5.4",
+      "line": 219,
+      "term": "`ArcSlate.Transition`",
+      "names": [
+        "ArcSlate.Transition"
+      ],
+      "namespace": "ArcSlate",
+      "spaces": [
+        "domain"
+      ],
+      "status": "active",
+      "definition": "A declared relation between adjacent clips. **Not** an incidental overlap."
+    },
+    {
+      "section": "5.4",
+      "line": 220,
+      "term": "`ArcSlate.EffectDefinition` / `ArcSlate.EffectInstance`",
+      "names": [
+        "ArcSlate.EffectDefinition",
+        "ArcSlate.EffectInstance"
+      ],
+      "namespace": "ArcSlate",
+      "spaces": [
+        "domain"
+      ],
+      "status": "active",
+      "definition": "Type versus applied instance with parameters."
+    },
+    {
+      "section": "5.4",
+      "line": 221,
+      "term": "`ArcSlate.Keyframe`",
+      "names": [
+        "ArcSlate.Keyframe"
+      ],
+      "namespace": "ArcSlate",
+      "spaces": [
+        "domain"
+      ],
+      "status": "active",
+      "definition": "A time-anchored parameter value. **Not** the current parameter value."
+    },
+    {
+      "section": "5.4",
+      "line": 222,
+      "term": "`ArcSlate.Proxy`",
+      "names": [
+        "ArcSlate.Proxy"
+      ],
+      "namespace": "ArcSlate",
+      "spaces": [
+        "storage"
+      ],
+      "status": "active",
+      "definition": "A lower-cost stand-in for original media. **Not** the original; **not** a render cache."
+    },
+    {
+      "section": "5.4",
+      "line": 223,
+      "term": "`ArcSlate.RenderCache`",
+      "names": [
+        "ArcSlate.RenderCache"
+      ],
+      "namespace": "ArcSlate",
+      "spaces": [
+        "storage"
+      ],
+      "status": "active",
+      "definition": "Rebuildable rendered output. **Never** project authority."
+    },
+    {
+      "section": "5.4",
+      "line": 224,
+      "term": "`ArcSlate.RenderJob`",
+      "names": [
+        "ArcSlate.RenderJob"
+      ],
+      "namespace": "ArcSlate",
+      "spaces": [
+        "domain"
+      ],
+      "status": "active",
+      "definition": "An ArcSlate-owned native product render/export Job, distinct from a Cloud Agent Task and UI progress dialog."
+    },
+    {
+      "section": "5.4",
+      "line": 225,
+      "term": "`ArcSlate.RenderedArtifact`",
+      "names": [
+        "ArcSlate.RenderedArtifact"
+      ],
+      "namespace": "ArcSlate",
+      "spaces": [
+        "domain"
+      ],
+      "status": "active",
+      "definition": "The produced media file. **Not** the ArcSlate Project."
+    },
+    {
+      "section": "5.4",
+      "line": 226,
+      "term": "`ArcSlate.Transcript` / `ArcSlate.Subtitle`",
+      "names": [
+        "ArcSlate.Transcript",
+        "ArcSlate.Subtitle"
+      ],
+      "namespace": "ArcSlate",
+      "spaces": [
+        "domain"
+      ],
+      "status": "active",
+      "definition": "Machine text versus authored, timed, styled display text."
+    }
+  ],
+  "forbiddenAliases": [
+    {
+      "section": "8",
+      "line": 752,
+      "term": "`ArcCanvas`, `ArcMusic`, `ArcImage`",
+      "reason": "`SUPERSEDED` product names (**[D-002](../decisions/phase-1-foundation-decisions.md#rule-d-002)**)",
+      "instead": "No replacement product or runtime alias. ArcScope is independently defined; image-editor concepts do not migrate into it."
+    },
+    {
+      "section": "8",
+      "line": 753,
+      "term": "`ArcVideo`",
+      "reason": "`SUPERSEDED` product name; reference-repository identity only",
+      "instead": "ArcSlate retains product direction only, not a model, identity or automatic migration."
+    },
+    {
+      "section": "8",
+      "line": 754,
+      "term": "\"Workspace\" meaning a panel layout",
+      "reason": "Collides with the cloud tenancy boundary",
+      "instead": "**Layout**"
+    },
+    {
+      "section": "8",
+      "line": 755,
+      "term": "Bare \"Project\" in shared family text",
+      "reason": "Three incompatible product meanings",
+      "instead": "`ArcChat.Project` / `ArcScope.Project` / `ArcSlate.Project`"
+    },
+    {
+      "section": "8",
+      "line": 756,
+      "term": "Bare \"Scope\"",
+      "reason": "Eight distinct meanings exist",
+      "instead": "Name the scope explicitly: Knowledge Scope, Sync Scope, Permission Scope, Policy Scope, Product Scope, Search Scope, Egress Scope, Resource Scope"
+    },
+    {
+      "section": "8",
+      "line": 757,
+      "term": "\"ArcForges Suite 2.0\" as a version",
+      "reason": "No mandatory suite release train",
+      "instead": "Per-product versions plus an optional release campaign name"
+    },
+    {
+      "section": "8",
+      "line": 758,
+      "term": "\"Central desktop service\", `ArcForgesService.exe`",
+      "reason": "Prohibited architecture",
+      "instead": "application-owned assistant"
+    },
+    {
+      "section": "8",
+      "line": 759,
+      "term": "Unqualified \"Unlimited AI\" / \"unlimited storage\"",
+      "reason": "Prohibited unbounded commercial claims",
+      "instead": "Disclosed AI capacity recovery/rate/concurrency/model limits and storage tier"
+    },
+    {
+      "section": "8",
+      "line": 760,
+      "term": "\".NET AOT\" applied to Kotlin Android",
+      "reason": "Kotlin/Jetpack Compose is its own runtime under [P2-009](../decisions/phase-2-specification-decisions.md#rule-p2-009)",
+      "instead": "\"Kotlin/Jetpack Compose release build\""
+    },
+    {
+      "section": "8",
+      "line": 761,
+      "term": "\"Cloud may remain JIT\"",
+      "reason": "Superseded by [P2-009](../decisions/phase-2-specification-decisions.md#rule-p2-009)",
+      "instead": "\"C# Cloud publishes Native AOT\""
+    },
+    {
+      "section": "8",
+      "line": 762,
+      "term": "\"A realtime connection is durable authority\"",
+      "reason": "Hints are projections",
+      "instead": "\"Reconcile using the typed authoritative read\""
+    },
+    {
+      "section": "8",
+      "line": 763,
+      "term": "Waffo Pancake and every Waffo-specific mechanic",
+      "reason": "`SUPERSEDED` provider (**[D-005](../decisions/phase-1-foundation-decisions.md#rule-d-005)**)",
+      "instead": "Paddle (MoR) and Payoneer (payout destination)"
+    },
+    {
+      "section": "8",
+      "line": 764,
+      "term": "\"License key unlock\" in Android companion",
+      "reason": "Excluded by the accepted Android companion entitlement/distribution policy and **[D-022](../decisions/phase-1-foundation-decisions.md#rule-d-022)**",
+      "instead": "Cloud-resolved entitlement"
+    },
+    {
+      "section": "8",
+      "line": 765,
+      "term": "`InvokeAsync(string, object)` / `Dictionary<string,object>` capability calls",
+      "reason": "Bypasses contracts, permissions and versioning",
+      "instead": "Strongly typed capability interfaces"
+    },
+    {
+      "section": "8",
+      "line": 766,
+      "term": "`ArcForges.Foundation.Document`, `.VideoTimeline`, `.TelemetrySession`",
+      "reason": "Shared foundation must not hold domain",
+      "instead": "Product-owned domain types"
+    },
+    {
+      "section": "8",
+      "line": 767,
+      "term": "`ArcProductBase` domain hierarchy",
+      "reason": "Product classification is not inheritance",
+      "instead": "Independent domains + platform contracts"
+    }
+  ]
+}
diff --git a/eng/policy/invariants.json b/eng/policy/invariants.json
new file mode 100644
index 0000000..dbbbac6
--- /dev/null
+++ b/eng/policy/invariants.json
@@ -0,0 +1,7448 @@
+{
+  "schemaVersion": 1,
+  "license": "AGPL-3.0-only",
+  "sources": [
+    {
+      "repository": "ArcForges/ArcForges-Design",
+      "commit": "1607374e81955f0a47f319cd6cc8ba1c6e254157",
+      "path": "docs/requirements/01-normative-glossary-and-invariants.md",
+      "sha256": "fa60f160fe6c28685cd904f590f8d74ed1ead03295e4b9e42023f2a8f2b09a88"
+    },
+    {
+      "repository": "ArcForges/ArcForges-Design",
+      "commit": "1607374e81955f0a47f319cd6cc8ba1c6e254157",
+      "path": "docs/assurance/invariant-coverage.md",
+      "sha256": "aa5880fc655e1e3da8f748f2c627d9c57ce1405c9b5fcb1ef7d3c2a6396e417a"
+    }
+  ],
+  "verificationState": "planned-only",
+  "records": [
+    {
+      "id": "I-001",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 254,
+      "coverageLine": 221,
+      "statement": "User ≠ Workspace ≠ Device ≠ Session ≠ Subscription ≠ Entitlement",
+      "architectureHome": "`08-security-architecture.md` §1; `16-billing-and-commerce-architecture.md` §3",
+      "mechanism": "Type distinction",
+      "plannedVerification": "Assert `User` is not `Workspace`, `Workspace` is not `Device`, `Device` is not `Session`, `Session` is not `Subscription`, `Subscription` is not `Entitlement`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "04",
+        "22",
+        "42"
+      ],
+      "ownerCell": "`04`, `22`, `42`",
+      "completionGate": "[WP-04.00](../planning/work-packages/04-identity-error-and-versioning-primitives.md#rule-wp-04.00), [WP-22.00](../planning/work-packages/22-identity-workspace-and-device.md#rule-wp-22.00), [WP-42.04](../planning/work-packages/42-commerce-entitlement-and-credits.md#rule-wp-42.04)"
+    },
+    {
+      "id": "I-002",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 255,
+      "coverageLine": 222,
+      "statement": "Subscription cancellation ≠ Account deletion",
+      "architectureHome": "`08-security-architecture.md` §1; `16-billing-and-commerce-architecture.md` §3",
+      "mechanism": "Type distinction",
+      "plannedVerification": "Assert `Subscription cancellation` is not `Account deletion`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "04",
+        "22",
+        "42"
+      ],
+      "ownerCell": "`04`, `22`, `42`",
+      "completionGate": "[WP-04.00](../planning/work-packages/04-identity-error-and-versioning-primitives.md#rule-wp-04.00), [WP-22.00](../planning/work-packages/22-identity-workspace-and-device.md#rule-wp-22.00), [WP-42.04](../planning/work-packages/42-commerce-entitlement-and-credits.md#rule-wp-42.04)"
+    },
+    {
+      "id": "I-003",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 256,
+      "coverageLine": 223,
+      "statement": "`canceling` state ≠ use prohibited",
+      "architectureHome": "`08-security-architecture.md` §1; `16-billing-and-commerce-architecture.md` §3",
+      "mechanism": "Type distinction",
+      "plannedVerification": "Assert ``canceling` state` is not `use prohibited`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "04",
+        "22",
+        "42"
+      ],
+      "ownerCell": "`04`, `22`, `42`",
+      "completionGate": "[WP-04.00](../planning/work-packages/04-identity-error-and-versioning-primitives.md#rule-wp-04.00), [WP-22.00](../planning/work-packages/22-identity-workspace-and-device.md#rule-wp-22.00), [WP-42.04](../planning/work-packages/42-commerce-entitlement-and-credits.md#rule-wp-42.04)"
+    },
+    {
+      "id": "I-004",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 257,
+      "coverageLine": 224,
+      "statement": "Entitlement ≠ Feature Flag",
+      "architectureHome": "`08-security-architecture.md` §1; `16-billing-and-commerce-architecture.md` §3",
+      "mechanism": "Type distinction",
+      "plannedVerification": "Assert `Entitlement` is not `Feature Flag`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "04",
+        "22",
+        "42"
+      ],
+      "ownerCell": "`04`, `22`, `42`",
+      "completionGate": "[WP-04.00](../planning/work-packages/04-identity-error-and-versioning-primitives.md#rule-wp-04.00), [WP-22.00](../planning/work-packages/22-identity-workspace-and-device.md#rule-wp-22.00), [WP-42.04](../planning/work-packages/42-commerce-entitlement-and-credits.md#rule-wp-42.04)"
+    },
+    {
+      "id": "I-005",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 258,
+      "coverageLine": 225,
+      "statement": "AppId ≠ ProductScope",
+      "architectureHome": "`08-security-architecture.md` §1; `16-billing-and-commerce-architecture.md` §3",
+      "mechanism": "Type distinction",
+      "plannedVerification": "Assert `AppId` is not `ProductScope`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "04",
+        "22",
+        "42"
+      ],
+      "ownerCell": "`04`, `22`, `42`",
+      "completionGate": "[WP-04.00](../planning/work-packages/04-identity-error-and-versioning-primitives.md#rule-wp-04.00), [WP-22.00](../planning/work-packages/22-identity-workspace-and-device.md#rule-wp-22.00), [WP-42.04](../planning/work-packages/42-commerce-entitlement-and-credits.md#rule-wp-42.04)"
+    },
+    {
+      "id": "I-006",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 259,
+      "coverageLine": 226,
+      "statement": "AppId ≠ Process",
+      "architectureHome": "`08-security-architecture.md` §1; `16-billing-and-commerce-architecture.md` §3",
+      "mechanism": "Type distinction",
+      "plannedVerification": "Assert `AppId` is not `Process`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "04",
+        "22",
+        "42"
+      ],
+      "ownerCell": "`04`, `22`, `42`",
+      "completionGate": "[WP-04.00](../planning/work-packages/04-identity-error-and-versioning-primitives.md#rule-wp-04.00), [WP-22.00](../planning/work-packages/22-identity-workspace-and-device.md#rule-wp-22.00), [WP-42.04](../planning/work-packages/42-commerce-entitlement-and-credits.md#rule-wp-42.04)"
+    },
+    {
+      "id": "I-007",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 260,
+      "coverageLine": 227,
+      "statement": "App ≠ Installation ≠ Instance",
+      "architectureHome": "`08-security-architecture.md` §1; `16-billing-and-commerce-architecture.md` §3",
+      "mechanism": "Type distinction",
+      "plannedVerification": "Assert `App` is not `Installation`, `Installation` is not `Instance`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "04",
+        "22",
+        "42"
+      ],
+      "ownerCell": "`04`, `22`, `42`",
+      "completionGate": "[WP-04.00](../planning/work-packages/04-identity-error-and-versioning-primitives.md#rule-wp-04.00), [WP-22.00](../planning/work-packages/22-identity-workspace-and-device.md#rule-wp-22.00), [WP-42.04](../planning/work-packages/42-commerce-entitlement-and-credits.md#rule-wp-42.04)"
+    },
+    {
+      "id": "I-008",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 261,
+      "coverageLine": 228,
+      "statement": "Instance ≠ Window",
+      "architectureHome": "`08-security-architecture.md` §1; `16-billing-and-commerce-architecture.md` §3",
+      "mechanism": "Type distinction",
+      "plannedVerification": "Assert `Instance` is not `Window`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "04",
+        "22",
+        "42"
+      ],
+      "ownerCell": "`04`, `22`, `42`",
+      "completionGate": "[WP-04.00](../planning/work-packages/04-identity-error-and-versioning-primitives.md#rule-wp-04.00), [WP-22.00](../planning/work-packages/22-identity-workspace-and-device.md#rule-wp-22.00), [WP-42.04](../planning/work-packages/42-commerce-entitlement-and-credits.md#rule-wp-42.04)"
+    },
+    {
+      "id": "I-009",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 262,
+      "coverageLine": 229,
+      "statement": "AppId ≠ InstanceId",
+      "architectureHome": "`08-security-architecture.md` §1; `16-billing-and-commerce-architecture.md` §3",
+      "mechanism": "Type distinction",
+      "plannedVerification": "Assert `AppId` is not `InstanceId`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "04",
+        "22",
+        "42"
+      ],
+      "ownerCell": "`04`, `22`, `42`",
+      "completionGate": "[WP-04.00](../planning/work-packages/04-identity-error-and-versioning-primitives.md#rule-wp-04.00), [WP-22.00](../planning/work-packages/22-identity-workspace-and-device.md#rule-wp-22.00), [WP-42.04](../planning/work-packages/42-commerce-entitlement-and-credits.md#rule-wp-42.04)"
+    },
+    {
+      "id": "I-010",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 263,
+      "coverageLine": 230,
+      "statement": "Growth Analytics ≠ Entitlement ≠ Billing ≠ Policy",
+      "architectureHome": "`08-security-architecture.md` §1; `16-billing-and-commerce-architecture.md` §3",
+      "mechanism": "Type distinction",
+      "plannedVerification": "Assert `Growth Analytics` is not `Entitlement`, `Entitlement` is not `Billing`, `Billing` is not `Policy`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "04",
+        "22",
+        "42"
+      ],
+      "ownerCell": "`04`, `22`, `42`",
+      "completionGate": "[WP-04.00](../planning/work-packages/04-identity-error-and-versioning-primitives.md#rule-wp-04.00), [WP-22.00](../planning/work-packages/22-identity-workspace-and-device.md#rule-wp-22.00), [WP-42.04](../planning/work-packages/42-commerce-entitlement-and-credits.md#rule-wp-42.04)"
+    },
+    {
+      "id": "I-011",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 264,
+      "coverageLine": 231,
+      "statement": "Provider Cost Ledger ≠ Customer Credit Ledger ≠ Payment/Revenue Ledger",
+      "architectureHome": "`08-security-architecture.md` §1; `16-billing-and-commerce-architecture.md` §3",
+      "mechanism": "Type distinction",
+      "plannedVerification": "Assert `Provider Cost Ledger` is not `Customer Credit Ledger`, `Customer Credit Ledger` is not `Payment/Revenue Ledger`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "04",
+        "22",
+        "42"
+      ],
+      "ownerCell": "`04`, `22`, `42`",
+      "completionGate": "[WP-04.00](../planning/work-packages/04-identity-error-and-versioning-primitives.md#rule-wp-04.00), [WP-22.00](../planning/work-packages/22-identity-workspace-and-device.md#rule-wp-22.00), [WP-42.04](../planning/work-packages/42-commerce-entitlement-and-credits.md#rule-wp-42.04)"
+    },
+    {
+      "id": "I-012",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 265,
+      "coverageLine": 232,
+      "statement": "Reserved Credits ≠ Charged Credits",
+      "architectureHome": "`08-security-architecture.md` §1; `16-billing-and-commerce-architecture.md` §3",
+      "mechanism": "Type distinction",
+      "plannedVerification": "Assert `Reserved Credits` is not `Charged Credits`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "04",
+        "22",
+        "42"
+      ],
+      "ownerCell": "`04`, `22`, `42`",
+      "completionGate": "[WP-04.00](../planning/work-packages/04-identity-error-and-versioning-primitives.md#rule-wp-04.00), [WP-22.00](../planning/work-packages/22-identity-workspace-and-device.md#rule-wp-22.00), [WP-42.04](../planning/work-packages/42-commerce-entitlement-and-credits.md#rule-wp-42.04)"
+    },
+    {
+      "id": "I-013",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 266,
+      "coverageLine": 233,
+      "statement": "Budget ≠ Entitlement",
+      "architectureHome": "`08-security-architecture.md` §1; `16-billing-and-commerce-architecture.md` §3",
+      "mechanism": "Type distinction",
+      "plannedVerification": "Assert `Budget` is not `Entitlement`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "04",
+        "22",
+        "42"
+      ],
+      "ownerCell": "`04`, `22`, `42`",
+      "completionGate": "[WP-04.00](../planning/work-packages/04-identity-error-and-versioning-primitives.md#rule-wp-04.00), [WP-22.00](../planning/work-packages/22-identity-workspace-and-device.md#rule-wp-22.00), [WP-42.04](../planning/work-packages/42-commerce-entitlement-and-credits.md#rule-wp-42.04)"
+    },
+    {
+      "id": "I-014",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 267,
+      "coverageLine": 234,
+      "statement": "AI Billing Workspace ≠ Conversation Storage Scope",
+      "architectureHome": "`08-security-architecture.md` §1; `16-billing-and-commerce-architecture.md` §3",
+      "mechanism": "Type distinction",
+      "plannedVerification": "Assert `AI Billing Workspace` is not `Conversation Storage Scope`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "04",
+        "22",
+        "42"
+      ],
+      "ownerCell": "`04`, `22`, `42`",
+      "completionGate": "[WP-04.00](../planning/work-packages/04-identity-error-and-versioning-primitives.md#rule-wp-04.00), [WP-22.00](../planning/work-packages/22-identity-workspace-and-device.md#rule-wp-22.00), [WP-42.04](../planning/work-packages/42-commerce-entitlement-and-credits.md#rule-wp-42.04)"
+    },
+    {
+      "id": "I-015",
+      "status": "retired",
+      "section": "7",
+      "catalogueLine": 268,
+      "coverageLine": 235,
+      "statement": "**Retired by [P2-006](../decisions/phase-2-specification-decisions.md#rule-p2-006):** Cloud BYOK and Local BYOK are both excluded, with no customer credential types or routes required.",
+      "architectureHome": "—",
+      "mechanism": "Absence test",
+      "plannedVerification": "Assert no customer BYOK credential type, API, setting or client key store can enable Cloud/local model execution; operator secrets remain server-only.",
+      "owningPackages": [
+        "05",
+        "41",
+        "43"
+      ],
+      "ownerCell": "[WP-05](../planning/work-packages/05-architecture-and-repository-policy-tests.md#rule-wp-05), [WP-43.03](../planning/work-packages/43-managed-ai-routing-and-metering.md#rule-wp-43.03), [WP-41.07](../planning/work-packages/41-extension-platform-and-integrations.md#rule-wp-41.07)",
+      "completionGate": "The exclusion is structurally asserted, not merely undocumented"
+    },
+    {
+      "id": "I-016",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 269,
+      "coverageLine": 236,
+      "statement": "Cloud Account Restriction ≠ Local Data Confiscation",
+      "architectureHome": "`08-security-architecture.md` §1; `16-billing-and-commerce-architecture.md` §3",
+      "mechanism": "Type distinction",
+      "plannedVerification": "Assert `Cloud Account Restriction` is not `Local Data Confiscation`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "04",
+        "22",
+        "42"
+      ],
+      "ownerCell": "`04`, `22`, `42`",
+      "completionGate": "[WP-04.00](../planning/work-packages/04-identity-error-and-versioning-primitives.md#rule-wp-04.00), [WP-22.00](../planning/work-packages/22-identity-workspace-and-device.md#rule-wp-22.00), [WP-42.04](../planning/work-packages/42-commerce-entitlement-and-credits.md#rule-wp-42.04)"
+    },
+    {
+      "id": "I-017",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 270,
+      "coverageLine": 237,
+      "statement": "ArcForges Cloud Agent ≠ free VPS",
+      "architectureHome": "`08-security-architecture.md` §1; `16-billing-and-commerce-architecture.md` §3",
+      "mechanism": "Type distinction",
+      "plannedVerification": "Assert `ArcForges Cloud Agent` is not `free VPS`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "04",
+        "22",
+        "42"
+      ],
+      "ownerCell": "`04`, `22`, `42`",
+      "completionGate": "[WP-04.00](../planning/work-packages/04-identity-error-and-versioning-primitives.md#rule-wp-04.00), [WP-22.00](../planning/work-packages/22-identity-workspace-and-device.md#rule-wp-22.00), [WP-42.04](../planning/work-packages/42-commerce-entitlement-and-credits.md#rule-wp-42.04)"
+    },
+    {
+      "id": "I-020",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 276,
+      "coverageLine": 238,
+      "statement": "Reference ≠ Ownership",
+      "architectureHome": "`00-architecture-overview.md` §7; `01-solution-and-project-layout.md` §8",
+      "mechanism": "Repository policy test",
+      "plannedVerification": "Assert `Reference` is not `Ownership`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "00",
+        "01",
+        "05"
+      ],
+      "ownerCell": "`00`, `01`, `05`",
+      "completionGate": "[WP-05.00](../planning/work-packages/05-architecture-and-repository-policy-tests.md#rule-wp-05.00), [WP-05.02](../planning/work-packages/05-architecture-and-repository-policy-tests.md#rule-wp-05.02)"
+    },
+    {
+      "id": "I-021",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 277,
+      "coverageLine": 239,
+      "statement": "Shared Experience ≠ Shared Shell ≠ Shared Domain",
+      "architectureHome": "`00-architecture-overview.md` §7; `01-solution-and-project-layout.md` §8",
+      "mechanism": "Repository policy test",
+      "plannedVerification": "Assert `Shared Experience` is not `Shared Shell`, `Shared Shell` is not `Shared Domain`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "00",
+        "01",
+        "05"
+      ],
+      "ownerCell": "`00`, `01`, `05`",
+      "completionGate": "[WP-05.00](../planning/work-packages/05-architecture-and-repository-policy-tests.md#rule-wp-05.00), [WP-05.02](../planning/work-packages/05-architecture-and-repository-policy-tests.md#rule-wp-05.02)"
+    },
+    {
+      "id": "I-022",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 278,
+      "coverageLine": 240,
+      "statement": "Shared Foundation ≠ Shared Domain",
+      "architectureHome": "`00-architecture-overview.md` §7; `01-solution-and-project-layout.md` §8",
+      "mechanism": "Repository policy test",
+      "plannedVerification": "Assert `Shared Foundation` is not `Shared Domain`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "00",
+        "01",
+        "05"
+      ],
+      "ownerCell": "`00`, `01`, `05`",
+      "completionGate": "[WP-05.00](../planning/work-packages/05-architecture-and-repository-policy-tests.md#rule-wp-05.00), [WP-05.02](../planning/work-packages/05-architecture-and-repository-policy-tests.md#rule-wp-05.02)"
+    },
+    {
+      "id": "I-023",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 279,
+      "coverageLine": 241,
+      "statement": "Task Owner ≠ Execution Location",
+      "architectureHome": "`00-architecture-overview.md` §7; `01-solution-and-project-layout.md` §8",
+      "mechanism": "Repository policy test",
+      "plannedVerification": "Assert `Task Owner` is not `Execution Location`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "00",
+        "01",
+        "05"
+      ],
+      "ownerCell": "`00`, `01`, `05`",
+      "completionGate": "[WP-05.00](../planning/work-packages/05-architecture-and-repository-policy-tests.md#rule-wp-05.00), [WP-05.02](../planning/work-packages/05-architecture-and-repository-policy-tests.md#rule-wp-05.02)"
+    },
+    {
+      "id": "I-024",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 280,
+      "coverageLine": 242,
+      "statement": "Actor ≠ Executor ≠ Caller Instance ≠ Identity",
+      "architectureHome": "`00-architecture-overview.md` §7; `01-solution-and-project-layout.md` §8",
+      "mechanism": "Repository policy test",
+      "plannedVerification": "Assert `Actor` is not `Executor`, `Executor` is not `Caller Instance`, `Caller Instance` is not `Identity`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "00",
+        "01",
+        "05"
+      ],
+      "ownerCell": "`00`, `01`, `05`",
+      "completionGate": "[WP-05.00](../planning/work-packages/05-architecture-and-repository-policy-tests.md#rule-wp-05.00), [WP-05.02](../planning/work-packages/05-architecture-and-repository-policy-tests.md#rule-wp-05.02)"
+    },
+    {
+      "id": "I-025",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 281,
+      "coverageLine": 243,
+      "statement": "App Version ≠ Contract Version",
+      "architectureHome": "`00-architecture-overview.md` §7; `01-solution-and-project-layout.md` §8",
+      "mechanism": "Repository policy test",
+      "plannedVerification": "Assert `App Version` is not `Contract Version`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "00",
+        "01",
+        "05"
+      ],
+      "ownerCell": "`00`, `01`, `05`",
+      "completionGate": "[WP-05.00](../planning/work-packages/05-architecture-and-repository-policy-tests.md#rule-wp-05.00), [WP-05.02](../planning/work-packages/05-architecture-and-repository-policy-tests.md#rule-wp-05.02)"
+    },
+    {
+      "id": "I-026",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 282,
+      "coverageLine": 244,
+      "statement": "Semantic Contract ≠ Wire Contract",
+      "architectureHome": "`00-architecture-overview.md` §7; `01-solution-and-project-layout.md` §8",
+      "mechanism": "Repository policy test",
+      "plannedVerification": "Assert `Semantic Contract` is not `Wire Contract`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "00",
+        "01",
+        "05"
+      ],
+      "ownerCell": "`00`, `01`, `05`",
+      "completionGate": "[WP-05.00](../planning/work-packages/05-architecture-and-repository-policy-tests.md#rule-wp-05.00), [WP-05.02](../planning/work-packages/05-architecture-and-repository-policy-tests.md#rule-wp-05.02)"
+    },
+    {
+      "id": "I-027",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 283,
+      "coverageLine": 245,
+      "statement": "Mobile/Web Companion ≠ Professional-app Mobile/Web port",
+      "architectureHome": "`00-architecture-overview.md` §7; `01-solution-and-project-layout.md` §8",
+      "mechanism": "Repository policy test",
+      "plannedVerification": "Assert `Mobile/Web Companion` is not `Professional-app Mobile/Web port`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "00",
+        "01",
+        "05"
+      ],
+      "ownerCell": "`00`, `01`, `05`",
+      "completionGate": "[WP-05.00](../planning/work-packages/05-architecture-and-repository-policy-tests.md#rule-wp-05.00), [WP-05.02](../planning/work-packages/05-architecture-and-repository-policy-tests.md#rule-wp-05.02)"
+    },
+    {
+      "id": "I-028",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 284,
+      "coverageLine": 246,
+      "statement": "Native ArcNotes editor/working cache ≠ WebView shell; acknowledged Cloud revision ≠ pending local edit",
+      "architectureHome": "`00-architecture-overview.md` §7; `01-solution-and-project-layout.md` §8",
+      "mechanism": "Repository policy test",
+      "plannedVerification": "Edit/save a native Notes document offline, retain the pending local version through restart, then reconcile its distinct Cloud acknowledgement; reject a WebView replacement for the native editor.",
+      "owningPackages": [
+        "00",
+        "01",
+        "05"
+      ],
+      "ownerCell": "`00`, `01`, `05`",
+      "completionGate": "[WP-05.00](../planning/work-packages/05-architecture-and-repository-policy-tests.md#rule-wp-05.00), [WP-05.02](../planning/work-packages/05-architecture-and-repository-policy-tests.md#rule-wp-05.02)"
+    },
+    {
+      "id": "I-029",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 285,
+      "coverageLine": 247,
+      "statement": "ArcScope Report ≠ ArcNotes Document",
+      "architectureHome": "`00-architecture-overview.md` §7; `01-solution-and-project-layout.md` §8",
+      "mechanism": "Repository policy test",
+      "plannedVerification": "Assert `ArcScope Report` is not `ArcNotes Document`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "00",
+        "01",
+        "05"
+      ],
+      "ownerCell": "`00`, `01`, `05`",
+      "completionGate": "[WP-05.00](../planning/work-packages/05-architecture-and-repository-policy-tests.md#rule-wp-05.00), [WP-05.02](../planning/work-packages/05-architecture-and-repository-policy-tests.md#rule-wp-05.02)"
+    },
+    {
+      "id": "I-030",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 286,
+      "coverageLine": 248,
+      "statement": "Product AI surface ≠ agent runtime; all products use the single Cloud harness",
+      "architectureHome": "`00-architecture-overview.md` §7; `01-solution-and-project-layout.md` §8",
+      "mechanism": "Repository policy test",
+      "plannedVerification": "Show each product assistant with an independently scoped Cloud execution; assert there is exactly one Workflow Harness and no client model loop or standalone ArcChat authority.",
+      "owningPackages": [
+        "00",
+        "01",
+        "05"
+      ],
+      "ownerCell": "`00`, `01`, `05`",
+      "completionGate": "[WP-05.00](../planning/work-packages/05-architecture-and-repository-policy-tests.md#rule-wp-05.00), [WP-05.02](../planning/work-packages/05-architecture-and-repository-policy-tests.md#rule-wp-05.02)"
+    },
+    {
+      "id": "I-031",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 287,
+      "coverageLine": 249,
+      "statement": "Own-application assistant search ≠ a central ArcForges database",
+      "architectureHome": "`27-platform-projects-and-application-assistants.md`; `contracts/10-application-scope-and-streams.md`",
+      "mechanism": "Repository policy test",
+      "plannedVerification": "Search one application with another product containing matching text; return only the owning application results and never open another product database or launch its process.",
+      "owningPackages": [
+        "00",
+        "01",
+        "05"
+      ],
+      "ownerCell": "`00`, `01`, `05`",
+      "completionGate": "[WP-05.00](../planning/work-packages/05-architecture-and-repository-policy-tests.md#rule-wp-05.00), [WP-05.02](../planning/work-packages/05-architecture-and-repository-policy-tests.md#rule-wp-05.02)"
+    },
+    {
+      "id": "I-032",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 288,
+      "coverageLine": 250,
+      "statement": "Upstream product reference ≠ ArcSlate runtime architecture",
+      "architectureHome": "`00-architecture-overview.md` §7; `01-solution-and-project-layout.md` §8",
+      "mechanism": "Repository policy test",
+      "plannedVerification": "Assert `Upstream product reference` is not `ArcSlate runtime architecture`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "00",
+        "01",
+        "05"
+      ],
+      "ownerCell": "`00`, `01`, `05`",
+      "completionGate": "[WP-05.00](../planning/work-packages/05-architecture-and-repository-policy-tests.md#rule-wp-05.00), [WP-05.02](../planning/work-packages/05-architecture-and-repository-policy-tests.md#rule-wp-05.02)"
+    },
+    {
+      "id": "I-040",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 294,
+      "coverageLine": 251,
+      "statement": "Capability ≠ Action",
+      "architectureHome": "`02-contracts-and-protocols.md` §5–§8",
+      "mechanism": "Type distinction",
+      "plannedVerification": "Assert `Capability` is not `Action`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "03",
+        "09"
+      ],
+      "ownerCell": "`03`, `09`",
+      "completionGate": "[WP-03.03](../planning/work-packages/03-contract-foundation-and-licence-split.md#rule-wp-03.03), [WP-09.05](../planning/work-packages/09-capability-contribution-and-resource-model.md#rule-wp-09.05)"
+    },
+    {
+      "id": "I-041",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 295,
+      "coverageLine": 252,
+      "statement": "Capability ≠ UI Command",
+      "architectureHome": "`02-contracts-and-protocols.md` §5–§8",
+      "mechanism": "Type distinction",
+      "plannedVerification": "Assert `Capability` is not `UI Command`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "03",
+        "09"
+      ],
+      "ownerCell": "`03`, `09`",
+      "completionGate": "[WP-03.03](../planning/work-packages/03-contract-foundation-and-licence-split.md#rule-wp-03.03), [WP-09.05](../planning/work-packages/09-capability-contribution-and-resource-model.md#rule-wp-09.05)"
+    },
+    {
+      "id": "I-042",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 296,
+      "coverageLine": 253,
+      "statement": "Capability ≠ Permission",
+      "architectureHome": "`02-contracts-and-protocols.md` §5–§8",
+      "mechanism": "Type distinction",
+      "plannedVerification": "Assert `Capability` is not `Permission`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "03",
+        "09"
+      ],
+      "ownerCell": "`03`, `09`",
+      "completionGate": "[WP-03.03](../planning/work-packages/03-contract-foundation-and-licence-split.md#rule-wp-03.03), [WP-09.05](../planning/work-packages/09-capability-contribution-and-resource-model.md#rule-wp-09.05)"
+    },
+    {
+      "id": "I-043",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 297,
+      "coverageLine": 254,
+      "statement": "Action ≠ Capability Invocation",
+      "architectureHome": "`02-contracts-and-protocols.md` §5–§8",
+      "mechanism": "Type distinction",
+      "plannedVerification": "Assert `Action` is not `Capability Invocation`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "03",
+        "09"
+      ],
+      "ownerCell": "`03`, `09`",
+      "completionGate": "[WP-03.03](../planning/work-packages/03-contract-foundation-and-licence-split.md#rule-wp-03.03), [WP-09.05](../planning/work-packages/09-capability-contribution-and-resource-model.md#rule-wp-09.05)"
+    },
+    {
+      "id": "I-044",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 298,
+      "coverageLine": 255,
+      "statement": "Capability ≠ Package",
+      "architectureHome": "`02-contracts-and-protocols.md` §5–§8",
+      "mechanism": "Type distinction",
+      "plannedVerification": "Assert `Capability` is not `Package`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "03",
+        "09"
+      ],
+      "ownerCell": "`03`, `09`",
+      "completionGate": "[WP-03.03](../planning/work-packages/03-contract-foundation-and-licence-split.md#rule-wp-03.03), [WP-09.05](../planning/work-packages/09-capability-contribution-and-resource-model.md#rule-wp-09.05)"
+    },
+    {
+      "id": "I-045",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 299,
+      "coverageLine": 256,
+      "statement": "Static Capability ≠ Runtime Capability Availability",
+      "architectureHome": "`02-contracts-and-protocols.md` §5–§8",
+      "mechanism": "Type distinction",
+      "plannedVerification": "Assert `Static Capability` is not `Runtime Capability Availability`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "03",
+        "09"
+      ],
+      "ownerCell": "`03`, `09`",
+      "completionGate": "[WP-03.03](../planning/work-packages/03-contract-foundation-and-licence-split.md#rule-wp-03.03), [WP-09.05](../planning/work-packages/09-capability-contribution-and-resource-model.md#rule-wp-09.05)"
+    },
+    {
+      "id": "I-046",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 300,
+      "coverageLine": 257,
+      "statement": "Context ≠ Resource",
+      "architectureHome": "`02-contracts-and-protocols.md` §5–§8",
+      "mechanism": "Type distinction",
+      "plannedVerification": "Assert `Context` is not `Resource`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "03",
+        "09"
+      ],
+      "ownerCell": "`03`, `09`",
+      "completionGate": "[WP-03.03](../planning/work-packages/03-contract-foundation-and-licence-split.md#rule-wp-03.03), [WP-09.05](../planning/work-packages/09-capability-contribution-and-resource-model.md#rule-wp-09.05)"
+    },
+    {
+      "id": "I-047",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 301,
+      "coverageLine": 258,
+      "statement": "Context Provider ≠ Search Engine",
+      "architectureHome": "`02-contracts-and-protocols.md` §5–§8",
+      "mechanism": "Type distinction",
+      "plannedVerification": "Assert `Context Provider` is not `Search Engine`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "03",
+        "09"
+      ],
+      "ownerCell": "`03`, `09`",
+      "completionGate": "[WP-03.03](../planning/work-packages/03-contract-foundation-and-licence-split.md#rule-wp-03.03), [WP-09.05](../planning/work-packages/09-capability-contribution-and-resource-model.md#rule-wp-09.05)"
+    },
+    {
+      "id": "I-048",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 302,
+      "coverageLine": 259,
+      "statement": "Context Provider ≠ Resource Database",
+      "architectureHome": "`02-contracts-and-protocols.md` §5–§8",
+      "mechanism": "Type distinction",
+      "plannedVerification": "Assert `Context Provider` is not `Resource Database`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "03",
+        "09"
+      ],
+      "ownerCell": "`03`, `09`",
+      "completionGate": "[WP-03.03](../planning/work-packages/03-contract-foundation-and-licence-split.md#rule-wp-03.03), [WP-09.05](../planning/work-packages/09-capability-contribution-and-resource-model.md#rule-wp-09.05)"
+    },
+    {
+      "id": "I-049",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 303,
+      "coverageLine": 260,
+      "statement": "Context Freeze ≠ copy all data",
+      "architectureHome": "`02-contracts-and-protocols.md` §5–§8",
+      "mechanism": "Type distinction",
+      "plannedVerification": "Assert `Context Freeze` is not `copy all data`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "03",
+        "09"
+      ],
+      "ownerCell": "`03`, `09`",
+      "completionGate": "[WP-03.03](../planning/work-packages/03-contract-foundation-and-licence-split.md#rule-wp-03.03), [WP-09.05](../planning/work-packages/09-capability-contribution-and-resource-model.md#rule-wp-09.05)"
+    },
+    {
+      "id": "I-050",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 304,
+      "coverageLine": 261,
+      "statement": "Current Selection ≠ durable Resource Identity",
+      "architectureHome": "`02-contracts-and-protocols.md` §5–§8",
+      "mechanism": "Type distinction",
+      "plannedVerification": "Assert `Current Selection` is not `durable Resource Identity`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "03",
+        "09"
+      ],
+      "ownerCell": "`03`, `09`",
+      "completionGate": "[WP-03.03](../planning/work-packages/03-contract-foundation-and-licence-split.md#rule-wp-03.03), [WP-09.05](../planning/work-packages/09-capability-contribution-and-resource-model.md#rule-wp-09.05)"
+    },
+    {
+      "id": "I-051",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 305,
+      "coverageLine": 262,
+      "statement": "ResourceRef ≠ Resource Content",
+      "architectureHome": "`02-contracts-and-protocols.md` §5–§8",
+      "mechanism": "Type distinction",
+      "plannedVerification": "Assert `ResourceRef` is not `Resource Content`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "03",
+        "09"
+      ],
+      "ownerCell": "`03`, `09`",
+      "completionGate": "[WP-03.03](../planning/work-packages/03-contract-foundation-and-licence-split.md#rule-wp-03.03), [WP-09.05](../planning/work-packages/09-capability-contribution-and-resource-model.md#rule-wp-09.05)"
+    },
+    {
+      "id": "I-052",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 306,
+      "coverageLine": 263,
+      "statement": "ResourceRef ≠ File Path",
+      "architectureHome": "`02-contracts-and-protocols.md` §5–§8",
+      "mechanism": "Type distinction",
+      "plannedVerification": "Assert `ResourceRef` is not `File Path`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "03",
+        "09"
+      ],
+      "ownerCell": "`03`, `09`",
+      "completionGate": "[WP-03.03](../planning/work-packages/03-contract-foundation-and-licence-split.md#rule-wp-03.03), [WP-09.05](../planning/work-packages/09-capability-contribution-and-resource-model.md#rule-wp-09.05)"
+    },
+    {
+      "id": "I-053",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 307,
+      "coverageLine": 264,
+      "statement": "ResourceRef ≠ Capability Token",
+      "architectureHome": "`02-contracts-and-protocols.md` §5–§8",
+      "mechanism": "Type distinction",
+      "plannedVerification": "Assert `ResourceRef` is not `Capability Token`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "03",
+        "09"
+      ],
+      "ownerCell": "`03`, `09`",
+      "completionGate": "[WP-03.03](../planning/work-packages/03-contract-foundation-and-licence-split.md#rule-wp-03.03), [WP-09.05](../planning/work-packages/09-capability-contribution-and-resource-model.md#rule-wp-09.05)"
+    },
+    {
+      "id": "I-054",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 308,
+      "coverageLine": 265,
+      "statement": "ResourceRef ≠ Permission Token",
+      "architectureHome": "`02-contracts-and-protocols.md` §5–§8",
+      "mechanism": "Type distinction",
+      "plannedVerification": "Assert `ResourceRef` is not `Permission Token`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "03",
+        "09"
+      ],
+      "ownerCell": "`03`, `09`",
+      "completionGate": "[WP-03.03](../planning/work-packages/03-contract-foundation-and-licence-split.md#rule-wp-03.03), [WP-09.05](../planning/work-packages/09-capability-contribution-and-resource-model.md#rule-wp-09.05)"
+    },
+    {
+      "id": "I-055",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 309,
+      "coverageLine": 266,
+      "statement": "ResourceRef ≠ universal domain entity",
+      "architectureHome": "`02-contracts-and-protocols.md` §5–§8",
+      "mechanism": "Type distinction",
+      "plannedVerification": "Assert `ResourceRef` is not `universal domain entity`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "03",
+        "09"
+      ],
+      "ownerCell": "`03`, `09`",
+      "completionGate": "[WP-03.03](../planning/work-packages/03-contract-foundation-and-licence-split.md#rule-wp-03.03), [WP-09.05](../planning/work-packages/09-capability-contribution-and-resource-model.md#rule-wp-09.05)"
+    },
+    {
+      "id": "I-056",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 310,
+      "coverageLine": 267,
+      "statement": "ResourceRef ≠ Resource Selection",
+      "architectureHome": "`02-contracts-and-protocols.md` §5–§8",
+      "mechanism": "Type distinction",
+      "plannedVerification": "Assert `ResourceRef` is not `Resource Selection`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "03",
+        "09"
+      ],
+      "ownerCell": "`03`, `09`",
+      "completionGate": "[WP-03.03](../planning/work-packages/03-contract-foundation-and-licence-split.md#rule-wp-03.03), [WP-09.05](../planning/work-packages/09-capability-contribution-and-resource-model.md#rule-wp-09.05)"
+    },
+    {
+      "id": "I-057",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 311,
+      "coverageLine": 268,
+      "statement": "ResourceRef ≠ Search Result",
+      "architectureHome": "`02-contracts-and-protocols.md` §5–§8",
+      "mechanism": "Type distinction",
+      "plannedVerification": "Assert `ResourceRef` is not `Search Result`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "03",
+        "09"
+      ],
+      "ownerCell": "`03`, `09`",
+      "completionGate": "[WP-03.03](../planning/work-packages/03-contract-foundation-and-licence-split.md#rule-wp-03.03), [WP-09.05](../planning/work-packages/09-capability-contribution-and-resource-model.md#rule-wp-09.05)"
+    },
+    {
+      "id": "I-058",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 312,
+      "coverageLine": 269,
+      "statement": "Artifact ≠ Resource",
+      "architectureHome": "`02-contracts-and-protocols.md` §5–§8",
+      "mechanism": "Type distinction",
+      "plannedVerification": "Assert `Artifact` is not `Resource`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "03",
+        "09"
+      ],
+      "ownerCell": "`03`, `09`",
+      "completionGate": "[WP-03.03](../planning/work-packages/03-contract-foundation-and-licence-split.md#rule-wp-03.03), [WP-09.05](../planning/work-packages/09-capability-contribution-and-resource-model.md#rule-wp-09.05)"
+    },
+    {
+      "id": "I-059",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 313,
+      "coverageLine": 270,
+      "statement": "ArtifactRef ≠ ResourceRef",
+      "architectureHome": "`02-contracts-and-protocols.md` §5–§8",
+      "mechanism": "Type distinction",
+      "plannedVerification": "Assert `ArtifactRef` is not `ResourceRef`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "03",
+        "09"
+      ],
+      "ownerCell": "`03`, `09`",
+      "completionGate": "[WP-03.03](../planning/work-packages/03-contract-foundation-and-licence-split.md#rule-wp-03.03), [WP-09.05](../planning/work-packages/09-capability-contribution-and-resource-model.md#rule-wp-09.05)"
+    },
+    {
+      "id": "I-077",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 314,
+      "coverageLine": 271,
+      "statement": "ArtifactRef ≠ Permission Token",
+      "architectureHome": "`02-contracts-and-protocols.md` §5–§8",
+      "mechanism": "Type distinction",
+      "plannedVerification": "Assert `ArtifactRef` is not `Permission Token`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "03",
+        "09"
+      ],
+      "ownerCell": "`03`, `09`",
+      "completionGate": "[WP-03.03](../planning/work-packages/03-contract-foundation-and-licence-split.md#rule-wp-03.03), [WP-09.05](../planning/work-packages/09-capability-contribution-and-resource-model.md#rule-wp-09.05)"
+    },
+    {
+      "id": "I-060",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 315,
+      "coverageLine": 272,
+      "statement": "Artifact Preview ≠ Artifact Authority",
+      "architectureHome": "`02-contracts-and-protocols.md` §5–§8",
+      "mechanism": "Type distinction",
+      "plannedVerification": "Assert `Artifact Preview` is not `Artifact Authority`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "03",
+        "09"
+      ],
+      "ownerCell": "`03`, `09`",
+      "completionGate": "[WP-03.03](../planning/work-packages/03-contract-foundation-and-licence-split.md#rule-wp-03.03), [WP-09.05](../planning/work-packages/09-capability-contribution-and-resource-model.md#rule-wp-09.05)"
+    },
+    {
+      "id": "I-061",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 316,
+      "coverageLine": 273,
+      "statement": "Cloud Artifact Copy ≠ source professional resource",
+      "architectureHome": "`02-contracts-and-protocols.md` §5–§8",
+      "mechanism": "Type distinction",
+      "plannedVerification": "Assert `Cloud Artifact Copy` is not `source professional resource`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "03",
+        "09"
+      ],
+      "ownerCell": "`03`, `09`",
+      "completionGate": "[WP-03.03](../planning/work-packages/03-contract-foundation-and-licence-split.md#rule-wp-03.03), [WP-09.05](../planning/work-packages/09-capability-contribution-and-resource-model.md#rule-wp-09.05)"
+    },
+    {
+      "id": "I-062",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 317,
+      "coverageLine": 274,
+      "statement": "Deep Link ≠ Command",
+      "architectureHome": "`02-contracts-and-protocols.md` §5–§8",
+      "mechanism": "Type distinction",
+      "plannedVerification": "Assert `Deep Link` is not `Command`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "03",
+        "09"
+      ],
+      "ownerCell": "`03`, `09`",
+      "completionGate": "[WP-03.03](../planning/work-packages/03-contract-foundation-and-licence-split.md#rule-wp-03.03), [WP-09.05](../planning/work-packages/09-capability-contribution-and-resource-model.md#rule-wp-09.05)"
+    },
+    {
+      "id": "I-063",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 318,
+      "coverageLine": 275,
+      "statement": "Deep Link ≠ Permission Token",
+      "architectureHome": "`02-contracts-and-protocols.md` §5–§8",
+      "mechanism": "Type distinction",
+      "plannedVerification": "Assert `Deep Link` is not `Permission Token`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "03",
+        "09"
+      ],
+      "ownerCell": "`03`, `09`",
+      "completionGate": "[WP-03.03](../planning/work-packages/03-contract-foundation-and-licence-split.md#rule-wp-03.03), [WP-09.05](../planning/work-packages/09-capability-contribution-and-resource-model.md#rule-wp-09.05)"
+    },
+    {
+      "id": "I-064",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 319,
+      "coverageLine": 276,
+      "statement": "Event ≠ Command",
+      "architectureHome": "`02-contracts-and-protocols.md` §5–§8",
+      "mechanism": "Type distinction",
+      "plannedVerification": "Assert `Event` is not `Command`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "03",
+        "09"
+      ],
+      "ownerCell": "`03`, `09`",
+      "completionGate": "[WP-03.03](../planning/work-packages/03-contract-foundation-and-licence-split.md#rule-wp-03.03), [WP-09.05](../planning/work-packages/09-capability-contribution-and-resource-model.md#rule-wp-09.05)"
+    },
+    {
+      "id": "I-065",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 320,
+      "coverageLine": 277,
+      "statement": "Event ≠ Realtime Signal",
+      "architectureHome": "`02-contracts-and-protocols.md` §5–§8",
+      "mechanism": "Type distinction",
+      "plannedVerification": "Assert `Event` is not `Realtime Signal`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "03",
+        "09"
+      ],
+      "ownerCell": "`03`, `09`",
+      "completionGate": "[WP-03.03](../planning/work-packages/03-contract-foundation-and-licence-split.md#rule-wp-03.03), [WP-09.05](../planning/work-packages/09-capability-contribution-and-resource-model.md#rule-wp-09.05)"
+    },
+    {
+      "id": "I-066",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 321,
+      "coverageLine": 278,
+      "statement": "Realtime Event Delivery ≠ Persistent Truth",
+      "architectureHome": "`02-contracts-and-protocols.md` §5–§8",
+      "mechanism": "Type distinction",
+      "plannedVerification": "Assert `Realtime Event Delivery` is not `Persistent Truth`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "03",
+        "09"
+      ],
+      "ownerCell": "`03`, `09`",
+      "completionGate": "[WP-03.03](../planning/work-packages/03-contract-foundation-and-licence-split.md#rule-wp-03.03), [WP-09.05](../planning/work-packages/09-capability-contribution-and-resource-model.md#rule-wp-09.05)"
+    },
+    {
+      "id": "I-067",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 322,
+      "coverageLine": 279,
+      "statement": "Health ≠ Presence",
+      "architectureHome": "`02-contracts-and-protocols.md` §5–§8",
+      "mechanism": "Type distinction",
+      "plannedVerification": "Assert `Health` is not `Presence`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "03",
+        "09"
+      ],
+      "ownerCell": "`03`, `09`",
+      "completionGate": "[WP-03.03](../planning/work-packages/03-contract-foundation-and-licence-split.md#rule-wp-03.03), [WP-09.05](../planning/work-packages/09-capability-contribution-and-resource-model.md#rule-wp-09.05)"
+    },
+    {
+      "id": "I-068",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 323,
+      "coverageLine": 280,
+      "statement": "Presence ≠ Readiness",
+      "architectureHome": "`02-contracts-and-protocols.md` §5–§8",
+      "mechanism": "Type distinction",
+      "plannedVerification": "Assert `Presence` is not `Readiness`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "03",
+        "09"
+      ],
+      "ownerCell": "`03`, `09`",
+      "completionGate": "[WP-03.03](../planning/work-packages/03-contract-foundation-and-licence-split.md#rule-wp-03.03), [WP-09.05](../planning/work-packages/09-capability-contribution-and-resource-model.md#rule-wp-09.05)"
+    },
+    {
+      "id": "I-069",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 324,
+      "coverageLine": 281,
+      "statement": "Health ≠ Compatibility",
+      "architectureHome": "`02-contracts-and-protocols.md` §5–§8",
+      "mechanism": "Type distinction",
+      "plannedVerification": "Assert `Health` is not `Compatibility`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "03",
+        "09"
+      ],
+      "ownerCell": "`03`, `09`",
+      "completionGate": "[WP-03.03](../planning/work-packages/03-contract-foundation-and-licence-split.md#rule-wp-03.03), [WP-09.05](../planning/work-packages/09-capability-contribution-and-resource-model.md#rule-wp-09.05)"
+    },
+    {
+      "id": "I-070",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 325,
+      "coverageLine": 282,
+      "statement": "Health ≠ Trust",
+      "architectureHome": "`02-contracts-and-protocols.md` §5–§8",
+      "mechanism": "Type distinction",
+      "plannedVerification": "Assert `Health` is not `Trust`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "03",
+        "09"
+      ],
+      "ownerCell": "`03`, `09`",
+      "completionGate": "[WP-03.03](../planning/work-packages/03-contract-foundation-and-licence-split.md#rule-wp-03.03), [WP-09.05](../planning/work-packages/09-capability-contribution-and-resource-model.md#rule-wp-09.05)"
+    },
+    {
+      "id": "I-071",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 326,
+      "coverageLine": 283,
+      "statement": "Health ≠ Capability Availability",
+      "architectureHome": "`02-contracts-and-protocols.md` §5–§8",
+      "mechanism": "Type distinction",
+      "plannedVerification": "Assert `Health` is not `Capability Availability`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "03",
+        "09"
+      ],
+      "ownerCell": "`03`, `09`",
+      "completionGate": "[WP-03.03](../planning/work-packages/03-contract-foundation-and-licence-split.md#rule-wp-03.03), [WP-09.05](../planning/work-packages/09-capability-contribution-and-resource-model.md#rule-wp-09.05)"
+    },
+    {
+      "id": "I-072",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 327,
+      "coverageLine": 284,
+      "statement": "Compatibility ≠ Feature Flag",
+      "architectureHome": "`02-contracts-and-protocols.md` §5–§8",
+      "mechanism": "Type distinction",
+      "plannedVerification": "Assert `Compatibility` is not `Feature Flag`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "03",
+        "09"
+      ],
+      "ownerCell": "`03`, `09`",
+      "completionGate": "[WP-03.03](../planning/work-packages/03-contract-foundation-and-licence-split.md#rule-wp-03.03), [WP-09.05](../planning/work-packages/09-capability-contribution-and-resource-model.md#rule-wp-09.05)"
+    },
+    {
+      "id": "I-073",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 328,
+      "coverageLine": 285,
+      "statement": "InvocationId ≠ CommandId",
+      "architectureHome": "`02-contracts-and-protocols.md` §5–§8",
+      "mechanism": "Type distinction",
+      "plannedVerification": "Assert `InvocationId` is not `CommandId`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "03",
+        "09"
+      ],
+      "ownerCell": "`03`, `09`",
+      "completionGate": "[WP-03.03](../planning/work-packages/03-contract-foundation-and-licence-split.md#rule-wp-03.03), [WP-09.05](../planning/work-packages/09-capability-contribution-and-resource-model.md#rule-wp-09.05)"
+    },
+    {
+      "id": "I-074",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 329,
+      "coverageLine": 286,
+      "statement": "Invocation ≠ Task Step",
+      "architectureHome": "`02-contracts-and-protocols.md` §5–§8",
+      "mechanism": "Type distinction",
+      "plannedVerification": "Assert `Invocation` is not `Task Step`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "03",
+        "09"
+      ],
+      "ownerCell": "`03`, `09`",
+      "completionGate": "[WP-03.03](../planning/work-packages/03-contract-foundation-and-licence-split.md#rule-wp-03.03), [WP-09.05](../planning/work-packages/09-capability-contribution-and-resource-model.md#rule-wp-09.05)"
+    },
+    {
+      "id": "I-075",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 330,
+      "coverageLine": 287,
+      "statement": "TaskHandle ≠ RPC Connection",
+      "architectureHome": "`02-contracts-and-protocols.md` §5–§8",
+      "mechanism": "Type distinction",
+      "plannedVerification": "Assert `TaskHandle` is not `RPC Connection`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "03",
+        "09"
+      ],
+      "ownerCell": "`03`, `09`",
+      "completionGate": "[WP-03.03](../planning/work-packages/03-contract-foundation-and-licence-split.md#rule-wp-03.03), [WP-09.05](../planning/work-packages/09-capability-contribution-and-resource-model.md#rule-wp-09.05)"
+    },
+    {
+      "id": "I-076",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 331,
+      "coverageLine": 288,
+      "statement": "MCP Resource ≠ ArcForges Resource",
+      "architectureHome": "`02-contracts-and-protocols.md` §5–§8",
+      "mechanism": "Type distinction",
+      "plannedVerification": "Assert `MCP Resource` is not `ArcForges Resource`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "03",
+        "09"
+      ],
+      "ownerCell": "`03`, `09`",
+      "completionGate": "[WP-03.03](../planning/work-packages/03-contract-foundation-and-licence-split.md#rule-wp-03.03), [WP-09.05](../planning/work-packages/09-capability-contribution-and-resource-model.md#rule-wp-09.05)"
+    },
+    {
+      "id": "I-080",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 337,
+      "coverageLine": 289,
+      "statement": "Intent ≠ Task",
+      "architectureHome": "`09-ai-and-agent-runtime-architecture.md` §3–§4",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Intent` is not `Task`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "04",
+        "52"
+      ],
+      "ownerCell": "`04`, `52`",
+      "completionGate": "[WP-04.01](../planning/work-packages/04-identity-error-and-versioning-primitives.md#rule-wp-04.01), [WP-52.00](../planning/work-packages/52-cloud-harness.md#rule-wp-52.00)"
+    },
+    {
+      "id": "I-081",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 338,
+      "coverageLine": 290,
+      "statement": "Task ≠ Run",
+      "architectureHome": "`09-ai-and-agent-runtime-architecture.md` §3–§4",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Task` is not `Run`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "04",
+        "52"
+      ],
+      "ownerCell": "`04`, `52`",
+      "completionGate": "[WP-04.01](../planning/work-packages/04-identity-error-and-versioning-primitives.md#rule-wp-04.01), [WP-52.00](../planning/work-packages/52-cloud-harness.md#rule-wp-52.00)"
+    },
+    {
+      "id": "I-082",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 339,
+      "coverageLine": 291,
+      "statement": "Run ≠ Step",
+      "architectureHome": "`09-ai-and-agent-runtime-architecture.md` §3–§4",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Run` is not `Step`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "04",
+        "52"
+      ],
+      "ownerCell": "`04`, `52`",
+      "completionGate": "[WP-04.01](../planning/work-packages/04-identity-error-and-versioning-primitives.md#rule-wp-04.01), [WP-52.00](../planning/work-packages/52-cloud-harness.md#rule-wp-52.00)"
+    },
+    {
+      "id": "I-083",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 340,
+      "coverageLine": 292,
+      "statement": "Step ≠ Attempt",
+      "architectureHome": "`09-ai-and-agent-runtime-architecture.md` §3–§4",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Step` is not `Attempt`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "04",
+        "52"
+      ],
+      "ownerCell": "`04`, `52`",
+      "completionGate": "[WP-04.01](../planning/work-packages/04-identity-error-and-versioning-primitives.md#rule-wp-04.01), [WP-52.00](../planning/work-packages/52-cloud-harness.md#rule-wp-52.00)"
+    },
+    {
+      "id": "I-084",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 341,
+      "coverageLine": 293,
+      "statement": "Step ≠ Capability Invocation",
+      "architectureHome": "`09-ai-and-agent-runtime-architecture.md` §3–§4",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Step` is not `Capability Invocation`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "04",
+        "52"
+      ],
+      "ownerCell": "`04`, `52`",
+      "completionGate": "[WP-04.01](../planning/work-packages/04-identity-error-and-versioning-primitives.md#rule-wp-04.01), [WP-52.00](../planning/work-packages/52-cloud-harness.md#rule-wp-52.00)"
+    },
+    {
+      "id": "I-085",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 342,
+      "coverageLine": 294,
+      "statement": "AttemptId ≠ CommandId",
+      "architectureHome": "`09-ai-and-agent-runtime-architecture.md` §3–§4",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `AttemptId` is not `CommandId`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "04",
+        "52"
+      ],
+      "ownerCell": "`04`, `52`",
+      "completionGate": "[WP-04.01](../planning/work-packages/04-identity-error-and-versioning-primitives.md#rule-wp-04.01), [WP-52.00](../planning/work-packages/52-cloud-harness.md#rule-wp-52.00)"
+    },
+    {
+      "id": "I-086",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 343,
+      "coverageLine": 295,
+      "statement": "Task Retry ≠ Step Retry",
+      "architectureHome": "`09-ai-and-agent-runtime-architecture.md` §3–§4",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Task Retry` is not `Step Retry`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "04",
+        "52"
+      ],
+      "ownerCell": "`04`, `52`",
+      "completionGate": "[WP-04.01](../planning/work-packages/04-identity-error-and-versioning-primitives.md#rule-wp-04.01), [WP-52.00](../planning/work-packages/52-cloud-harness.md#rule-wp-52.00)"
+    },
+    {
+      "id": "I-087",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 344,
+      "coverageLine": 296,
+      "statement": "Retry ≠ Resume",
+      "architectureHome": "`09-ai-and-agent-runtime-architecture.md` §3–§4",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Retry` is not `Resume`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "04",
+        "52"
+      ],
+      "ownerCell": "`04`, `52`",
+      "completionGate": "[WP-04.01](../planning/work-packages/04-identity-error-and-versioning-primitives.md#rule-wp-04.01), [WP-52.00](../planning/work-packages/52-cloud-harness.md#rule-wp-52.00)"
+    },
+    {
+      "id": "I-088",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 345,
+      "coverageLine": 297,
+      "statement": "Retry ≠ Run Again",
+      "architectureHome": "`09-ai-and-agent-runtime-architecture.md` §3–§4",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Retry` is not `Run Again`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "04",
+        "52"
+      ],
+      "ownerCell": "`04`, `52`",
+      "completionGate": "[WP-04.01](../planning/work-packages/04-identity-error-and-versioning-primitives.md#rule-wp-04.01), [WP-52.00](../planning/work-packages/52-cloud-harness.md#rule-wp-52.00)"
+    },
+    {
+      "id": "I-089",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 346,
+      "coverageLine": 298,
+      "statement": "Pause ≠ Waiting",
+      "architectureHome": "`09-ai-and-agent-runtime-architecture.md` §3–§4",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Pause` is not `Waiting`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "04",
+        "52"
+      ],
+      "ownerCell": "`04`, `52`",
+      "completionGate": "[WP-04.01](../planning/work-packages/04-identity-error-and-versioning-primitives.md#rule-wp-04.01), [WP-52.00](../planning/work-packages/52-cloud-harness.md#rule-wp-52.00)"
+    },
+    {
+      "id": "I-090",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 347,
+      "coverageLine": 299,
+      "statement": "Waiting ≠ Interrupted",
+      "architectureHome": "`09-ai-and-agent-runtime-architecture.md` §3–§4",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Waiting` is not `Interrupted`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "04",
+        "52"
+      ],
+      "ownerCell": "`04`, `52`",
+      "completionGate": "[WP-04.01](../planning/work-packages/04-identity-error-and-versioning-primitives.md#rule-wp-04.01), [WP-52.00](../planning/work-packages/52-cloud-harness.md#rule-wp-52.00)"
+    },
+    {
+      "id": "I-091",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 348,
+      "coverageLine": 300,
+      "statement": "Needs Attention ≠ Task State",
+      "architectureHome": "`09-ai-and-agent-runtime-architecture.md` §3–§4",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Needs Attention` is not `Task State`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "04",
+        "52"
+      ],
+      "ownerCell": "`04`, `52`",
+      "completionGate": "[WP-04.01](../planning/work-packages/04-identity-error-and-versioning-primitives.md#rule-wp-04.01), [WP-52.00](../planning/work-packages/52-cloud-harness.md#rule-wp-52.00)"
+    },
+    {
+      "id": "I-092",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 349,
+      "coverageLine": 301,
+      "statement": "Cancel Requested ≠ Canceled",
+      "architectureHome": "`09-ai-and-agent-runtime-architecture.md` §3–§4",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Cancel Requested` is not `Canceled`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "04",
+        "52"
+      ],
+      "ownerCell": "`04`, `52`",
+      "completionGate": "[WP-04.01](../planning/work-packages/04-identity-error-and-versioning-primitives.md#rule-wp-04.01), [WP-52.00](../planning/work-packages/52-cloud-harness.md#rule-wp-52.00)"
+    },
+    {
+      "id": "I-093",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 350,
+      "coverageLine": 302,
+      "statement": "Succeeded ≠ no exception",
+      "architectureHome": "`09-ai-and-agent-runtime-architecture.md` §3–§4",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Succeeded` is not `no exception`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "04",
+        "52"
+      ],
+      "ownerCell": "`04`, `52`",
+      "completionGate": "[WP-04.01](../planning/work-packages/04-identity-error-and-versioning-primitives.md#rule-wp-04.01), [WP-52.00](../planning/work-packages/52-cloud-harness.md#rule-wp-52.00)"
+    },
+    {
+      "id": "I-094",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 351,
+      "coverageLine": 303,
+      "statement": "Canceled ≠ no side effects",
+      "architectureHome": "`09-ai-and-agent-runtime-architecture.md` §3–§4",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Canceled` is not `no side effects`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "04",
+        "52"
+      ],
+      "ownerCell": "`04`, `52`",
+      "completionGate": "[WP-04.01](../planning/work-packages/04-identity-error-and-versioning-primitives.md#rule-wp-04.01), [WP-52.00](../planning/work-packages/52-cloud-harness.md#rule-wp-52.00)"
+    },
+    {
+      "id": "I-095",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 352,
+      "coverageLine": 304,
+      "statement": "Checkpoint ≠ Undo",
+      "architectureHome": "`09-ai-and-agent-runtime-architecture.md` §3–§4",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Checkpoint` is not `Undo`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "04",
+        "52"
+      ],
+      "ownerCell": "`04`, `52`",
+      "completionGate": "[WP-04.01](../planning/work-packages/04-identity-error-and-versioning-primitives.md#rule-wp-04.01), [WP-52.00](../planning/work-packages/52-cloud-harness.md#rule-wp-52.00)"
+    },
+    {
+      "id": "I-096",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 353,
+      "coverageLine": 305,
+      "statement": "Compensation ≠ Transaction Rollback",
+      "architectureHome": "`09-ai-and-agent-runtime-architecture.md` §3–§4",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Compensation` is not `Transaction Rollback`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "04",
+        "52"
+      ],
+      "ownerCell": "`04`, `52`",
+      "completionGate": "[WP-04.01](../planning/work-packages/04-identity-error-and-versioning-primitives.md#rule-wp-04.01), [WP-52.00](../planning/work-packages/52-cloud-harness.md#rule-wp-52.00)"
+    },
+    {
+      "id": "I-097",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 354,
+      "coverageLine": 306,
+      "statement": "Approval ≠ Permission Grant",
+      "architectureHome": "`09-ai-and-agent-runtime-architecture.md` §3–§4",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Approval` is not `Permission Grant`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "04",
+        "52"
+      ],
+      "ownerCell": "`04`, `52`",
+      "completionGate": "[WP-04.01](../planning/work-packages/04-identity-error-and-versioning-primitives.md#rule-wp-04.01), [WP-52.00](../planning/work-packages/52-cloud-harness.md#rule-wp-52.00)"
+    },
+    {
+      "id": "I-098",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 355,
+      "coverageLine": 307,
+      "statement": "Approval ≠ Steering",
+      "architectureHome": "`09-ai-and-agent-runtime-architecture.md` §3–§4",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Approval` is not `Steering`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "04",
+        "52"
+      ],
+      "ownerCell": "`04`, `52`",
+      "completionGate": "[WP-04.01](../planning/work-packages/04-identity-error-and-versioning-primitives.md#rule-wp-04.01), [WP-52.00](../planning/work-packages/52-cloud-harness.md#rule-wp-52.00)"
+    },
+    {
+      "id": "I-099",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 356,
+      "coverageLine": 308,
+      "statement": "Steering ≠ Conversation Message",
+      "architectureHome": "`09-ai-and-agent-runtime-architecture.md` §3–§4",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Steering` is not `Conversation Message`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "04",
+        "52"
+      ],
+      "ownerCell": "`04`, `52`",
+      "completionGate": "[WP-04.01](../planning/work-packages/04-identity-error-and-versioning-primitives.md#rule-wp-04.01), [WP-52.00](../planning/work-packages/52-cloud-harness.md#rule-wp-52.00)"
+    },
+    {
+      "id": "I-100",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 357,
+      "coverageLine": 309,
+      "statement": "Automation ≠ Task",
+      "architectureHome": "`09-ai-and-agent-runtime-architecture.md` §3–§4",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Automation` is not `Task`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "04",
+        "52"
+      ],
+      "ownerCell": "`04`, `52`",
+      "completionGate": "[WP-04.01](../planning/work-packages/04-identity-error-and-versioning-primitives.md#rule-wp-04.01), [WP-52.00](../planning/work-packages/52-cloud-harness.md#rule-wp-52.00)"
+    },
+    {
+      "id": "I-101",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 358,
+      "coverageLine": 310,
+      "statement": "Automation Occurrence ≠ Task Retry",
+      "architectureHome": "`09-ai-and-agent-runtime-architecture.md` §3–§4",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Automation Occurrence` is not `Task Retry`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "04",
+        "52"
+      ],
+      "ownerCell": "`04`, `52`",
+      "completionGate": "[WP-04.01](../planning/work-packages/04-identity-error-and-versioning-primitives.md#rule-wp-04.01), [WP-52.00](../planning/work-packages/52-cloud-harness.md#rule-wp-52.00)"
+    },
+    {
+      "id": "I-102",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 359,
+      "coverageLine": 311,
+      "statement": "Trigger Definition ≠ Trigger Occurrence",
+      "architectureHome": "`09-ai-and-agent-runtime-architecture.md` §3–§4",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Trigger Definition` is not `Trigger Occurrence`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "04",
+        "52"
+      ],
+      "ownerCell": "`04`, `52`",
+      "completionGate": "[WP-04.01](../planning/work-packages/04-identity-error-and-versioning-primitives.md#rule-wp-04.01), [WP-52.00](../planning/work-packages/52-cloud-harness.md#rule-wp-52.00)"
+    },
+    {
+      "id": "I-103",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 360,
+      "coverageLine": 312,
+      "statement": "Automation Disable ≠ cancel running Task",
+      "architectureHome": "`09-ai-and-agent-runtime-architecture.md` §3–§4",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Automation Disable` is not `cancel running Task`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "04",
+        "52"
+      ],
+      "ownerCell": "`04`, `52`",
+      "completionGate": "[WP-04.01](../planning/work-packages/04-identity-error-and-versioning-primitives.md#rule-wp-04.01), [WP-52.00](../planning/work-packages/52-cloud-harness.md#rule-wp-52.00)"
+    },
+    {
+      "id": "I-104",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 361,
+      "coverageLine": 313,
+      "statement": "Automation Concurrency ≠ Step Parallelism",
+      "architectureHome": "`09-ai-and-agent-runtime-architecture.md` §3–§4",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Automation Concurrency` is not `Step Parallelism`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "04",
+        "52"
+      ],
+      "ownerCell": "`04`, `52`",
+      "completionGate": "[WP-04.01](../planning/work-packages/04-identity-error-and-versioning-primitives.md#rule-wp-04.01), [WP-52.00](../planning/work-packages/52-cloud-harness.md#rule-wp-52.00)"
+    },
+    {
+      "id": "I-105",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 362,
+      "coverageLine": 314,
+      "statement": "Hybrid tool locality ≠ additional agent runtime",
+      "architectureHome": "`09-ai-and-agent-runtime-architecture.md` §3–§4",
+      "mechanism": "Unit test",
+      "plannedVerification": "Run a Cloud Task mixing Cloud and same-application device tools; locality changes the tool owner only and never creates another planner/model loop.",
+      "owningPackages": [
+        "04",
+        "52"
+      ],
+      "ownerCell": "`04`, `52`",
+      "completionGate": "[WP-04.01](../planning/work-packages/04-identity-error-and-versioning-primitives.md#rule-wp-04.01), [WP-52.00](../planning/work-packages/52-cloud-harness.md#rule-wp-52.00)"
+    },
+    {
+      "id": "I-106",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 363,
+      "coverageLine": 315,
+      "statement": "Progress Event ≠ Task Authority",
+      "architectureHome": "`09-ai-and-agent-runtime-architecture.md` §3–§4",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Progress Event` is not `Task Authority`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "04",
+        "52"
+      ],
+      "ownerCell": "`04`, `52`",
+      "completionGate": "[WP-04.01](../planning/work-packages/04-identity-error-and-versioning-primitives.md#rule-wp-04.01), [WP-52.00](../planning/work-packages/52-cloud-harness.md#rule-wp-52.00)"
+    },
+    {
+      "id": "I-107",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 364,
+      "coverageLine": 316,
+      "statement": "Operational Trace ≠ Chain-of-Thought",
+      "architectureHome": "`09-ai-and-agent-runtime-architecture.md` §3–§4",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Operational Trace` is not `Chain-of-Thought`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "04",
+        "52"
+      ],
+      "ownerCell": "`04`, `52`",
+      "completionGate": "[WP-04.01](../planning/work-packages/04-identity-error-and-versioning-primitives.md#rule-wp-04.01), [WP-52.00](../planning/work-packages/52-cloud-harness.md#rule-wp-52.00)"
+    },
+    {
+      "id": "I-108",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 365,
+      "coverageLine": 317,
+      "statement": "Conversation ≠ Task",
+      "architectureHome": "`09-ai-and-agent-runtime-architecture.md` §3–§4",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Conversation` is not `Task`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "04",
+        "52"
+      ],
+      "ownerCell": "`04`, `52`",
+      "completionGate": "[WP-04.01](../planning/work-packages/04-identity-error-and-versioning-primitives.md#rule-wp-04.01), [WP-52.00](../planning/work-packages/52-cloud-harness.md#rule-wp-52.00)"
+    },
+    {
+      "id": "I-109",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 366,
+      "coverageLine": 318,
+      "statement": "Message ≠ Tool Call",
+      "architectureHome": "`09-ai-and-agent-runtime-architecture.md` §3–§4",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Message` is not `Tool Call`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "04",
+        "52"
+      ],
+      "ownerCell": "`04`, `52`",
+      "completionGate": "[WP-04.01](../planning/work-packages/04-identity-error-and-versioning-primitives.md#rule-wp-04.01), [WP-52.00](../planning/work-packages/52-cloud-harness.md#rule-wp-52.00)"
+    },
+    {
+      "id": "I-110",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 367,
+      "coverageLine": 319,
+      "statement": "Attachment ≠ Context Reference",
+      "architectureHome": "`09-ai-and-agent-runtime-architecture.md` §3–§4",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Attachment` is not `Context Reference`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "04",
+        "52"
+      ],
+      "ownerCell": "`04`, `52`",
+      "completionGate": "[WP-04.01](../planning/work-packages/04-identity-error-and-versioning-primitives.md#rule-wp-04.01), [WP-52.00](../planning/work-packages/52-cloud-harness.md#rule-wp-52.00)"
+    },
+    {
+      "id": "I-111",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 368,
+      "coverageLine": 320,
+      "statement": "Input Attachment ≠ Artifact",
+      "architectureHome": "`09-ai-and-agent-runtime-architecture.md` §3–§4",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Input Attachment` is not `Artifact`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "04",
+        "52"
+      ],
+      "ownerCell": "`04`, `52`",
+      "completionGate": "[WP-04.01](../planning/work-packages/04-identity-error-and-versioning-primitives.md#rule-wp-04.01), [WP-52.00](../planning/work-packages/52-cloud-harness.md#rule-wp-52.00)"
+    },
+    {
+      "id": "I-112",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 369,
+      "coverageLine": 321,
+      "statement": "Agent Profile ≠ Running Agent",
+      "architectureHome": "`09-ai-and-agent-runtime-architecture.md` §3–§4",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Agent Profile` is not `Running Agent`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "04",
+        "52"
+      ],
+      "ownerCell": "`04`, `52`",
+      "completionGate": "[WP-04.01](../planning/work-packages/04-identity-error-and-versioning-primitives.md#rule-wp-04.01), [WP-52.00](../planning/work-packages/52-cloud-harness.md#rule-wp-52.00)"
+    },
+    {
+      "id": "I-113",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 370,
+      "coverageLine": 322,
+      "statement": "Agent Profile ≠ Model",
+      "architectureHome": "`09-ai-and-agent-runtime-architecture.md` §3–§4",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Agent Profile` is not `Model`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "04",
+        "52"
+      ],
+      "ownerCell": "`04`, `52`",
+      "completionGate": "[WP-04.01](../planning/work-packages/04-identity-error-and-versioning-primitives.md#rule-wp-04.01), [WP-52.00](../planning/work-packages/52-cloud-harness.md#rule-wp-52.00)"
+    },
+    {
+      "id": "I-114",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 371,
+      "coverageLine": 323,
+      "statement": "Agent Profile ≠ running agent; external-agent execution is excluded",
+      "architectureHome": "`09-ai-and-agent-runtime-architecture.md` §3–§4",
+      "mechanism": "Unit test",
+      "plannedVerification": "Load a profile as validated data; it creates no process, external agent adapter or capability grant.",
+      "owningPackages": [
+        "04",
+        "52"
+      ],
+      "ownerCell": "`04`, `52`",
+      "completionGate": "[WP-04.01](../planning/work-packages/04-identity-error-and-versioning-primitives.md#rule-wp-04.01), [WP-52.00](../planning/work-packages/52-cloud-harness.md#rule-wp-52.00)"
+    },
+    {
+      "id": "I-115",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 372,
+      "coverageLine": 324,
+      "statement": "Provider ≠ Model",
+      "architectureHome": "`09-ai-and-agent-runtime-architecture.md` §3–§4",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Provider` is not `Model`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "04",
+        "52"
+      ],
+      "ownerCell": "`04`, `52`",
+      "completionGate": "[WP-04.01](../planning/work-packages/04-identity-error-and-versioning-primitives.md#rule-wp-04.01), [WP-52.00](../planning/work-packages/52-cloud-harness.md#rule-wp-52.00)"
+    },
+    {
+      "id": "I-116",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 373,
+      "coverageLine": 325,
+      "statement": "Provider ≠ AI Source",
+      "architectureHome": "`09-ai-and-agent-runtime-architecture.md` §3–§4",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Provider` is not `AI Source`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "04",
+        "52"
+      ],
+      "ownerCell": "`04`, `52`",
+      "completionGate": "[WP-04.01](../planning/work-packages/04-identity-error-and-versioning-primitives.md#rule-wp-04.01), [WP-52.00](../planning/work-packages/52-cloud-harness.md#rule-wp-52.00)"
+    },
+    {
+      "id": "I-117",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 374,
+      "coverageLine": 326,
+      "statement": "Chat Mode ≠ no tools",
+      "architectureHome": "`09-ai-and-agent-runtime-architecture.md` §3–§4",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Chat Mode` is not `no tools`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "04",
+        "52"
+      ],
+      "ownerCell": "`04`, `52`",
+      "completionGate": "[WP-04.01](../planning/work-packages/04-identity-error-and-versioning-primitives.md#rule-wp-04.01), [WP-52.00](../planning/work-packages/52-cloud-harness.md#rule-wp-52.00)"
+    },
+    {
+      "id": "I-118",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 375,
+      "coverageLine": 327,
+      "statement": "Agent Mode ≠ unlimited permission",
+      "architectureHome": "`09-ai-and-agent-runtime-architecture.md` §3–§4",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Agent Mode` is not `unlimited permission`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "04",
+        "52"
+      ],
+      "ownerCell": "`04`, `52`",
+      "completionGate": "[WP-04.01](../planning/work-packages/04-identity-error-and-versioning-primitives.md#rule-wp-04.01), [WP-52.00](../planning/work-packages/52-cloud-harness.md#rule-wp-52.00)"
+    },
+    {
+      "id": "I-119",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 376,
+      "coverageLine": 328,
+      "statement": "Task Creation Authorization ≠ lifetime authorization",
+      "architectureHome": "`09-ai-and-agent-runtime-architecture.md` §3–§4",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Task Creation Authorization` is not `lifetime authorization`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "04",
+        "52"
+      ],
+      "ownerCell": "`04`, `52`",
+      "completionGate": "[WP-04.01](../planning/work-packages/04-identity-error-and-versioning-primitives.md#rule-wp-04.01), [WP-52.00](../planning/work-packages/52-cloud-harness.md#rule-wp-52.00)"
+    },
+    {
+      "id": "I-120",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 377,
+      "coverageLine": 329,
+      "statement": "Remote Task ≠ Remote Desktop",
+      "architectureHome": "`09-ai-and-agent-runtime-architecture.md` §3–§4",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Remote Task` is not `Remote Desktop`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "04",
+        "52"
+      ],
+      "ownerCell": "`04`, `52`",
+      "completionGate": "[WP-04.01](../planning/work-packages/04-identity-error-and-versioning-primitives.md#rule-wp-04.01), [WP-52.00](../planning/work-packages/52-cloud-harness.md#rule-wp-52.00)"
+    },
+    {
+      "id": "I-121",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 378,
+      "coverageLine": 330,
+      "statement": "Cloud Agent Task ≠ native Product Job",
+      "architectureHome": "`09-ai-and-agent-runtime-architecture.md` §3–§4",
+      "mechanism": "Unit test",
+      "plannedVerification": "Cancel a native Product Job and a Cloud Agent Task independently; assert distinct identities, stores, metering and recovery authority.",
+      "owningPackages": [
+        "04",
+        "52"
+      ],
+      "ownerCell": "`04`, `52`",
+      "completionGate": "[WP-04.01](../planning/work-packages/04-identity-error-and-versioning-primitives.md#rule-wp-04.01), [WP-52.00](../planning/work-packages/52-cloud-harness.md#rule-wp-52.00)"
+    },
+    {
+      "id": "I-122",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 379,
+      "coverageLine": 331,
+      "statement": "Remote Task ≠ Cloud-only Task",
+      "architectureHome": "`09-ai-and-agent-runtime-architecture.md` §3–§4",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Remote Task` is not `Cloud-only Task`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "04",
+        "52"
+      ],
+      "ownerCell": "`04`, `52`",
+      "completionGate": "[WP-04.01](../planning/work-packages/04-identity-error-and-versioning-primitives.md#rule-wp-04.01), [WP-52.00](../planning/work-packages/52-cloud-harness.md#rule-wp-52.00)"
+    },
+    {
+      "id": "I-123",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 380,
+      "coverageLine": 332,
+      "statement": "Conversation Sync ≠ Remote Task State",
+      "architectureHome": "`09-ai-and-agent-runtime-architecture.md` §3–§4",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Conversation Sync` is not `Remote Task State`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "04",
+        "52"
+      ],
+      "ownerCell": "`04`, `52`",
+      "completionGate": "[WP-04.01](../planning/work-packages/04-identity-error-and-versioning-primitives.md#rule-wp-04.01), [WP-52.00](../planning/work-packages/52-cloud-harness.md#rule-wp-52.00)"
+    },
+    {
+      "id": "I-124",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 381,
+      "coverageLine": 333,
+      "statement": "Unsent local draft ≠ acknowledged Cloud conversation",
+      "architectureHome": "`09-ai-and-agent-runtime-architecture.md` §3–§4",
+      "mechanism": "Unit test",
+      "plannedVerification": "Lose connectivity before a Cloud-history append acknowledgement; preserve the unsent draft without showing it as committed Cloud history. Local-history mode remains separately canonical under model05.",
+      "owningPackages": [
+        "04",
+        "52"
+      ],
+      "ownerCell": "`04`, `52`",
+      "completionGate": "[WP-04.01](../planning/work-packages/04-identity-error-and-versioning-primitives.md#rule-wp-04.01), [WP-52.00](../planning/work-packages/52-cloud-harness.md#rule-wp-52.00)"
+    },
+    {
+      "id": "I-125",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 382,
+      "coverageLine": 334,
+      "statement": "Continuity ≠ mirroring UI",
+      "architectureHome": "`09-ai-and-agent-runtime-architecture.md` §3–§4",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Continuity` is not `mirroring UI`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "04",
+        "52"
+      ],
+      "ownerCell": "`04`, `52`",
+      "completionGate": "[WP-04.01](../planning/work-packages/04-identity-error-and-versioning-primitives.md#rule-wp-04.01), [WP-52.00](../planning/work-packages/52-cloud-harness.md#rule-wp-52.00)"
+    },
+    {
+      "id": "I-130",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 388,
+      "coverageLine": 335,
+      "statement": "Knowledge Source ≠ Data Copy",
+      "architectureHome": "`09-ai-and-agent-runtime-architecture.md` §5",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Knowledge Source` is not `Data Copy`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "19",
+        "40"
+      ],
+      "ownerCell": "`19`, `40`",
+      "completionGate": "[WP-19.01](../planning/work-packages/19-arcnotes-search-and-portability.md#rule-wp-19.01), [WP-40.03](../planning/work-packages/40-knowledge-search-and-retrieval.md#rule-wp-40.03)"
+    },
+    {
+      "id": "I-131",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 389,
+      "coverageLine": 336,
+      "statement": "Knowledge Source ≠ Context Provider",
+      "architectureHome": "`09-ai-and-agent-runtime-architecture.md` §5",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Knowledge Source` is not `Context Provider`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "19",
+        "40"
+      ],
+      "ownerCell": "`19`, `40`",
+      "completionGate": "[WP-19.01](../planning/work-packages/19-arcnotes-search-and-portability.md#rule-wp-19.01), [WP-40.03](../planning/work-packages/40-knowledge-search-and-retrieval.md#rule-wp-40.03)"
+    },
+    {
+      "id": "I-132",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 390,
+      "coverageLine": 337,
+      "statement": "Knowledge Source ≠ Import",
+      "architectureHome": "`09-ai-and-agent-runtime-architecture.md` §5",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Knowledge Source` is not `Import`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "19",
+        "40"
+      ],
+      "ownerCell": "`19`, `40`",
+      "completionGate": "[WP-19.01](../planning/work-packages/19-arcnotes-search-and-portability.md#rule-wp-19.01), [WP-40.03](../planning/work-packages/40-knowledge-search-and-retrieval.md#rule-wp-40.03)"
+    },
+    {
+      "id": "I-133",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 391,
+      "coverageLine": 338,
+      "statement": "Knowledge Scope ≠ Index Scope",
+      "architectureHome": "`09-ai-and-agent-runtime-architecture.md` §5",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Knowledge Scope` is not `Index Scope`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "19",
+        "40"
+      ],
+      "ownerCell": "`19`, `40`",
+      "completionGate": "[WP-19.01](../planning/work-packages/19-arcnotes-search-and-portability.md#rule-wp-19.01), [WP-40.03](../planning/work-packages/40-knowledge-search-and-retrieval.md#rule-wp-40.03)"
+    },
+    {
+      "id": "I-134",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 392,
+      "coverageLine": 339,
+      "statement": "Index ≠ Canonical Data",
+      "architectureHome": "`09-ai-and-agent-runtime-architecture.md` §5",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Index` is not `Canonical Data`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "19",
+        "40"
+      ],
+      "ownerCell": "`19`, `40`",
+      "completionGate": "[WP-19.01](../planning/work-packages/19-arcnotes-search-and-portability.md#rule-wp-19.01), [WP-40.03](../planning/work-packages/40-knowledge-search-and-retrieval.md#rule-wp-40.03)"
+    },
+    {
+      "id": "I-135",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 393,
+      "coverageLine": 340,
+      "statement": "Search Index ≠ Knowledge Authority",
+      "architectureHome": "`09-ai-and-agent-runtime-architecture.md` §5",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Search Index` is not `Knowledge Authority`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "19",
+        "40"
+      ],
+      "ownerCell": "`19`, `40`",
+      "completionGate": "[WP-19.01](../planning/work-packages/19-arcnotes-search-and-portability.md#rule-wp-19.01), [WP-40.03](../planning/work-packages/40-knowledge-search-and-retrieval.md#rule-wp-40.03)"
+    },
+    {
+      "id": "I-136",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 394,
+      "coverageLine": 341,
+      "statement": "Search Index ≠ User Data Authority",
+      "architectureHome": "`09-ai-and-agent-runtime-architecture.md` §5",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Search Index` is not `User Data Authority`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "19",
+        "40"
+      ],
+      "ownerCell": "`19`, `40`",
+      "completionGate": "[WP-19.01](../planning/work-packages/19-arcnotes-search-and-portability.md#rule-wp-19.01), [WP-40.03](../planning/work-packages/40-knowledge-search-and-retrieval.md#rule-wp-40.03)"
+    },
+    {
+      "id": "I-137",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 395,
+      "coverageLine": 342,
+      "statement": "Knowledge Index ≠ Document Copy",
+      "architectureHome": "`09-ai-and-agent-runtime-architecture.md` §5",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Knowledge Index` is not `Document Copy`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "19",
+        "40"
+      ],
+      "ownerCell": "`19`, `40`",
+      "completionGate": "[WP-19.01](../planning/work-packages/19-arcnotes-search-and-portability.md#rule-wp-19.01), [WP-40.03](../planning/work-packages/40-knowledge-search-and-retrieval.md#rule-wp-40.03)"
+    },
+    {
+      "id": "I-138",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 396,
+      "coverageLine": 343,
+      "statement": "Semantic Index ≠ Knowledge",
+      "architectureHome": "`09-ai-and-agent-runtime-architecture.md` §5",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Semantic Index` is not `Knowledge`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "19",
+        "40"
+      ],
+      "ownerCell": "`19`, `40`",
+      "completionGate": "[WP-19.01](../planning/work-packages/19-arcnotes-search-and-portability.md#rule-wp-19.01), [WP-40.03](../planning/work-packages/40-knowledge-search-and-retrieval.md#rule-wp-40.03)"
+    },
+    {
+      "id": "I-139",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 397,
+      "coverageLine": 344,
+      "statement": "Embedding ≠ Permission",
+      "architectureHome": "`09-ai-and-agent-runtime-architecture.md` §5",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Embedding` is not `Permission`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "19",
+        "40"
+      ],
+      "ownerCell": "`19`, `40`",
+      "completionGate": "[WP-19.01](../planning/work-packages/19-arcnotes-search-and-portability.md#rule-wp-19.01), [WP-40.03](../planning/work-packages/40-knowledge-search-and-retrieval.md#rule-wp-40.03)"
+    },
+    {
+      "id": "I-140",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 398,
+      "coverageLine": 345,
+      "statement": "Cloud Sync ≠ Cloud Index",
+      "architectureHome": "`09-ai-and-agent-runtime-architecture.md` §5",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Cloud Sync` is not `Cloud Index`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "19",
+        "40"
+      ],
+      "ownerCell": "`19`, `40`",
+      "completionGate": "[WP-19.01](../planning/work-packages/19-arcnotes-search-and-portability.md#rule-wp-19.01), [WP-40.03](../planning/work-packages/40-knowledge-search-and-retrieval.md#rule-wp-40.03)"
+    },
+    {
+      "id": "I-141",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 399,
+      "coverageLine": 346,
+      "statement": "Cloud Index ≠ AI Retrieval",
+      "architectureHome": "`09-ai-and-agent-runtime-architecture.md` §5",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Cloud Index` is not `AI Retrieval`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "19",
+        "40"
+      ],
+      "ownerCell": "`19`, `40`",
+      "completionGate": "[WP-19.01](../planning/work-packages/19-arcnotes-search-and-portability.md#rule-wp-19.01), [WP-40.03](../planning/work-packages/40-knowledge-search-and-retrieval.md#rule-wp-40.03)"
+    },
+    {
+      "id": "I-142",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 400,
+      "coverageLine": 347,
+      "statement": "Cloud Search ≠ Cloud AI Indexing",
+      "architectureHome": "`09-ai-and-agent-runtime-architecture.md` §5",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Cloud Search` is not `Cloud AI Indexing`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "19",
+        "40"
+      ],
+      "ownerCell": "`19`, `40`",
+      "completionGate": "[WP-19.01](../planning/work-packages/19-arcnotes-search-and-portability.md#rule-wp-19.01), [WP-40.03](../planning/work-packages/40-knowledge-search-and-retrieval.md#rule-wp-40.03)"
+    },
+    {
+      "id": "I-143",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 401,
+      "coverageLine": 348,
+      "statement": "AI Retrieval ≠ Managed AI Processing",
+      "architectureHome": "`09-ai-and-agent-runtime-architecture.md` §5",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `AI Retrieval` is not `Managed AI Processing`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "19",
+        "40"
+      ],
+      "ownerCell": "`19`, `40`",
+      "completionGate": "[WP-19.01](../planning/work-packages/19-arcnotes-search-and-portability.md#rule-wp-19.01), [WP-40.03](../planning/work-packages/40-knowledge-search-and-retrieval.md#rule-wp-40.03)"
+    },
+    {
+      "id": "I-144",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 402,
+      "coverageLine": 349,
+      "statement": "Exclude from AI ≠ Exclude from Search",
+      "architectureHome": "`09-ai-and-agent-runtime-architecture.md` §5",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Exclude from AI` is not `Exclude from Search`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "19",
+        "40"
+      ],
+      "ownerCell": "`19`, `40`",
+      "completionGate": "[WP-19.01](../planning/work-packages/19-arcnotes-search-and-portability.md#rule-wp-19.01), [WP-40.03](../planning/work-packages/40-knowledge-search-and-retrieval.md#rule-wp-40.03)"
+    },
+    {
+      "id": "I-145",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 403,
+      "coverageLine": 350,
+      "statement": "Keyword Search ≠ Semantic Search",
+      "architectureHome": "`09-ai-and-agent-runtime-architecture.md` §5",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Keyword Search` is not `Semantic Search`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "19",
+        "40"
+      ],
+      "ownerCell": "`19`, `40`",
+      "completionGate": "[WP-19.01](../planning/work-packages/19-arcnotes-search-and-portability.md#rule-wp-19.01), [WP-40.03](../planning/work-packages/40-knowledge-search-and-retrieval.md#rule-wp-40.03)"
+    },
+    {
+      "id": "I-146",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 404,
+      "coverageLine": 351,
+      "statement": "Search ≠ Retrieval",
+      "architectureHome": "`09-ai-and-agent-runtime-architecture.md` §5",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Search` is not `Retrieval`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "19",
+        "40"
+      ],
+      "ownerCell": "`19`, `40`",
+      "completionGate": "[WP-19.01](../planning/work-packages/19-arcnotes-search-and-portability.md#rule-wp-19.01), [WP-40.03](../planning/work-packages/40-knowledge-search-and-retrieval.md#rule-wp-40.03)"
+    },
+    {
+      "id": "I-147",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 405,
+      "coverageLine": 352,
+      "statement": "Search ≠ Ask AI",
+      "architectureHome": "`09-ai-and-agent-runtime-architecture.md` §5",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Search` is not `Ask AI`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "19",
+        "40"
+      ],
+      "ownerCell": "`19`, `40`",
+      "completionGate": "[WP-19.01](../planning/work-packages/19-arcnotes-search-and-portability.md#rule-wp-19.01), [WP-40.03](../planning/work-packages/40-knowledge-search-and-retrieval.md#rule-wp-40.03)"
+    },
+    {
+      "id": "I-148",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 406,
+      "coverageLine": 353,
+      "statement": "Web Search ≠ ArcChat Global Search",
+      "architectureHome": "`09-ai-and-agent-runtime-architecture.md` §5",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Web Search` is not `ArcChat Global Search`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "19",
+        "40"
+      ],
+      "ownerCell": "`19`, `40`",
+      "completionGate": "[WP-19.01](../planning/work-packages/19-arcnotes-search-and-portability.md#rule-wp-19.01), [WP-40.03](../planning/work-packages/40-knowledge-search-and-retrieval.md#rule-wp-40.03)"
+    },
+    {
+      "id": "I-149",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 407,
+      "coverageLine": 354,
+      "statement": "Web Search ≠ long-term knowledge",
+      "architectureHome": "`09-ai-and-agent-runtime-architecture.md` §5",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Web Search` is not `long-term knowledge`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "19",
+        "40"
+      ],
+      "ownerCell": "`19`, `40`",
+      "completionGate": "[WP-19.01](../planning/work-packages/19-arcnotes-search-and-portability.md#rule-wp-19.01), [WP-40.03](../planning/work-packages/40-knowledge-search-and-retrieval.md#rule-wp-40.03)"
+    },
+    {
+      "id": "I-150",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 408,
+      "coverageLine": 355,
+      "statement": "Retrieval Candidate ≠ Evidence",
+      "architectureHome": "`09-ai-and-agent-runtime-architecture.md` §5",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Retrieval Candidate` is not `Evidence`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "19",
+        "40"
+      ],
+      "ownerCell": "`19`, `40`",
+      "completionGate": "[WP-19.01](../planning/work-packages/19-arcnotes-search-and-portability.md#rule-wp-19.01), [WP-40.03](../planning/work-packages/40-knowledge-search-and-retrieval.md#rule-wp-40.03)"
+    },
+    {
+      "id": "I-151",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 409,
+      "coverageLine": 356,
+      "statement": "Evidence ≠ Citation",
+      "architectureHome": "`09-ai-and-agent-runtime-architecture.md` §5",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Evidence` is not `Citation`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "19",
+        "40"
+      ],
+      "ownerCell": "`19`, `40`",
+      "completionGate": "[WP-19.01](../planning/work-packages/19-arcnotes-search-and-portability.md#rule-wp-19.01), [WP-40.03](../planning/work-packages/40-knowledge-search-and-retrieval.md#rule-wp-40.03)"
+    },
+    {
+      "id": "I-152",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 410,
+      "coverageLine": 357,
+      "statement": "Search Result ≠ Citation",
+      "architectureHome": "`09-ai-and-agent-runtime-architecture.md` §5",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Search Result` is not `Citation`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "19",
+        "40"
+      ],
+      "ownerCell": "`19`, `40`",
+      "completionGate": "[WP-19.01](../planning/work-packages/19-arcnotes-search-and-portability.md#rule-wp-19.01), [WP-40.03](../planning/work-packages/40-knowledge-search-and-retrieval.md#rule-wp-40.03)"
+    },
+    {
+      "id": "I-153",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 411,
+      "coverageLine": 358,
+      "statement": "Citation ≠ Vector Chunk ID",
+      "architectureHome": "`09-ai-and-agent-runtime-architecture.md` §5",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Citation` is not `Vector Chunk ID`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "19",
+        "40"
+      ],
+      "ownerCell": "`19`, `40`",
+      "completionGate": "[WP-19.01](../planning/work-packages/19-arcnotes-search-and-portability.md#rule-wp-19.01), [WP-40.03](../planning/work-packages/40-knowledge-search-and-retrieval.md#rule-wp-40.03)"
+    },
+    {
+      "id": "I-154",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 412,
+      "coverageLine": 359,
+      "statement": "Retrieval Unit ≠ Domain Resource",
+      "architectureHome": "`09-ai-and-agent-runtime-architecture.md` §5",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Retrieval Unit` is not `Domain Resource`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "19",
+        "40"
+      ],
+      "ownerCell": "`19`, `40`",
+      "completionGate": "[WP-19.01](../planning/work-packages/19-arcnotes-search-and-portability.md#rule-wp-19.01), [WP-40.03](../planning/work-packages/40-knowledge-search-and-retrieval.md#rule-wp-40.03)"
+    },
+    {
+      "id": "I-155",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 413,
+      "coverageLine": 360,
+      "statement": "Context Pack ≠ entire Knowledge Source",
+      "architectureHome": "`09-ai-and-agent-runtime-architecture.md` §5",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Context Pack` is not `entire Knowledge Source`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "19",
+        "40"
+      ],
+      "ownerCell": "`19`, `40`",
+      "completionGate": "[WP-19.01](../planning/work-packages/19-arcnotes-search-and-portability.md#rule-wp-19.01), [WP-40.03](../planning/work-packages/40-knowledge-search-and-retrieval.md#rule-wp-40.03)"
+    },
+    {
+      "id": "I-156",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 414,
+      "coverageLine": 361,
+      "statement": "ArcNotes Knowledge ≠ ArcChat Memory",
+      "architectureHome": "`09-ai-and-agent-runtime-architecture.md` §5",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `ArcNotes Knowledge` is not `ArcChat Memory`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "19",
+        "40"
+      ],
+      "ownerCell": "`19`, `40`",
+      "completionGate": "[WP-19.01](../planning/work-packages/19-arcnotes-search-and-portability.md#rule-wp-19.01), [WP-40.03](../planning/work-packages/40-knowledge-search-and-retrieval.md#rule-wp-40.03)"
+    },
+    {
+      "id": "I-157",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 415,
+      "coverageLine": 362,
+      "statement": "Personal Memory ≠ ArcNotes Knowledge",
+      "architectureHome": "`09-ai-and-agent-runtime-architecture.md` §5",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Personal Memory` is not `ArcNotes Knowledge`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "19",
+        "40"
+      ],
+      "ownerCell": "`19`, `40`",
+      "completionGate": "[WP-19.01](../planning/work-packages/19-arcnotes-search-and-portability.md#rule-wp-19.01), [WP-40.03](../planning/work-packages/40-knowledge-search-and-retrieval.md#rule-wp-40.03)"
+    },
+    {
+      "id": "I-158",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 416,
+      "coverageLine": 363,
+      "statement": "Conversation Summary ≠ Personal Memory",
+      "architectureHome": "`09-ai-and-agent-runtime-architecture.md` §5",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Conversation Summary` is not `Personal Memory`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "19",
+        "40"
+      ],
+      "ownerCell": "`19`, `40`",
+      "completionGate": "[WP-19.01](../planning/work-packages/19-arcnotes-search-and-portability.md#rule-wp-19.01), [WP-40.03](../planning/work-packages/40-knowledge-search-and-retrieval.md#rule-wp-40.03)"
+    },
+    {
+      "id": "I-159",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 417,
+      "coverageLine": 364,
+      "statement": "Conversation Context ≠ long-term knowledge",
+      "architectureHome": "`09-ai-and-agent-runtime-architecture.md` §5",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Conversation Context` is not `long-term knowledge`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "19",
+        "40"
+      ],
+      "ownerCell": "`19`, `40`",
+      "completionGate": "[WP-19.01](../planning/work-packages/19-arcnotes-search-and-portability.md#rule-wp-19.01), [WP-40.03](../planning/work-packages/40-knowledge-search-and-retrieval.md#rule-wp-40.03)"
+    },
+    {
+      "id": "I-160",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 418,
+      "coverageLine": 365,
+      "statement": "Raw Capture ≠ text knowledge chunk",
+      "architectureHome": "`09-ai-and-agent-runtime-architecture.md` §5",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Raw Capture` is not `text knowledge chunk`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "19",
+        "40"
+      ],
+      "ownerCell": "`19`, `40`",
+      "completionGate": "[WP-19.01](../planning/work-packages/19-arcnotes-search-and-portability.md#rule-wp-19.01), [WP-40.03](../planning/work-packages/40-knowledge-search-and-retrieval.md#rule-wp-40.03)"
+    },
+    {
+      "id": "I-161",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 419,
+      "coverageLine": 366,
+      "statement": "Raw Video ≠ default vector corpus",
+      "architectureHome": "`09-ai-and-agent-runtime-architecture.md` §5",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Raw Video` is not `default vector corpus`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "19",
+        "40"
+      ],
+      "ownerCell": "`19`, `40`",
+      "completionGate": "[WP-19.01](../planning/work-packages/19-arcnotes-search-and-portability.md#rule-wp-19.01), [WP-40.03](../planning/work-packages/40-knowledge-search-and-retrieval.md#rule-wp-40.03)"
+    },
+    {
+      "id": "I-162",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 420,
+      "coverageLine": 367,
+      "statement": "AI Summary ≠ Source Evidence",
+      "architectureHome": "`09-ai-and-agent-runtime-architecture.md` §5",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `AI Summary` is not `Source Evidence`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "19",
+        "40"
+      ],
+      "ownerCell": "`19`, `40`",
+      "completionGate": "[WP-19.01](../planning/work-packages/19-arcnotes-search-and-portability.md#rule-wp-19.01), [WP-40.03](../planning/work-packages/40-knowledge-search-and-retrieval.md#rule-wp-40.03)"
+    },
+    {
+      "id": "I-163",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 421,
+      "coverageLine": 368,
+      "statement": "AI Summary ≠ Measurement Result",
+      "architectureHome": "`09-ai-and-agent-runtime-architecture.md` §5",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `AI Summary` is not `Measurement Result`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "19",
+        "40"
+      ],
+      "ownerCell": "`19`, `40`",
+      "completionGate": "[WP-19.01](../planning/work-packages/19-arcnotes-search-and-portability.md#rule-wp-19.01), [WP-40.03](../planning/work-packages/40-knowledge-search-and-retrieval.md#rule-wp-40.03)"
+    },
+    {
+      "id": "I-164",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 422,
+      "coverageLine": 369,
+      "statement": "Derived Knowledge Artifact ≠ Original Source",
+      "architectureHome": "`09-ai-and-agent-runtime-architecture.md` §5",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Derived Knowledge Artifact` is not `Original Source`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "19",
+        "40"
+      ],
+      "ownerCell": "`19`, `40`",
+      "completionGate": "[WP-19.01](../planning/work-packages/19-arcnotes-search-and-portability.md#rule-wp-19.01), [WP-40.03](../planning/work-packages/40-knowledge-search-and-retrieval.md#rule-wp-40.03)"
+    },
+    {
+      "id": "I-165",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 423,
+      "coverageLine": 370,
+      "statement": "Source Revision ≠ Index Revision",
+      "architectureHome": "`09-ai-and-agent-runtime-architecture.md` §5",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Source Revision` is not `Index Revision`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "19",
+        "40"
+      ],
+      "ownerCell": "`19`, `40`",
+      "completionGate": "[WP-19.01](../planning/work-packages/19-arcnotes-search-and-portability.md#rule-wp-19.01), [WP-40.03](../planning/work-packages/40-knowledge-search-and-retrieval.md#rule-wp-40.03)"
+    },
+    {
+      "id": "I-166",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 424,
+      "coverageLine": 371,
+      "statement": "Index Freshness ≠ Source Freshness",
+      "architectureHome": "`09-ai-and-agent-runtime-architecture.md` §5",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Index Freshness` is not `Source Freshness`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "19",
+        "40"
+      ],
+      "ownerCell": "`19`, `40`",
+      "completionGate": "[WP-19.01](../planning/work-packages/19-arcnotes-search-and-portability.md#rule-wp-19.01), [WP-40.03](../planning/work-packages/40-knowledge-search-and-retrieval.md#rule-wp-40.03)"
+    },
+    {
+      "id": "I-167",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 425,
+      "coverageLine": 372,
+      "statement": "Retrieval Trace ≠ Chain-of-Thought",
+      "architectureHome": "`09-ai-and-agent-runtime-architecture.md` §5",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Retrieval Trace` is not `Chain-of-Thought`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "19",
+        "40"
+      ],
+      "ownerCell": "`19`, `40`",
+      "completionGate": "[WP-19.01](../planning/work-packages/19-arcnotes-search-and-portability.md#rule-wp-19.01), [WP-40.03](../planning/work-packages/40-knowledge-search-and-retrieval.md#rule-wp-40.03)"
+    },
+    {
+      "id": "I-168",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 426,
+      "coverageLine": 373,
+      "statement": "Source Removal ≠ delete files",
+      "architectureHome": "`09-ai-and-agent-runtime-architecture.md` §5",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Source Removal` is not `delete files`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "19",
+        "40"
+      ],
+      "ownerCell": "`19`, `40`",
+      "completionGate": "[WP-19.01](../planning/work-packages/19-arcnotes-search-and-portability.md#rule-wp-19.01), [WP-40.03](../planning/work-packages/40-knowledge-search-and-retrieval.md#rule-wp-40.03)"
+    },
+    {
+      "id": "I-169",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 427,
+      "coverageLine": 374,
+      "statement": "Search ranking ≠ paid placement",
+      "architectureHome": "`09-ai-and-agent-runtime-architecture.md` §5",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Search ranking` is not `paid placement`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "19",
+        "40"
+      ],
+      "ownerCell": "`19`, `40`",
+      "completionGate": "[WP-19.01](../planning/work-packages/19-arcnotes-search-and-portability.md#rule-wp-19.01), [WP-40.03](../planning/work-packages/40-knowledge-search-and-retrieval.md#rule-wp-40.03)"
+    },
+    {
+      "id": "I-180",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 433,
+      "coverageLine": 375,
+      "statement": "Sync ≠ Backup ≠ Version History ≠ Trash ≠ Export",
+      "architectureHome": "`06-data-persistence-and-formats.md`; `07-sync-conflict-and-backup.md`",
+      "mechanism": "Integration test",
+      "plannedVerification": "Assert `Sync` is not `Backup`, `Backup` is not `Version History`, `Version History` is not `Trash`, `Trash` is not `Export`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "07",
+        "19",
+        "25",
+        "46"
+      ],
+      "ownerCell": "`07`, `19`, `25`, `46`",
+      "completionGate": "[WP-07.02](../planning/work-packages/07-local-persistence-foundation.md#rule-wp-07.02), [WP-25.07](../planning/work-packages/25-sync-engine-and-blob-lifecycle.md#rule-wp-25.07), [WP-46.04](../planning/work-packages/46-backup-recovery-and-data-health.md#rule-wp-46.04)"
+    },
+    {
+      "id": "I-181",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 434,
+      "coverageLine": 376,
+      "statement": "User Data ≠ Asset ≠ Cache ≠ Search Index ≠ Secret",
+      "architectureHome": "`06-data-persistence-and-formats.md`; `07-sync-conflict-and-backup.md`",
+      "mechanism": "Integration test",
+      "plannedVerification": "Assert `User Data` is not `Asset`, `Asset` is not `Cache`, `Cache` is not `Search Index`, `Search Index` is not `Secret`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "07",
+        "19",
+        "25",
+        "46"
+      ],
+      "ownerCell": "`07`, `19`, `25`, `46`",
+      "completionGate": "[WP-07.02](../planning/work-packages/07-local-persistence-foundation.md#rule-wp-07.02), [WP-25.07](../planning/work-packages/25-sync-engine-and-blob-lifecycle.md#rule-wp-25.07), [WP-46.04](../planning/work-packages/46-backup-recovery-and-data-health.md#rule-wp-46.04)"
+    },
+    {
+      "id": "I-182",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 435,
+      "coverageLine": 377,
+      "statement": "Sync ≠ AI upload; sync transmission ≠ AI transmission",
+      "architectureHome": "`06-data-persistence-and-formats.md`; `07-sync-conflict-and-backup.md`",
+      "mechanism": "Integration test",
+      "plannedVerification": "Assert `Sync` is not `AI upload; sync transmission`, `AI upload; sync transmission` is not `AI transmission`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "07",
+        "19",
+        "25",
+        "46"
+      ],
+      "ownerCell": "`07`, `19`, `25`, `46`",
+      "completionGate": "[WP-07.02](../planning/work-packages/07-local-persistence-foundation.md#rule-wp-07.02), [WP-25.07](../planning/work-packages/25-sync-engine-and-blob-lifecycle.md#rule-wp-25.07), [WP-46.04](../planning/work-packages/46-backup-recovery-and-data-health.md#rule-wp-46.04)"
+    },
+    {
+      "id": "I-183",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 436,
+      "coverageLine": 378,
+      "statement": "Domain Model ≠ Database Schema",
+      "architectureHome": "`06-data-persistence-and-formats.md`; `07-sync-conflict-and-backup.md`",
+      "mechanism": "Integration test",
+      "plannedVerification": "Assert `Domain Model` is not `Database Schema`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "07",
+        "19",
+        "25",
+        "46"
+      ],
+      "ownerCell": "`07`, `19`, `25`, `46`",
+      "completionGate": "[WP-07.02](../planning/work-packages/07-local-persistence-foundation.md#rule-wp-07.02), [WP-25.07](../planning/work-packages/25-sync-engine-and-blob-lifecycle.md#rule-wp-25.07), [WP-46.04](../planning/work-packages/46-backup-recovery-and-data-health.md#rule-wp-46.04)"
+    },
+    {
+      "id": "I-184",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 437,
+      "coverageLine": 379,
+      "statement": "Database Schema ≠ Native File Format",
+      "architectureHome": "`06-data-persistence-and-formats.md`; `07-sync-conflict-and-backup.md`",
+      "mechanism": "Integration test",
+      "plannedVerification": "Assert `Database Schema` is not `Native File Format`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "07",
+        "19",
+        "25",
+        "46"
+      ],
+      "ownerCell": "`07`, `19`, `25`, `46`",
+      "completionGate": "[WP-07.02](../planning/work-packages/07-local-persistence-foundation.md#rule-wp-07.02), [WP-25.07](../planning/work-packages/25-sync-engine-and-blob-lifecycle.md#rule-wp-25.07), [WP-46.04](../planning/work-packages/46-backup-recovery-and-data-health.md#rule-wp-46.04)"
+    },
+    {
+      "id": "I-185",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 438,
+      "coverageLine": 380,
+      "statement": "Native Format ≠ Interchange Format",
+      "architectureHome": "`06-data-persistence-and-formats.md`; `07-sync-conflict-and-backup.md`",
+      "mechanism": "Integration test",
+      "plannedVerification": "Assert `Native Format` is not `Interchange Format`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "07",
+        "19",
+        "25",
+        "46"
+      ],
+      "ownerCell": "`07`, `19`, `25`, `46`",
+      "completionGate": "[WP-07.02](../planning/work-packages/07-local-persistence-foundation.md#rule-wp-07.02), [WP-25.07](../planning/work-packages/25-sync-engine-and-blob-lifecycle.md#rule-wp-25.07), [WP-46.04](../planning/work-packages/46-backup-recovery-and-data-health.md#rule-wp-46.04)"
+    },
+    {
+      "id": "I-186",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 439,
+      "coverageLine": 381,
+      "statement": "Native Format ≠ Cloud Sync Protocol",
+      "architectureHome": "`06-data-persistence-and-formats.md`; `07-sync-conflict-and-backup.md`",
+      "mechanism": "Integration test",
+      "plannedVerification": "Assert `Native Format` is not `Cloud Sync Protocol`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "07",
+        "19",
+        "25",
+        "46"
+      ],
+      "ownerCell": "`07`, `19`, `25`, `46`",
+      "completionGate": "[WP-07.02](../planning/work-packages/07-local-persistence-foundation.md#rule-wp-07.02), [WP-25.07](../planning/work-packages/25-sync-engine-and-blob-lifecycle.md#rule-wp-25.07), [WP-46.04](../planning/work-packages/46-backup-recovery-and-data-health.md#rule-wp-46.04)"
+    },
+    {
+      "id": "I-187",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 440,
+      "coverageLine": 382,
+      "statement": "Runtime Storage Format ≠ User Interchange Format",
+      "architectureHome": "`06-data-persistence-and-formats.md`; `07-sync-conflict-and-backup.md`",
+      "mechanism": "Integration test",
+      "plannedVerification": "Assert `Runtime Storage Format` is not `User Interchange Format`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "07",
+        "19",
+        "25",
+        "46"
+      ],
+      "ownerCell": "`07`, `19`, `25`, `46`",
+      "completionGate": "[WP-07.02](../planning/work-packages/07-local-persistence-foundation.md#rule-wp-07.02), [WP-25.07](../planning/work-packages/25-sync-engine-and-blob-lifecycle.md#rule-wp-25.07), [WP-46.04](../planning/work-packages/46-backup-recovery-and-data-health.md#rule-wp-46.04)"
+    },
+    {
+      "id": "I-188",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 441,
+      "coverageLine": 383,
+      "statement": "Working Store ≠ Portable Package",
+      "architectureHome": "`06-data-persistence-and-formats.md`; `07-sync-conflict-and-backup.md`",
+      "mechanism": "Integration test",
+      "plannedVerification": "Assert `Working Store` is not `Portable Package`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "07",
+        "19",
+        "25",
+        "46"
+      ],
+      "ownerCell": "`07`, `19`, `25`, `46`",
+      "completionGate": "[WP-07.02](../planning/work-packages/07-local-persistence-foundation.md#rule-wp-07.02), [WP-25.07](../planning/work-packages/25-sync-engine-and-blob-lifecycle.md#rule-wp-25.07), [WP-46.04](../planning/work-packages/46-backup-recovery-and-data-health.md#rule-wp-46.04)"
+    },
+    {
+      "id": "I-189",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 442,
+      "coverageLine": 384,
+      "statement": "Project ≠ single file",
+      "architectureHome": "`06-data-persistence-and-formats.md`; `07-sync-conflict-and-backup.md`",
+      "mechanism": "Integration test",
+      "plannedVerification": "Assert `Project` is not `single file`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "07",
+        "19",
+        "25",
+        "46"
+      ],
+      "ownerCell": "`07`, `19`, `25`, `46`",
+      "completionGate": "[WP-07.02](../planning/work-packages/07-local-persistence-foundation.md#rule-wp-07.02), [WP-25.07](../planning/work-packages/25-sync-engine-and-blob-lifecycle.md#rule-wp-25.07), [WP-46.04](../planning/work-packages/46-backup-recovery-and-data-health.md#rule-wp-46.04)"
+    },
+    {
+      "id": "I-190",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 443,
+      "coverageLine": 385,
+      "statement": "Document ≠ Markdown file; Canonical Document ≠ Markdown file",
+      "architectureHome": "`06-data-persistence-and-formats.md`; `07-sync-conflict-and-backup.md`",
+      "mechanism": "Integration test",
+      "plannedVerification": "Assert `Document` is not `Markdown file; Canonical Document`, `Markdown file; Canonical Document` is not `Markdown file`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "07",
+        "19",
+        "25",
+        "46"
+      ],
+      "ownerCell": "`07`, `19`, `25`, `46`",
+      "completionGate": "[WP-07.02](../planning/work-packages/07-local-persistence-foundation.md#rule-wp-07.02), [WP-25.07](../planning/work-packages/25-sync-engine-and-blob-lifecycle.md#rule-wp-25.07), [WP-46.04](../planning/work-packages/46-backup-recovery-and-data-health.md#rule-wp-46.04)"
+    },
+    {
+      "id": "I-191",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 444,
+      "coverageLine": 386,
+      "statement": "Raw Capture ≠ Analysis Result",
+      "architectureHome": "`06-data-persistence-and-formats.md`; `07-sync-conflict-and-backup.md`",
+      "mechanism": "Integration test",
+      "plannedVerification": "Assert `Raw Capture` is not `Analysis Result`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "07",
+        "19",
+        "25",
+        "46"
+      ],
+      "ownerCell": "`07`, `19`, `25`, `46`",
+      "completionGate": "[WP-07.02](../planning/work-packages/07-local-persistence-foundation.md#rule-wp-07.02), [WP-25.07](../planning/work-packages/25-sync-engine-and-blob-lifecycle.md#rule-wp-25.07), [WP-46.04](../planning/work-packages/46-backup-recovery-and-data-health.md#rule-wp-46.04)"
+    },
+    {
+      "id": "I-192",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 445,
+      "coverageLine": 387,
+      "statement": "MediaAsset ≠ File Path",
+      "architectureHome": "`06-data-persistence-and-formats.md`; `07-sync-conflict-and-backup.md`",
+      "mechanism": "Integration test",
+      "plannedVerification": "Assert `MediaAsset` is not `File Path`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "07",
+        "19",
+        "25",
+        "46"
+      ],
+      "ownerCell": "`07`, `19`, `25`, `46`",
+      "completionGate": "[WP-07.02](../planning/work-packages/07-local-persistence-foundation.md#rule-wp-07.02), [WP-25.07](../planning/work-packages/25-sync-engine-and-blob-lifecycle.md#rule-wp-25.07), [WP-46.04](../planning/work-packages/46-backup-recovery-and-data-health.md#rule-wp-46.04)"
+    },
+    {
+      "id": "I-193",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 446,
+      "coverageLine": 388,
+      "statement": "Managed Asset ≠ External Reference",
+      "architectureHome": "`06-data-persistence-and-formats.md`; `07-sync-conflict-and-backup.md`",
+      "mechanism": "Integration test",
+      "plannedVerification": "Assert `Managed Asset` is not `External Reference`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "07",
+        "19",
+        "25",
+        "46"
+      ],
+      "ownerCell": "`07`, `19`, `25`, `46`",
+      "completionGate": "[WP-07.02](../planning/work-packages/07-local-persistence-foundation.md#rule-wp-07.02), [WP-25.07](../planning/work-packages/25-sync-engine-and-blob-lifecycle.md#rule-wp-25.07), [WP-46.04](../planning/work-packages/46-backup-recovery-and-data-health.md#rule-wp-46.04)"
+    },
+    {
+      "id": "I-194",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 447,
+      "coverageLine": 389,
+      "statement": "External Locator ≠ Resource Identity",
+      "architectureHome": "`06-data-persistence-and-formats.md`; `07-sync-conflict-and-backup.md`",
+      "mechanism": "Integration test",
+      "plannedVerification": "Assert `External Locator` is not `Resource Identity`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "07",
+        "19",
+        "25",
+        "46"
+      ],
+      "ownerCell": "`07`, `19`, `25`, `46`",
+      "completionGate": "[WP-07.02](../planning/work-packages/07-local-persistence-foundation.md#rule-wp-07.02), [WP-25.07](../planning/work-packages/25-sync-engine-and-blob-lifecycle.md#rule-wp-25.07), [WP-46.04](../planning/work-packages/46-backup-recovery-and-data-health.md#rule-wp-46.04)"
+    },
+    {
+      "id": "I-195",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 448,
+      "coverageLine": 390,
+      "statement": "File Path ≠ Resource Identity",
+      "architectureHome": "`06-data-persistence-and-formats.md`; `07-sync-conflict-and-backup.md`",
+      "mechanism": "Integration test",
+      "plannedVerification": "Assert `File Path` is not `Resource Identity`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "07",
+        "19",
+        "25",
+        "46"
+      ],
+      "ownerCell": "`07`, `19`, `25`, `46`",
+      "completionGate": "[WP-07.02](../planning/work-packages/07-local-persistence-foundation.md#rule-wp-07.02), [WP-25.07](../planning/work-packages/25-sync-engine-and-blob-lifecycle.md#rule-wp-25.07), [WP-46.04](../planning/work-packages/46-backup-recovery-and-data-health.md#rule-wp-46.04)"
+    },
+    {
+      "id": "I-196",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 449,
+      "coverageLine": 391,
+      "statement": "Cache ≠ Canonical Data",
+      "architectureHome": "`06-data-persistence-and-formats.md`; `07-sync-conflict-and-backup.md`",
+      "mechanism": "Integration test",
+      "plannedVerification": "Assert `Cache` is not `Canonical Data`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "07",
+        "19",
+        "25",
+        "46"
+      ],
+      "ownerCell": "`07`, `19`, `25`, `46`",
+      "completionGate": "[WP-07.02](../planning/work-packages/07-local-persistence-foundation.md#rule-wp-07.02), [WP-25.07](../planning/work-packages/25-sync-engine-and-blob-lifecycle.md#rule-wp-25.07), [WP-46.04](../planning/work-packages/46-backup-recovery-and-data-health.md#rule-wp-46.04)"
+    },
+    {
+      "id": "I-197",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 450,
+      "coverageLine": 392,
+      "statement": "Proxy ≠ Original",
+      "architectureHome": "`06-data-persistence-and-formats.md`; `07-sync-conflict-and-backup.md`",
+      "mechanism": "Integration test",
+      "plannedVerification": "Assert `Proxy` is not `Original`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "07",
+        "19",
+        "25",
+        "46"
+      ],
+      "ownerCell": "`07`, `19`, `25`, `46`",
+      "completionGate": "[WP-07.02](../planning/work-packages/07-local-persistence-foundation.md#rule-wp-07.02), [WP-25.07](../planning/work-packages/25-sync-engine-and-blob-lifecycle.md#rule-wp-25.07), [WP-46.04](../planning/work-packages/46-backup-recovery-and-data-health.md#rule-wp-46.04)"
+    },
+    {
+      "id": "I-198",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 451,
+      "coverageLine": 393,
+      "statement": "Autosave ≠ rewrite entire project",
+      "architectureHome": "`06-data-persistence-and-formats.md`; `07-sync-conflict-and-backup.md`",
+      "mechanism": "Integration test",
+      "plannedVerification": "Assert `Autosave` is not `rewrite entire project`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "07",
+        "19",
+        "25",
+        "46"
+      ],
+      "ownerCell": "`07`, `19`, `25`, `46`",
+      "completionGate": "[WP-07.02](../planning/work-packages/07-local-persistence-foundation.md#rule-wp-07.02), [WP-25.07](../planning/work-packages/25-sync-engine-and-blob-lifecycle.md#rule-wp-25.07), [WP-46.04](../planning/work-packages/46-backup-recovery-and-data-health.md#rule-wp-46.04)"
+    },
+    {
+      "id": "I-199",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 452,
+      "coverageLine": 394,
+      "statement": "Saved Locally ≠ Synced to Cloud",
+      "architectureHome": "`06-data-persistence-and-formats.md`; `07-sync-conflict-and-backup.md`",
+      "mechanism": "Integration test",
+      "plannedVerification": "Assert `Saved Locally` is not `Synced to Cloud`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "07",
+        "19",
+        "25",
+        "46"
+      ],
+      "ownerCell": "`07`, `19`, `25`, `46`",
+      "completionGate": "[WP-07.02](../planning/work-packages/07-local-persistence-foundation.md#rule-wp-07.02), [WP-25.07](../planning/work-packages/25-sync-engine-and-blob-lifecycle.md#rule-wp-25.07), [WP-46.04](../planning/work-packages/46-backup-recovery-and-data-health.md#rule-wp-46.04)"
+    },
+    {
+      "id": "I-200",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 453,
+      "coverageLine": 395,
+      "statement": "Cloud Pending ≠ Unsaved",
+      "architectureHome": "`06-data-persistence-and-formats.md`; `07-sync-conflict-and-backup.md`",
+      "mechanism": "Integration test",
+      "plannedVerification": "Assert `Cloud Pending` is not `Unsaved`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "07",
+        "19",
+        "25",
+        "46"
+      ],
+      "ownerCell": "`07`, `19`, `25`, `46`",
+      "completionGate": "[WP-07.02](../planning/work-packages/07-local-persistence-foundation.md#rule-wp-07.02), [WP-25.07](../planning/work-packages/25-sync-engine-and-blob-lifecycle.md#rule-wp-25.07), [WP-46.04](../planning/work-packages/46-backup-recovery-and-data-health.md#rule-wp-46.04)"
+    },
+    {
+      "id": "I-201",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 454,
+      "coverageLine": 396,
+      "statement": "Undo ≠ Revision",
+      "architectureHome": "`06-data-persistence-and-formats.md`; `07-sync-conflict-and-backup.md`",
+      "mechanism": "Integration test",
+      "plannedVerification": "Assert `Undo` is not `Revision`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "07",
+        "19",
+        "25",
+        "46"
+      ],
+      "ownerCell": "`07`, `19`, `25`, `46`",
+      "completionGate": "[WP-07.02](../planning/work-packages/07-local-persistence-foundation.md#rule-wp-07.02), [WP-25.07](../planning/work-packages/25-sync-engine-and-blob-lifecycle.md#rule-wp-25.07), [WP-46.04](../planning/work-packages/46-backup-recovery-and-data-health.md#rule-wp-46.04)"
+    },
+    {
+      "id": "I-202",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 455,
+      "coverageLine": 397,
+      "statement": "Undo ≠ Revision History",
+      "architectureHome": "`06-data-persistence-and-formats.md`; `07-sync-conflict-and-backup.md`",
+      "mechanism": "Integration test",
+      "plannedVerification": "Assert `Undo` is not `Revision History`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "07",
+        "19",
+        "25",
+        "46"
+      ],
+      "ownerCell": "`07`, `19`, `25`, `46`",
+      "completionGate": "[WP-07.02](../planning/work-packages/07-local-persistence-foundation.md#rule-wp-07.02), [WP-25.07](../planning/work-packages/25-sync-engine-and-blob-lifecycle.md#rule-wp-25.07), [WP-46.04](../planning/work-packages/46-backup-recovery-and-data-health.md#rule-wp-46.04)"
+    },
+    {
+      "id": "I-203",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 456,
+      "coverageLine": 398,
+      "statement": "Revision ≠ Checkpoint",
+      "architectureHome": "`06-data-persistence-and-formats.md`; `07-sync-conflict-and-backup.md`",
+      "mechanism": "Integration test",
+      "plannedVerification": "Assert `Revision` is not `Checkpoint`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "07",
+        "19",
+        "25",
+        "46"
+      ],
+      "ownerCell": "`07`, `19`, `25`, `46`",
+      "completionGate": "[WP-07.02](../planning/work-packages/07-local-persistence-foundation.md#rule-wp-07.02), [WP-25.07](../planning/work-packages/25-sync-engine-and-blob-lifecycle.md#rule-wp-25.07), [WP-46.04](../planning/work-packages/46-backup-recovery-and-data-health.md#rule-wp-46.04)"
+    },
+    {
+      "id": "I-204",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 457,
+      "coverageLine": 399,
+      "statement": "Checkpoint ≠ Recovery Journal",
+      "architectureHome": "`06-data-persistence-and-formats.md`; `07-sync-conflict-and-backup.md`",
+      "mechanism": "Integration test",
+      "plannedVerification": "Assert `Checkpoint` is not `Recovery Journal`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "07",
+        "19",
+        "25",
+        "46"
+      ],
+      "ownerCell": "`07`, `19`, `25`, `46`",
+      "completionGate": "[WP-07.02](../planning/work-packages/07-local-persistence-foundation.md#rule-wp-07.02), [WP-25.07](../planning/work-packages/25-sync-engine-and-blob-lifecycle.md#rule-wp-25.07), [WP-46.04](../planning/work-packages/46-backup-recovery-and-data-health.md#rule-wp-46.04)"
+    },
+    {
+      "id": "I-205",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 458,
+      "coverageLine": 400,
+      "statement": "Revision History ≠ Trash",
+      "architectureHome": "`06-data-persistence-and-formats.md`; `07-sync-conflict-and-backup.md`",
+      "mechanism": "Integration test",
+      "plannedVerification": "Assert `Revision History` is not `Trash`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "07",
+        "19",
+        "25",
+        "46"
+      ],
+      "ownerCell": "`07`, `19`, `25`, `46`",
+      "completionGate": "[WP-07.02](../planning/work-packages/07-local-persistence-foundation.md#rule-wp-07.02), [WP-25.07](../planning/work-packages/25-sync-engine-and-blob-lifecycle.md#rule-wp-25.07), [WP-46.04](../planning/work-packages/46-backup-recovery-and-data-health.md#rule-wp-46.04)"
+    },
+    {
+      "id": "I-206",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 459,
+      "coverageLine": 401,
+      "statement": "Crash Recovery ≠ Undo",
+      "architectureHome": "`06-data-persistence-and-formats.md`; `07-sync-conflict-and-backup.md`",
+      "mechanism": "Integration test",
+      "plannedVerification": "Assert `Crash Recovery` is not `Undo`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "07",
+        "19",
+        "25",
+        "46"
+      ],
+      "ownerCell": "`07`, `19`, `25`, `46`",
+      "completionGate": "[WP-07.02](../planning/work-packages/07-local-persistence-foundation.md#rule-wp-07.02), [WP-25.07](../planning/work-packages/25-sync-engine-and-blob-lifecycle.md#rule-wp-25.07), [WP-46.04](../planning/work-packages/46-backup-recovery-and-data-health.md#rule-wp-46.04)"
+    },
+    {
+      "id": "I-207",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 460,
+      "coverageLine": 402,
+      "statement": "Migration Recovery ≠ user Undo; Migration Recovery Point ≠ normal Undo",
+      "architectureHome": "`06-data-persistence-and-formats.md`; `07-sync-conflict-and-backup.md`",
+      "mechanism": "Integration test",
+      "plannedVerification": "Assert `Migration Recovery` is not `user Undo; Migration Recovery Point`, `user Undo; Migration Recovery Point` is not `normal Undo`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "07",
+        "19",
+        "25",
+        "46"
+      ],
+      "ownerCell": "`07`, `19`, `25`, `46`",
+      "completionGate": "[WP-07.02](../planning/work-packages/07-local-persistence-foundation.md#rule-wp-07.02), [WP-25.07](../planning/work-packages/25-sync-engine-and-blob-lifecycle.md#rule-wp-25.07), [WP-46.04](../planning/work-packages/46-backup-recovery-and-data-health.md#rule-wp-46.04)"
+    },
+    {
+      "id": "I-208",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 461,
+      "coverageLine": 403,
+      "statement": "App Binary Rollback ≠ Data Rollback",
+      "architectureHome": "`06-data-persistence-and-formats.md`; `07-sync-conflict-and-backup.md`",
+      "mechanism": "Integration test",
+      "plannedVerification": "Assert `App Binary Rollback` is not `Data Rollback`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "07",
+        "19",
+        "25",
+        "46"
+      ],
+      "ownerCell": "`07`, `19`, `25`, `46`",
+      "completionGate": "[WP-07.02](../planning/work-packages/07-local-persistence-foundation.md#rule-wp-07.02), [WP-25.07](../planning/work-packages/25-sync-engine-and-blob-lifecycle.md#rule-wp-25.07), [WP-46.04](../planning/work-packages/46-backup-recovery-and-data-health.md#rule-wp-46.04)"
+    },
+    {
+      "id": "I-209",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 462,
+      "coverageLine": 404,
+      "statement": "Import ≠ live external sync",
+      "architectureHome": "`06-data-persistence-and-formats.md`; `07-sync-conflict-and-backup.md`",
+      "mechanism": "Integration test",
+      "plannedVerification": "Assert `Import` is not `live external sync`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "07",
+        "19",
+        "25",
+        "46"
+      ],
+      "ownerCell": "`07`, `19`, `25`, `46`",
+      "completionGate": "[WP-07.02](../planning/work-packages/07-local-persistence-foundation.md#rule-wp-07.02), [WP-25.07](../planning/work-packages/25-sync-engine-and-blob-lifecycle.md#rule-wp-25.07), [WP-46.04](../planning/work-packages/46-backup-recovery-and-data-health.md#rule-wp-46.04)"
+    },
+    {
+      "id": "I-210",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 463,
+      "coverageLine": 405,
+      "statement": "Export ≠ Backup",
+      "architectureHome": "`06-data-persistence-and-formats.md`; `07-sync-conflict-and-backup.md`",
+      "mechanism": "Integration test",
+      "plannedVerification": "Assert `Export` is not `Backup`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "07",
+        "19",
+        "25",
+        "46"
+      ],
+      "ownerCell": "`07`, `19`, `25`, `46`",
+      "completionGate": "[WP-07.02](../planning/work-packages/07-local-persistence-foundation.md#rule-wp-07.02), [WP-25.07](../planning/work-packages/25-sync-engine-and-blob-lifecycle.md#rule-wp-25.07), [WP-46.04](../planning/work-packages/46-backup-recovery-and-data-health.md#rule-wp-46.04)"
+    },
+    {
+      "id": "I-211",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 464,
+      "coverageLine": 406,
+      "statement": "Repository Projection ≠ Runtime Authority",
+      "architectureHome": "`06-data-persistence-and-formats.md` `§12`; `../requirements/13-data-formats-and-portability.md` `§14`",
+      "mechanism": "Structural + integration test",
+      "plannedVerification": "**Projection is retired delivery**, so the oracle is a prohibition, not a feature test: no assembly carries a projection writer, Git client or LFS path ([GP-01](../architecture/06-data-persistence-and-formats.md#rule-gp-01)), and content reaching the product from a repository is accepted **only** through the ordinary import pipeline — never opened as authority ([GP-02](../architecture/06-data-persistence-and-formats.md#rule-gp-02)).",
+      "owningPackages": [
+        "07",
+        "19"
+      ],
+      "ownerCell": "`07`, `19`",
+      "completionGate": "[WP-19.06](../planning/work-packages/19-arcnotes-search-and-portability.md#rule-wp-19.06), [WP-07.02](../planning/work-packages/07-local-persistence-foundation.md#rule-wp-07.02)"
+    },
+    {
+      "id": "I-212",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 465,
+      "coverageLine": 407,
+      "statement": "Repository Projection ≠ Live Working Store",
+      "architectureHome": "`06-data-persistence-and-formats.md` `§12`; `../requirements/13-data-formats-and-portability.md` `§14`",
+      "mechanism": "Structural + integration test",
+      "plannedVerification": "No code path opens a working store located in or synchronised by a repository as transactional storage ([GP-03](../architecture/06-data-persistence-and-formats.md#rule-gp-03)); the build fails if a Git or LFS dependency is added ([WP-19.06](../planning/work-packages/19-arcnotes-search-and-portability.md#rule-wp-19.06)).",
+      "owningPackages": [
+        "07",
+        "19"
+      ],
+      "ownerCell": "`07`, `19`",
+      "completionGate": "[WP-19.06](../planning/work-packages/19-arcnotes-search-and-portability.md#rule-wp-19.06), [WP-07.02](../planning/work-packages/07-local-persistence-foundation.md#rule-wp-07.02)"
+    },
+    {
+      "id": "I-213",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 466,
+      "coverageLine": 408,
+      "statement": "Git Merge ≠ Collaboration Protocol",
+      "architectureHome": "`06-data-persistence-and-formats.md`; `07-sync-conflict-and-backup.md`",
+      "mechanism": "Integration test",
+      "plannedVerification": "Assert `Git Merge` is not `Collaboration Protocol`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "07",
+        "19",
+        "25",
+        "46"
+      ],
+      "ownerCell": "`07`, `19`, `25`, `46`",
+      "completionGate": "[WP-07.02](../planning/work-packages/07-local-persistence-foundation.md#rule-wp-07.02), [WP-25.07](../planning/work-packages/25-sync-engine-and-blob-lifecycle.md#rule-wp-25.07), [WP-46.04](../planning/work-packages/46-backup-recovery-and-data-health.md#rule-wp-46.04)"
+    },
+    {
+      "id": "I-214",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 467,
+      "coverageLine": 409,
+      "statement": "Git Versioning ≠ Cloud Sync",
+      "architectureHome": "`06-data-persistence-and-formats.md`; `07-sync-conflict-and-backup.md`",
+      "mechanism": "Integration test",
+      "plannedVerification": "Assert `Git Versioning` is not `Cloud Sync`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "07",
+        "19",
+        "25",
+        "46"
+      ],
+      "ownerCell": "`07`, `19`, `25`, `46`",
+      "completionGate": "[WP-07.02](../planning/work-packages/07-local-persistence-foundation.md#rule-wp-07.02), [WP-25.07](../planning/work-packages/25-sync-engine-and-blob-lifecycle.md#rule-wp-25.07), [WP-46.04](../planning/work-packages/46-backup-recovery-and-data-health.md#rule-wp-46.04)"
+    },
+    {
+      "id": "I-215",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 468,
+      "coverageLine": 410,
+      "statement": "Resource Delete ≠ Managed Blob garbage collection",
+      "architectureHome": "`06-data-persistence-and-formats.md`; `07-sync-conflict-and-backup.md`",
+      "mechanism": "Integration test",
+      "plannedVerification": "Assert `Resource Delete` is not `Managed Blob garbage collection`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "07",
+        "19",
+        "25",
+        "46"
+      ],
+      "ownerCell": "`07`, `19`, `25`, `46`",
+      "completionGate": "[WP-07.02](../planning/work-packages/07-local-persistence-foundation.md#rule-wp-07.02), [WP-25.07](../planning/work-packages/25-sync-engine-and-blob-lifecycle.md#rule-wp-25.07), [WP-46.04](../planning/work-packages/46-backup-recovery-and-data-health.md#rule-wp-46.04)"
+    },
+    {
+      "id": "I-216",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 469,
+      "coverageLine": 411,
+      "statement": "Native Package ≠ Trusted Input",
+      "architectureHome": "`06-data-persistence-and-formats.md`; `07-sync-conflict-and-backup.md`",
+      "mechanism": "Integration test",
+      "plannedVerification": "Assert `Native Package` is not `Trusted Input`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "07",
+        "19",
+        "25",
+        "46"
+      ],
+      "ownerCell": "`07`, `19`, `25`, `46`",
+      "completionGate": "[WP-07.02](../planning/work-packages/07-local-persistence-foundation.md#rule-wp-07.02), [WP-25.07](../planning/work-packages/25-sync-engine-and-blob-lifecycle.md#rule-wp-25.07), [WP-46.04](../planning/work-packages/46-backup-recovery-and-data-health.md#rule-wp-46.04)"
+    },
+    {
+      "id": "I-217",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 470,
+      "coverageLine": 412,
+      "statement": "CLR Type ≠ persistent format contract",
+      "architectureHome": "`06-data-persistence-and-formats.md`; `07-sync-conflict-and-backup.md`",
+      "mechanism": "Integration test",
+      "plannedVerification": "Assert `CLR Type` is not `persistent format contract`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "07",
+        "19",
+        "25",
+        "46"
+      ],
+      "ownerCell": "`07`, `19`, `25`, `46`",
+      "completionGate": "[WP-07.02](../planning/work-packages/07-local-persistence-foundation.md#rule-wp-07.02), [WP-25.07](../planning/work-packages/25-sync-engine-and-blob-lifecycle.md#rule-wp-25.07), [WP-46.04](../planning/work-packages/46-backup-recovery-and-data-health.md#rule-wp-46.04)"
+    },
+    {
+      "id": "I-218",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 471,
+      "coverageLine": 413,
+      "statement": "ETag ≠ ArcForges Content Hash",
+      "architectureHome": "`06-data-persistence-and-formats.md`; `07-sync-conflict-and-backup.md`",
+      "mechanism": "Integration test",
+      "plannedVerification": "Assert `ETag` is not `ArcForges Content Hash`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "07",
+        "19",
+        "25",
+        "46"
+      ],
+      "ownerCell": "`07`, `19`, `25`, `46`",
+      "completionGate": "[WP-07.02](../planning/work-packages/07-local-persistence-foundation.md#rule-wp-07.02), [WP-25.07](../planning/work-packages/25-sync-engine-and-blob-lifecycle.md#rule-wp-25.07), [WP-46.04](../planning/work-packages/46-backup-recovery-and-data-health.md#rule-wp-46.04)"
+    },
+    {
+      "id": "I-219",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 472,
+      "coverageLine": 414,
+      "statement": "High Durability ≠ Backup",
+      "architectureHome": "`06-data-persistence-and-formats.md`; `07-sync-conflict-and-backup.md`",
+      "mechanism": "Integration test",
+      "plannedVerification": "Assert `High Durability` is not `Backup`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "07",
+        "19",
+        "25",
+        "46"
+      ],
+      "ownerCell": "`07`, `19`, `25`, `46`",
+      "completionGate": "[WP-07.02](../planning/work-packages/07-local-persistence-foundation.md#rule-wp-07.02), [WP-25.07](../planning/work-packages/25-sync-engine-and-blob-lifecycle.md#rule-wp-25.07), [WP-46.04](../planning/work-packages/46-backup-recovery-and-data-health.md#rule-wp-46.04)"
+    },
+    {
+      "id": "I-220",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 473,
+      "coverageLine": 415,
+      "statement": "Permanent user deletion ≠ same-day disappearance from every disaster backup",
+      "architectureHome": "`06-data-persistence-and-formats.md`; `07-sync-conflict-and-backup.md`",
+      "mechanism": "Integration test",
+      "plannedVerification": "Assert `Permanent user deletion` is not `same-day disappearance from every disaster backup`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "07",
+        "19",
+        "25",
+        "46"
+      ],
+      "ownerCell": "`07`, `19`, `25`, `46`",
+      "completionGate": "[WP-07.02](../planning/work-packages/07-local-persistence-foundation.md#rule-wp-07.02), [WP-25.07](../planning/work-packages/25-sync-engine-and-blob-lifecycle.md#rule-wp-25.07), [WP-46.04](../planning/work-packages/46-backup-recovery-and-data-health.md#rule-wp-46.04)"
+    },
+    {
+      "id": "I-221",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 474,
+      "coverageLine": 416,
+      "statement": "Read compatibility ≠ safe write compatibility",
+      "architectureHome": "`06-data-persistence-and-formats.md`; `07-sync-conflict-and-backup.md`",
+      "mechanism": "Integration test",
+      "plannedVerification": "Assert `Read compatibility` is not `safe write compatibility`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "07",
+        "19",
+        "25",
+        "46"
+      ],
+      "ownerCell": "`07`, `19`, `25`, `46`",
+      "completionGate": "[WP-07.02](../planning/work-packages/07-local-persistence-foundation.md#rule-wp-07.02), [WP-25.07](../planning/work-packages/25-sync-engine-and-blob-lifecycle.md#rule-wp-25.07), [WP-46.04](../planning/work-packages/46-backup-recovery-and-data-health.md#rule-wp-46.04)"
+    },
+    {
+      "id": "I-222",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 475,
+      "coverageLine": 417,
+      "statement": "Cache Recovery ≠ Canonical Data Recovery",
+      "architectureHome": "`06-data-persistence-and-formats.md`; `07-sync-conflict-and-backup.md`",
+      "mechanism": "Integration test",
+      "plannedVerification": "Assert `Cache Recovery` is not `Canonical Data Recovery`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "07",
+        "19",
+        "25",
+        "46"
+      ],
+      "ownerCell": "`07`, `19`, `25`, `46`",
+      "completionGate": "[WP-07.02](../planning/work-packages/07-local-persistence-foundation.md#rule-wp-07.02), [WP-25.07](../planning/work-packages/25-sync-engine-and-blob-lifecycle.md#rule-wp-25.07), [WP-46.04](../planning/work-packages/46-backup-recovery-and-data-health.md#rule-wp-46.04)"
+    },
+    {
+      "id": "I-223",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 476,
+      "coverageLine": 418,
+      "statement": "Projection Repair ≠ Canonical Data Repair",
+      "architectureHome": "`06-data-persistence-and-formats.md`; `07-sync-conflict-and-backup.md`",
+      "mechanism": "Integration test",
+      "plannedVerification": "Assert `Projection Repair` is not `Canonical Data Repair`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "07",
+        "19",
+        "25",
+        "46"
+      ],
+      "ownerCell": "`07`, `19`, `25`, `46`",
+      "completionGate": "[WP-07.02](../planning/work-packages/07-local-persistence-foundation.md#rule-wp-07.02), [WP-25.07](../planning/work-packages/25-sync-engine-and-blob-lifecycle.md#rule-wp-25.07), [WP-46.04](../planning/work-packages/46-backup-recovery-and-data-health.md#rule-wp-46.04)"
+    },
+    {
+      "id": "I-224",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 477,
+      "coverageLine": 419,
+      "statement": "Project Reference ≠ Resource Copy",
+      "architectureHome": "`06-data-persistence-and-formats.md`; `07-sync-conflict-and-backup.md`",
+      "mechanism": "Integration test",
+      "plannedVerification": "Assert `Project Reference` is not `Resource Copy`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "07",
+        "19",
+        "25",
+        "46"
+      ],
+      "ownerCell": "`07`, `19`, `25`, `46`",
+      "completionGate": "[WP-07.02](../planning/work-packages/07-local-persistence-foundation.md#rule-wp-07.02), [WP-25.07](../planning/work-packages/25-sync-engine-and-blob-lifecycle.md#rule-wp-25.07), [WP-46.04](../planning/work-packages/46-backup-recovery-and-data-health.md#rule-wp-46.04)"
+    },
+    {
+      "id": "I-230",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 483,
+      "coverageLine": 420,
+      "statement": "Identity ≠ Actor ≠ Executor ≠ Caller Process",
+      "architectureHome": "`08-security-architecture.md` §2–§13",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Identity` is not `Actor`, `Actor` is not `Executor`, `Executor` is not `Caller Process`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "11",
+        "22"
+      ],
+      "ownerCell": "`11`, `22`",
+      "completionGate": "[WP-11.02](../planning/work-packages/11-security-foundation.md#rule-wp-11.02), [WP-11.04](../planning/work-packages/11-security-foundation.md#rule-wp-11.04)"
+    },
+    {
+      "id": "I-231",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 484,
+      "coverageLine": 421,
+      "statement": "App Identity ≠ Human Authority",
+      "architectureHome": "`08-security-architecture.md` §2–§13",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `App Identity` is not `Human Authority`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "11",
+        "22"
+      ],
+      "ownerCell": "`11`, `22`",
+      "completionGate": "[WP-11.02](../planning/work-packages/11-security-foundation.md#rule-wp-11.02), [WP-11.04](../planning/work-packages/11-security-foundation.md#rule-wp-11.04)"
+    },
+    {
+      "id": "I-232",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 485,
+      "coverageLine": 422,
+      "statement": "Agent Profile ≠ Security Principal",
+      "architectureHome": "`08-security-architecture.md` §2–§13",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Agent Profile` is not `Security Principal`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "11",
+        "22"
+      ],
+      "ownerCell": "`11`, `22`",
+      "completionGate": "[WP-11.02](../planning/work-packages/11-security-foundation.md#rule-wp-11.02), [WP-11.04](../planning/work-packages/11-security-foundation.md#rule-wp-11.04)"
+    },
+    {
+      "id": "I-233",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 486,
+      "coverageLine": 423,
+      "statement": "Agent Capability Configuration ≠ Permission",
+      "architectureHome": "`08-security-architecture.md` §2–§13",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Agent Capability Configuration` is not `Permission`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "11",
+        "22"
+      ],
+      "ownerCell": "`11`, `22`",
+      "completionGate": "[WP-11.02](../planning/work-packages/11-security-foundation.md#rule-wp-11.02), [WP-11.04](../planning/work-packages/11-security-foundation.md#rule-wp-11.04)"
+    },
+    {
+      "id": "I-234",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 487,
+      "coverageLine": 424,
+      "statement": "Automation ≠ Principal",
+      "architectureHome": "`08-security-architecture.md` §2–§13",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Automation` is not `Principal`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "11",
+        "22"
+      ],
+      "ownerCell": "`11`, `22`",
+      "completionGate": "[WP-11.02](../planning/work-packages/11-security-foundation.md#rule-wp-11.02), [WP-11.04](../planning/work-packages/11-security-foundation.md#rule-wp-11.04)"
+    },
+    {
+      "id": "I-235",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 488,
+      "coverageLine": 425,
+      "statement": "Automation Definition ≠ Automation Principal",
+      "architectureHome": "`08-security-architecture.md` §2–§13",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Automation Definition` is not `Automation Principal`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "11",
+        "22"
+      ],
+      "ownerCell": "`11`, `22`",
+      "completionGate": "[WP-11.02](../planning/work-packages/11-security-foundation.md#rule-wp-11.02), [WP-11.04](../planning/work-packages/11-security-foundation.md#rule-wp-11.04)"
+    },
+    {
+      "id": "I-236",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 489,
+      "coverageLine": 426,
+      "statement": "Automation Creator Permission Snapshot ≠ permanent authority",
+      "architectureHome": "`08-security-architecture.md` §2–§13",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Automation Creator Permission Snapshot` is not `permanent authority`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "11",
+        "22"
+      ],
+      "ownerCell": "`11`, `22`",
+      "completionGate": "[WP-11.02](../planning/work-packages/11-security-foundation.md#rule-wp-11.02), [WP-11.04](../planning/work-packages/11-security-foundation.md#rule-wp-11.04)"
+    },
+    {
+      "id": "I-237",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 490,
+      "coverageLine": 427,
+      "statement": "Role ≠ Permission",
+      "architectureHome": "`08-security-architecture.md` §2–§13",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Role` is not `Permission`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "11",
+        "22"
+      ],
+      "ownerCell": "`11`, `22`",
+      "completionGate": "[WP-11.02](../planning/work-packages/11-security-foundation.md#rule-wp-11.02), [WP-11.04](../planning/work-packages/11-security-foundation.md#rule-wp-11.04)"
+    },
+    {
+      "id": "I-238",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 491,
+      "coverageLine": 428,
+      "statement": "Capability Permission ≠ Resource Authorization",
+      "architectureHome": "`08-security-architecture.md` §2–§13",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Capability Permission` is not `Resource Authorization`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "11",
+        "22"
+      ],
+      "ownerCell": "`11`, `22`",
+      "completionGate": "[WP-11.02](../planning/work-packages/11-security-foundation.md#rule-wp-11.02), [WP-11.04](../planning/work-packages/11-security-foundation.md#rule-wp-11.04)"
+    },
+    {
+      "id": "I-239",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 492,
+      "coverageLine": 429,
+      "statement": "Permission ≠ Approval",
+      "architectureHome": "`08-security-architecture.md` §2–§13",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Permission` is not `Approval`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "11",
+        "22"
+      ],
+      "ownerCell": "`11`, `22`",
+      "completionGate": "[WP-11.02](../planning/work-packages/11-security-foundation.md#rule-wp-11.02), [WP-11.04](../planning/work-packages/11-security-foundation.md#rule-wp-11.04)"
+    },
+    {
+      "id": "I-240",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 493,
+      "coverageLine": 430,
+      "statement": "Permission Grant ≠ Approval",
+      "architectureHome": "`08-security-architecture.md` §2–§13",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Permission Grant` is not `Approval`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "11",
+        "22"
+      ],
+      "ownerCell": "`11`, `22`",
+      "completionGate": "[WP-11.02](../planning/work-packages/11-security-foundation.md#rule-wp-11.02), [WP-11.04](../planning/work-packages/11-security-foundation.md#rule-wp-11.04)"
+    },
+    {
+      "id": "I-241",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 494,
+      "coverageLine": 431,
+      "statement": "Approval ≠ Persistent Grant",
+      "architectureHome": "`08-security-architecture.md` §2–§13",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Approval` is not `Persistent Grant`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "11",
+        "22"
+      ],
+      "ownerCell": "`11`, `22`",
+      "completionGate": "[WP-11.02](../planning/work-packages/11-security-foundation.md#rule-wp-11.02), [WP-11.04](../planning/work-packages/11-security-foundation.md#rule-wp-11.04)"
+    },
+    {
+      "id": "I-242",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 495,
+      "coverageLine": 432,
+      "statement": "Approval ≠ Step-up Authentication; Step-up ≠ Approval",
+      "architectureHome": "`08-security-architecture.md` §2–§13",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Approval` is not `Step-up Authentication; Step-up`, `Step-up Authentication; Step-up` is not `Approval`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "11",
+        "22"
+      ],
+      "ownerCell": "`11`, `22`",
+      "completionGate": "[WP-11.02](../planning/work-packages/11-security-foundation.md#rule-wp-11.02), [WP-11.04](../planning/work-packages/11-security-foundation.md#rule-wp-11.04)"
+    },
+    {
+      "id": "I-243",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 496,
+      "coverageLine": 433,
+      "statement": "Remote Approval ≠ Local Presence",
+      "architectureHome": "`08-security-architecture.md` §2–§13",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Remote Approval` is not `Local Presence`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "11",
+        "22"
+      ],
+      "ownerCell": "`11`, `22`",
+      "completionGate": "[WP-11.02](../planning/work-packages/11-security-foundation.md#rule-wp-11.02), [WP-11.04](../planning/work-packages/11-security-foundation.md#rule-wp-11.04)"
+    },
+    {
+      "id": "I-244",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 497,
+      "coverageLine": 434,
+      "statement": "Trust ≠ Permission",
+      "architectureHome": "`08-security-architecture.md` §2–§13",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Trust` is not `Permission`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "11",
+        "22"
+      ],
+      "ownerCell": "`11`, `22`",
+      "completionGate": "[WP-11.02](../planning/work-packages/11-security-foundation.md#rule-wp-11.02), [WP-11.04](../planning/work-packages/11-security-foundation.md#rule-wp-11.04)"
+    },
+    {
+      "id": "I-245",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 498,
+      "coverageLine": 435,
+      "statement": "Trust ≠ Risk",
+      "architectureHome": "`08-security-architecture.md` §2–§13",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Trust` is not `Risk`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "11",
+        "22"
+      ],
+      "ownerCell": "`11`, `22`",
+      "completionGate": "[WP-11.02](../planning/work-packages/11-security-foundation.md#rule-wp-11.02), [WP-11.04](../planning/work-packages/11-security-foundation.md#rule-wp-11.04)"
+    },
+    {
+      "id": "I-246",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 499,
+      "coverageLine": 436,
+      "statement": "Trust ≠ Entitlement",
+      "architectureHome": "`08-security-architecture.md` §2–§13",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Trust` is not `Entitlement`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "11",
+        "22"
+      ],
+      "ownerCell": "`11`, `22`",
+      "completionGate": "[WP-11.02](../planning/work-packages/11-security-foundation.md#rule-wp-11.02), [WP-11.04](../planning/work-packages/11-security-foundation.md#rule-wp-11.04)"
+    },
+    {
+      "id": "I-247",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 500,
+      "coverageLine": 437,
+      "statement": "Package Signature ≠ Safety",
+      "architectureHome": "`08-security-architecture.md` §2–§13",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Package Signature` is not `Safety`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "11",
+        "22"
+      ],
+      "ownerCell": "`11`, `22`",
+      "completionGate": "[WP-11.02](../planning/work-packages/11-security-foundation.md#rule-wp-11.02), [WP-11.04](../planning/work-packages/11-security-foundation.md#rule-wp-11.04)"
+    },
+    {
+      "id": "I-248",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 501,
+      "coverageLine": 438,
+      "statement": "Verified Publisher ≠ Unlimited Access; Verified Publisher ≠ safe capability",
+      "architectureHome": "`08-security-architecture.md` §2–§13",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Verified Publisher` is not `Unlimited Access; Verified Publisher`, `Unlimited Access; Verified Publisher` is not `safe capability`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "11",
+        "22"
+      ],
+      "ownerCell": "`11`, `22`",
+      "completionGate": "[WP-11.02](../planning/work-packages/11-security-foundation.md#rule-wp-11.02), [WP-11.04](../planning/work-packages/11-security-foundation.md#rule-wp-11.04)"
+    },
+    {
+      "id": "I-249",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 502,
+      "coverageLine": 439,
+      "statement": "First-party ≠ Unlimited Access",
+      "architectureHome": "`08-security-architecture.md` §2–§13",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `First-party` is not `Unlimited Access`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "11",
+        "22"
+      ],
+      "ownerCell": "`11`, `22`",
+      "completionGate": "[WP-11.02](../planning/work-packages/11-security-foundation.md#rule-wp-11.02), [WP-11.04](../planning/work-packages/11-security-foundation.md#rule-wp-11.04)"
+    },
+    {
+      "id": "I-250",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 503,
+      "coverageLine": 440,
+      "statement": "Device Presence ≠ Device Trust",
+      "architectureHome": "`08-security-architecture.md` §2–§13",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Device Presence` is not `Device Trust`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "11",
+        "22"
+      ],
+      "ownerCell": "`11`, `22`",
+      "completionGate": "[WP-11.02](../planning/work-packages/11-security-foundation.md#rule-wp-11.02), [WP-11.04](../planning/work-packages/11-security-foundation.md#rule-wp-11.04)"
+    },
+    {
+      "id": "I-251",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 504,
+      "coverageLine": 441,
+      "statement": "Device Online ≠ Remote Agent Enabled",
+      "architectureHome": "`08-security-architecture.md` §2–§13",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Device Online` is not `Remote Agent Enabled`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "11",
+        "22"
+      ],
+      "ownerCell": "`11`, `22`",
+      "completionGate": "[WP-11.02](../planning/work-packages/11-security-foundation.md#rule-wp-11.02), [WP-11.04](../planning/work-packages/11-security-foundation.md#rule-wp-11.04)"
+    },
+    {
+      "id": "I-252",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 505,
+      "coverageLine": 442,
+      "statement": "Registered Device ≠ Remote-authorized Device",
+      "architectureHome": "`08-security-architecture.md` §2–§13",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Registered Device` is not `Remote-authorized Device`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "11",
+        "22"
+      ],
+      "ownerCell": "`11`, `22`",
+      "completionGate": "[WP-11.02](../planning/work-packages/11-security-foundation.md#rule-wp-11.02), [WP-11.04](../planning/work-packages/11-security-foundation.md#rule-wp-11.04)"
+    },
+    {
+      "id": "I-253",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 506,
+      "coverageLine": 443,
+      "statement": "Knowledge Eligibility ≠ Read Permission",
+      "architectureHome": "`08-security-architecture.md` §2–§13",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Knowledge Eligibility` is not `Read Permission`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "11",
+        "22"
+      ],
+      "ownerCell": "`11`, `22`",
+      "completionGate": "[WP-11.02](../planning/work-packages/11-security-foundation.md#rule-wp-11.02), [WP-11.04](../planning/work-packages/11-security-foundation.md#rule-wp-11.04)"
+    },
+    {
+      "id": "I-254",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 507,
+      "coverageLine": 444,
+      "statement": "Read Permission ≠ Data Egress Permission",
+      "architectureHome": "`08-security-architecture.md` §2–§13",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Read Permission` is not `Data Egress Permission`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "11",
+        "22"
+      ],
+      "ownerCell": "`11`, `22`",
+      "completionGate": "[WP-11.02](../planning/work-packages/11-security-foundation.md#rule-wp-11.02), [WP-11.04](../planning/work-packages/11-security-foundation.md#rule-wp-11.04)"
+    },
+    {
+      "id": "I-255",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 508,
+      "coverageLine": 445,
+      "statement": "Synced Data ≠ allowed external transmission",
+      "architectureHome": "`08-security-architecture.md` §2–§13",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Synced Data` is not `allowed external transmission`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "11",
+        "22"
+      ],
+      "ownerCell": "`11`, `22`",
+      "completionGate": "[WP-11.02](../planning/work-packages/11-security-foundation.md#rule-wp-11.02), [WP-11.04](../planning/work-packages/11-security-foundation.md#rule-wp-11.04)"
+    },
+    {
+      "id": "I-256",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 509,
+      "coverageLine": 446,
+      "statement": "SecretRef ≠ Secret Value",
+      "architectureHome": "`08-security-architecture.md` §2–§13",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `SecretRef` is not `Secret Value`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "11",
+        "22"
+      ],
+      "ownerCell": "`11`, `22`",
+      "completionGate": "[WP-11.02](../planning/work-packages/11-security-foundation.md#rule-wp-11.02), [WP-11.04](../planning/work-packages/11-security-foundation.md#rule-wp-11.04)"
+    },
+    {
+      "id": "I-257",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 510,
+      "coverageLine": 447,
+      "statement": "Secret Use ≠ Secret Reveal",
+      "architectureHome": "`08-security-architecture.md` §2–§13",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Secret Use` is not `Secret Reveal`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "11",
+        "22"
+      ],
+      "ownerCell": "`11`, `22`",
+      "completionGate": "[WP-11.02](../planning/work-packages/11-security-foundation.md#rule-wp-11.02), [WP-11.04](../planning/work-packages/11-security-foundation.md#rule-wp-11.04)"
+    },
+    {
+      "id": "I-258",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 511,
+      "coverageLine": 448,
+      "statement": "Secret Permission ≠ general Settings permission",
+      "architectureHome": "`08-security-architecture.md` §2–§13",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Secret Permission` is not `general Settings permission`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "11",
+        "22"
+      ],
+      "ownerCell": "`11`, `22`",
+      "completionGate": "[WP-11.02](../planning/work-packages/11-security-foundation.md#rule-wp-11.02), [WP-11.04](../planning/work-packages/11-security-foundation.md#rule-wp-11.04)"
+    },
+    {
+      "id": "I-259",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 512,
+      "coverageLine": 449,
+      "statement": "Extension Isolation ≠ Authorization",
+      "architectureHome": "`08-security-architecture.md` §2–§13",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Extension Isolation` is not `Authorization`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "11",
+        "22"
+      ],
+      "ownerCell": "`11`, `22`",
+      "completionGate": "[WP-11.02](../planning/work-packages/11-security-foundation.md#rule-wp-11.02), [WP-11.04](../planning/work-packages/11-security-foundation.md#rule-wp-11.04)"
+    },
+    {
+      "id": "I-260",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 513,
+      "coverageLine": 450,
+      "statement": "Out-of-process ≠ automatically safe",
+      "architectureHome": "`08-security-architecture.md` §2–§13",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Out-of-process` is not `automatically safe`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "11",
+        "22"
+      ],
+      "ownerCell": "`11`, `22`",
+      "completionGate": "[WP-11.02](../planning/work-packages/11-security-foundation.md#rule-wp-11.02), [WP-11.04](../planning/work-packages/11-security-foundation.md#rule-wp-11.04)"
+    },
+    {
+      "id": "I-261",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 514,
+      "coverageLine": 451,
+      "statement": "MCP Protocol ≠ Trust",
+      "architectureHome": "`08-security-architecture.md` §2–§13",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `MCP Protocol` is not `Trust`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "11",
+        "22"
+      ],
+      "ownerCell": "`11`, `22`",
+      "completionGate": "[WP-11.02](../planning/work-packages/11-security-foundation.md#rule-wp-11.02), [WP-11.04](../planning/work-packages/11-security-foundation.md#rule-wp-11.04)"
+    },
+    {
+      "id": "I-262",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 515,
+      "coverageLine": 452,
+      "statement": "MCP Tool Description ≠ Trusted Instruction",
+      "architectureHome": "`08-security-architecture.md` §2–§13",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `MCP Tool Description` is not `Trusted Instruction`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "11",
+        "22"
+      ],
+      "ownerCell": "`11`, `22`",
+      "completionGate": "[WP-11.02](../planning/work-packages/11-security-foundation.md#rule-wp-11.02), [WP-11.04](../planning/work-packages/11-security-foundation.md#rule-wp-11.04)"
+    },
+    {
+      "id": "I-263",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 516,
+      "coverageLine": 453,
+      "statement": "Retrieved Content ≠ Security Instruction",
+      "architectureHome": "`08-security-architecture.md` §2–§13",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Retrieved Content` is not `Security Instruction`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "11",
+        "22"
+      ],
+      "ownerCell": "`11`, `22`",
+      "completionGate": "[WP-11.02](../planning/work-packages/11-security-foundation.md#rule-wp-11.02), [WP-11.04](../planning/work-packages/11-security-foundation.md#rule-wp-11.04)"
+    },
+    {
+      "id": "I-264",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 517,
+      "coverageLine": 454,
+      "statement": "Skill Guidance ≠ Permission Grant",
+      "architectureHome": "`08-security-architecture.md` §2–§13",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Skill Guidance` is not `Permission Grant`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "11",
+        "22"
+      ],
+      "ownerCell": "`11`, `22`",
+      "completionGate": "[WP-11.02](../planning/work-packages/11-security-foundation.md#rule-wp-11.02), [WP-11.04](../planning/work-packages/11-security-foundation.md#rule-wp-11.04)"
+    },
+    {
+      "id": "I-265",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 518,
+      "coverageLine": 455,
+      "statement": "Workflow Definition ≠ Authorization",
+      "architectureHome": "`08-security-architecture.md` §2–§13",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Workflow Definition` is not `Authorization`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "11",
+        "22"
+      ],
+      "ownerCell": "`11`, `22`",
+      "completionGate": "[WP-11.02](../planning/work-packages/11-security-foundation.md#rule-wp-11.02), [WP-11.04](../planning/work-packages/11-security-foundation.md#rule-wp-11.04)"
+    },
+    {
+      "id": "I-266",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 519,
+      "coverageLine": 456,
+      "statement": "Delegation ≠ Privilege Amplification",
+      "architectureHome": "`08-security-architecture.md` §2–§13",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Delegation` is not `Privilege Amplification`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "11",
+        "22"
+      ],
+      "ownerCell": "`11`, `22`",
+      "completionGate": "[WP-11.02](../planning/work-packages/11-security-foundation.md#rule-wp-11.02), [WP-11.04](../planning/work-packages/11-security-foundation.md#rule-wp-11.04)"
+    },
+    {
+      "id": "I-267",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 520,
+      "coverageLine": 457,
+      "statement": "Permission Revocation ≠ Undo",
+      "architectureHome": "`08-security-architecture.md` §2–§13",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Permission Revocation` is not `Undo`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "11",
+        "22"
+      ],
+      "ownerCell": "`11`, `22`",
+      "completionGate": "[WP-11.02](../planning/work-packages/11-security-foundation.md#rule-wp-11.02), [WP-11.04](../planning/work-packages/11-security-foundation.md#rule-wp-11.04)"
+    },
+    {
+      "id": "I-268",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 521,
+      "coverageLine": 458,
+      "statement": "Revocation ≠ Compensation",
+      "architectureHome": "`08-security-architecture.md` §2–§13",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Revocation` is not `Compensation`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "11",
+        "22"
+      ],
+      "ownerCell": "`11`, `22`",
+      "completionGate": "[WP-11.02](../planning/work-packages/11-security-foundation.md#rule-wp-11.02), [WP-11.04](../planning/work-packages/11-security-foundation.md#rule-wp-11.04)"
+    },
+    {
+      "id": "I-269",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 522,
+      "coverageLine": 459,
+      "statement": "Declared Permission ≠ Granted Permission",
+      "architectureHome": "`08-security-architecture.md` §2–§13",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Declared Permission` is not `Granted Permission`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "11",
+        "22"
+      ],
+      "ownerCell": "`11`, `22`",
+      "completionGate": "[WP-11.02](../planning/work-packages/11-security-foundation.md#rule-wp-11.02), [WP-11.04](../planning/work-packages/11-security-foundation.md#rule-wp-11.04)"
+    },
+    {
+      "id": "I-270",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 523,
+      "coverageLine": 460,
+      "statement": "Installation ≠ authorize all operations",
+      "architectureHome": "`08-security-architecture.md` §2–§13",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Installation` is not `authorize all operations`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "11",
+        "22"
+      ],
+      "ownerCell": "`11`, `22`",
+      "completionGate": "[WP-11.02](../planning/work-packages/11-security-foundation.md#rule-wp-11.02), [WP-11.04](../planning/work-packages/11-security-foundation.md#rule-wp-11.04)"
+    },
+    {
+      "id": "I-271",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 524,
+      "coverageLine": 461,
+      "statement": "Developer Mode ≠ permission bypass ≠ secret bypass ≠ workspace-policy bypass",
+      "architectureHome": "`08-security-architecture.md` §2–§13",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Developer Mode` is not `permission bypass`, `permission bypass` is not `secret bypass`, `secret bypass` is not `workspace-policy bypass`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "11",
+        "22"
+      ],
+      "ownerCell": "`11`, `22`",
+      "completionGate": "[WP-11.02](../planning/work-packages/11-security-foundation.md#rule-wp-11.02), [WP-11.04](../planning/work-packages/11-security-foundation.md#rule-wp-11.04)"
+    },
+    {
+      "id": "I-272",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 525,
+      "coverageLine": 462,
+      "statement": "Audit ≠ Debug Log",
+      "architectureHome": "`08-security-architecture.md` §2–§13",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Audit` is not `Debug Log`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "11",
+        "22"
+      ],
+      "ownerCell": "`11`, `22`",
+      "completionGate": "[WP-11.02](../planning/work-packages/11-security-foundation.md#rule-wp-11.02), [WP-11.04](../planning/work-packages/11-security-foundation.md#rule-wp-11.04)"
+    },
+    {
+      "id": "I-273",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 526,
+      "coverageLine": 463,
+      "statement": "Audit ≠ Telemetry",
+      "architectureHome": "`08-security-architecture.md` §2–§13",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Audit` is not `Telemetry`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "11",
+        "22"
+      ],
+      "ownerCell": "`11`, `22`",
+      "completionGate": "[WP-11.02](../planning/work-packages/11-security-foundation.md#rule-wp-11.02), [WP-11.04](../planning/work-packages/11-security-foundation.md#rule-wp-11.04)"
+    },
+    {
+      "id": "I-274",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 527,
+      "coverageLine": 464,
+      "statement": "Audit ≠ Domain Revision History; Audit ≠ Product History",
+      "architectureHome": "`08-security-architecture.md` §2–§13",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Audit` is not `Domain Revision History; Audit`, `Domain Revision History; Audit` is not `Product History`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "11",
+        "22"
+      ],
+      "ownerCell": "`11`, `22`",
+      "completionGate": "[WP-11.02](../planning/work-packages/11-security-foundation.md#rule-wp-11.02), [WP-11.04](../planning/work-packages/11-security-foundation.md#rule-wp-11.04)"
+    },
+    {
+      "id": "I-275",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 528,
+      "coverageLine": 465,
+      "statement": "Audit ≠ Task Operational Trace",
+      "architectureHome": "`08-security-architecture.md` §2–§13",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Audit` is not `Task Operational Trace`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "11",
+        "22"
+      ],
+      "ownerCell": "`11`, `22`",
+      "completionGate": "[WP-11.02](../planning/work-packages/11-security-foundation.md#rule-wp-11.02), [WP-11.04](../planning/work-packages/11-security-foundation.md#rule-wp-11.04)"
+    },
+    {
+      "id": "I-276",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 529,
+      "coverageLine": 466,
+      "statement": "Diagnostic Log ≠ Audit",
+      "architectureHome": "`08-security-architecture.md` §2–§13",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Diagnostic Log` is not `Audit`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "11",
+        "22"
+      ],
+      "ownerCell": "`11`, `22`",
+      "completionGate": "[WP-11.02](../planning/work-packages/11-security-foundation.md#rule-wp-11.02), [WP-11.04](../planning/work-packages/11-security-foundation.md#rule-wp-11.04)"
+    },
+    {
+      "id": "I-277",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 530,
+      "coverageLine": 467,
+      "statement": "App Lock ≠ Account Authentication",
+      "architectureHome": "`08-security-architecture.md` §2–§13",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `App Lock` is not `Account Authentication`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "11",
+        "22"
+      ],
+      "ownerCell": "`11`, `22`",
+      "completionGate": "[WP-11.02](../planning/work-packages/11-security-foundation.md#rule-wp-11.02), [WP-11.04](../planning/work-packages/11-security-foundation.md#rule-wp-11.04)"
+    },
+    {
+      "id": "I-278",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 531,
+      "coverageLine": 468,
+      "statement": "Mobile Biometric Unlock ≠ high-risk authorization",
+      "architectureHome": "`08-security-architecture.md` §2–§13",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Mobile Biometric Unlock` is not `high-risk authorization`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "11",
+        "22"
+      ],
+      "ownerCell": "`11`, `22`",
+      "completionGate": "[WP-11.02](../planning/work-packages/11-security-foundation.md#rule-wp-11.02), [WP-11.04](../planning/work-packages/11-security-foundation.md#rule-wp-11.04)"
+    },
+    {
+      "id": "I-279",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 532,
+      "coverageLine": 469,
+      "statement": "HTTPS Private Link ≠ Public Share Link",
+      "architectureHome": "`08-security-architecture.md` §2–§13",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `HTTPS Private Link` is not `Public Share Link`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "11",
+        "22"
+      ],
+      "ownerCell": "`11`, `22`",
+      "completionGate": "[WP-11.02](../planning/work-packages/11-security-foundation.md#rule-wp-11.02), [WP-11.04](../planning/work-packages/11-security-foundation.md#rule-wp-11.04)"
+    },
+    {
+      "id": "I-280",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 533,
+      "coverageLine": 470,
+      "statement": "Search ≠ Remote Desktop scan",
+      "architectureHome": "`08-security-architecture.md` §2–§13",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Search` is not `Remote Desktop scan`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "11",
+        "22"
+      ],
+      "ownerCell": "`11`, `22`",
+      "completionGate": "[WP-11.02](../planning/work-packages/11-security-foundation.md#rule-wp-11.02), [WP-11.04](../planning/work-packages/11-security-foundation.md#rule-wp-11.04)"
+    },
+    {
+      "id": "I-281",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 534,
+      "coverageLine": 471,
+      "statement": "Stage-25 Product Policy ≠ Stage-26 Authorization",
+      "architectureHome": "`08-security-architecture.md` §2–§13",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Stage-25 Product Policy` is not `Stage-26 Authorization`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "11",
+        "22"
+      ],
+      "ownerCell": "`11`, `22`",
+      "completionGate": "[WP-11.02](../planning/work-packages/11-security-foundation.md#rule-wp-11.02), [WP-11.04](../planning/work-packages/11-security-foundation.md#rule-wp-11.04)"
+    },
+    {
+      "id": "I-290",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 540,
+      "coverageLine": 472,
+      "statement": "Skill ≠ Capability",
+      "architectureHome": "`15-extension-platform-architecture.md`",
+      "mechanism": "Integration test",
+      "plannedVerification": "Assert `Skill` is not `Capability`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "41"
+      ],
+      "ownerCell": "`41`",
+      "completionGate": "[WP-41.02](../planning/work-packages/41-extension-platform-and-integrations.md#rule-wp-41.02), [WP-41.04](../planning/work-packages/41-extension-platform-and-integrations.md#rule-wp-41.04)"
+    },
+    {
+      "id": "I-291",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 541,
+      "coverageLine": 473,
+      "statement": "Skill ≠ Extension Code",
+      "architectureHome": "`15-extension-platform-architecture.md`",
+      "mechanism": "Integration test",
+      "plannedVerification": "Assert `Skill` is not `Extension Code`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "41"
+      ],
+      "ownerCell": "`41`",
+      "completionGate": "[WP-41.02](../planning/work-packages/41-extension-platform-and-integrations.md#rule-wp-41.02), [WP-41.04](../planning/work-packages/41-extension-platform-and-integrations.md#rule-wp-41.04)"
+    },
+    {
+      "id": "I-292",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 542,
+      "coverageLine": 474,
+      "statement": "Skill ≠ MCP",
+      "architectureHome": "`15-extension-platform-architecture.md`",
+      "mechanism": "Integration test",
+      "plannedVerification": "Assert `Skill` is not `MCP`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "41"
+      ],
+      "ownerCell": "`41`",
+      "completionGate": "[WP-41.02](../planning/work-packages/41-extension-platform-and-integrations.md#rule-wp-41.02), [WP-41.04](../planning/work-packages/41-extension-platform-and-integrations.md#rule-wp-41.04)"
+    },
+    {
+      "id": "I-293",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 543,
+      "coverageLine": 475,
+      "statement": "Template ≠ Skill",
+      "architectureHome": "`15-extension-platform-architecture.md`",
+      "mechanism": "Integration test",
+      "plannedVerification": "Assert `Template` is not `Skill`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "41"
+      ],
+      "ownerCell": "`41`",
+      "completionGate": "[WP-41.02](../planning/work-packages/41-extension-platform-and-integrations.md#rule-wp-41.02), [WP-41.04](../planning/work-packages/41-extension-platform-and-integrations.md#rule-wp-41.04)"
+    },
+    {
+      "id": "I-294",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 544,
+      "coverageLine": 476,
+      "statement": "Template ≠ live parent resource",
+      "architectureHome": "`15-extension-platform-architecture.md`",
+      "mechanism": "Integration test",
+      "plannedVerification": "Assert `Template` is not `live parent resource`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "41"
+      ],
+      "ownerCell": "`41`",
+      "completionGate": "[WP-41.02](../planning/work-packages/41-extension-platform-and-integrations.md#rule-wp-41.02), [WP-41.04](../planning/work-packages/41-extension-platform-and-integrations.md#rule-wp-41.04)"
+    },
+    {
+      "id": "I-295",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 545,
+      "coverageLine": 477,
+      "statement": "Workflow ≠ Automation",
+      "architectureHome": "`15-extension-platform-architecture.md`",
+      "mechanism": "Integration test",
+      "plannedVerification": "Assert `Workflow` is not `Automation`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "41"
+      ],
+      "ownerCell": "`41`",
+      "completionGate": "[WP-41.02](../planning/work-packages/41-extension-platform-and-integrations.md#rule-wp-41.02), [WP-41.04](../planning/work-packages/41-extension-platform-and-integrations.md#rule-wp-41.04)"
+    },
+    {
+      "id": "I-296",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 546,
+      "coverageLine": 478,
+      "statement": "Workflow ≠ Task",
+      "architectureHome": "`15-extension-platform-architecture.md`",
+      "mechanism": "Integration test",
+      "plannedVerification": "Assert `Workflow` is not `Task`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "41"
+      ],
+      "ownerCell": "`41`",
+      "completionGate": "[WP-41.02](../planning/work-packages/41-extension-platform-and-integrations.md#rule-wp-41.02), [WP-41.04](../planning/work-packages/41-extension-platform-and-integrations.md#rule-wp-41.04)"
+    },
+    {
+      "id": "I-297",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 547,
+      "coverageLine": 479,
+      "statement": "Workflow ≠ Agent Plan",
+      "architectureHome": "`15-extension-platform-architecture.md`",
+      "mechanism": "Integration test",
+      "plannedVerification": "Assert `Workflow` is not `Agent Plan`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "41"
+      ],
+      "ownerCell": "`41`",
+      "completionGate": "[WP-41.02](../planning/work-packages/41-extension-platform-and-integrations.md#rule-wp-41.02), [WP-41.04](../planning/work-packages/41-extension-platform-and-integrations.md#rule-wp-41.04)"
+    },
+    {
+      "id": "I-298",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 548,
+      "coverageLine": 480,
+      "statement": "Workflow ≠ arbitrary script runtime",
+      "architectureHome": "`15-extension-platform-architecture.md`",
+      "mechanism": "Integration test",
+      "plannedVerification": "Assert `Workflow` is not `arbitrary script runtime`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "41"
+      ],
+      "ownerCell": "`41`",
+      "completionGate": "[WP-41.02](../planning/work-packages/41-extension-platform-and-integrations.md#rule-wp-41.02), [WP-41.04](../planning/work-packages/41-extension-platform-and-integrations.md#rule-wp-41.04)"
+    },
+    {
+      "id": "I-299",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 549,
+      "coverageLine": 481,
+      "statement": "Automation ≠ Workflow",
+      "architectureHome": "`15-extension-platform-architecture.md`",
+      "mechanism": "Integration test",
+      "plannedVerification": "Assert `Automation` is not `Workflow`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "41"
+      ],
+      "ownerCell": "`41`",
+      "completionGate": "[WP-41.02](../planning/work-packages/41-extension-platform-and-integrations.md#rule-wp-41.02), [WP-41.04](../planning/work-packages/41-extension-platform-and-integrations.md#rule-wp-41.04)"
+    },
+    {
+      "id": "I-300",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 550,
+      "coverageLine": 482,
+      "statement": "Package ≠ Contribution",
+      "architectureHome": "`15-extension-platform-architecture.md`",
+      "mechanism": "Integration test",
+      "plannedVerification": "Assert `Package` is not `Contribution`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "41"
+      ],
+      "ownerCell": "`41`",
+      "completionGate": "[WP-41.02](../planning/work-packages/41-extension-platform-and-integrations.md#rule-wp-41.02), [WP-41.04](../planning/work-packages/41-extension-platform-and-integrations.md#rule-wp-41.04)"
+    },
+    {
+      "id": "I-301",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 551,
+      "coverageLine": 483,
+      "statement": "Package Version ≠ Protocol Version",
+      "architectureHome": "`15-extension-platform-architecture.md`",
+      "mechanism": "Integration test",
+      "plannedVerification": "Assert `Package Version` is not `Protocol Version`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "41"
+      ],
+      "ownerCell": "`41`",
+      "completionGate": "[WP-41.02](../planning/work-packages/41-extension-platform-and-integrations.md#rule-wp-41.02), [WP-41.04](../planning/work-packages/41-extension-platform-and-integrations.md#rule-wp-41.04)"
+    },
+    {
+      "id": "I-302",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 552,
+      "coverageLine": 484,
+      "statement": "Package Version ≠ App Version",
+      "architectureHome": "`15-extension-platform-architecture.md`",
+      "mechanism": "Integration test",
+      "plannedVerification": "Assert `Package Version` is not `App Version`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "41"
+      ],
+      "ownerCell": "`41`",
+      "completionGate": "[WP-41.02](../planning/work-packages/41-extension-platform-and-integrations.md#rule-wp-41.02), [WP-41.04](../planning/work-packages/41-extension-platform-and-integrations.md#rule-wp-41.04)"
+    },
+    {
+      "id": "I-303",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 553,
+      "coverageLine": 485,
+      "statement": "Install ≠ Enable",
+      "architectureHome": "`15-extension-platform-architecture.md`",
+      "mechanism": "Integration test",
+      "plannedVerification": "Assert `Install` is not `Enable`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "41"
+      ],
+      "ownerCell": "`41`",
+      "completionGate": "[WP-41.02](../planning/work-packages/41-extension-platform-and-integrations.md#rule-wp-41.02), [WP-41.04](../planning/work-packages/41-extension-platform-and-integrations.md#rule-wp-41.04)"
+    },
+    {
+      "id": "I-304",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 554,
+      "coverageLine": 486,
+      "statement": "Install ≠ Permission Grant",
+      "architectureHome": "`15-extension-platform-architecture.md`",
+      "mechanism": "Integration test",
+      "plannedVerification": "Assert `Install` is not `Permission Grant`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "41"
+      ],
+      "ownerCell": "`41`",
+      "completionGate": "[WP-41.02](../planning/work-packages/41-extension-platform-and-integrations.md#rule-wp-41.02), [WP-41.04](../planning/work-packages/41-extension-platform-and-integrations.md#rule-wp-41.04)"
+    },
+    {
+      "id": "I-305",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 555,
+      "coverageLine": 487,
+      "statement": "Compatibility ≠ Trust",
+      "architectureHome": "`15-extension-platform-architecture.md`",
+      "mechanism": "Integration test",
+      "plannedVerification": "Assert `Compatibility` is not `Trust`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "41"
+      ],
+      "ownerCell": "`41`",
+      "completionGate": "[WP-41.02](../planning/work-packages/41-extension-platform-and-integrations.md#rule-wp-41.02), [WP-41.04](../planning/work-packages/41-extension-platform-and-integrations.md#rule-wp-41.04)"
+    },
+    {
+      "id": "I-306",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 556,
+      "coverageLine": 488,
+      "statement": "Compatibility ≠ Enablement",
+      "architectureHome": "`15-extension-platform-architecture.md`",
+      "mechanism": "Integration test",
+      "plannedVerification": "Assert `Compatibility` is not `Enablement`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "41"
+      ],
+      "ownerCell": "`41`",
+      "completionGate": "[WP-41.02](../planning/work-packages/41-extension-platform-and-integrations.md#rule-wp-41.02), [WP-41.04](../planning/work-packages/41-extension-platform-and-integrations.md#rule-wp-41.04)"
+    },
+    {
+      "id": "I-307",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 557,
+      "coverageLine": 489,
+      "statement": "MCP ≠ native Arc capability",
+      "architectureHome": "`15-extension-platform-architecture.md`",
+      "mechanism": "Integration test",
+      "plannedVerification": "Assert `MCP` is not `native Arc capability`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "41"
+      ],
+      "ownerCell": "`41`",
+      "completionGate": "[WP-41.02](../planning/work-packages/41-extension-platform-and-integrations.md#rule-wp-41.02), [WP-41.04](../planning/work-packages/41-extension-platform-and-integrations.md#rule-wp-41.04)"
+    },
+    {
+      "id": "I-308",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 558,
+      "coverageLine": 490,
+      "statement": "MCP ≠ Connector",
+      "architectureHome": "`15-extension-platform-architecture.md`",
+      "mechanism": "Integration test",
+      "plannedVerification": "Assert `MCP` is not `Connector`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "41"
+      ],
+      "ownerCell": "`41`",
+      "completionGate": "[WP-41.02](../planning/work-packages/41-extension-platform-and-integrations.md#rule-wp-41.02), [WP-41.04](../planning/work-packages/41-extension-platform-and-integrations.md#rule-wp-41.04)"
+    },
+    {
+      "id": "I-309",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 559,
+      "coverageLine": 491,
+      "statement": "MCP Definition ≠ MCP Connection",
+      "architectureHome": "`15-extension-platform-architecture.md`",
+      "mechanism": "Integration test",
+      "plannedVerification": "Assert `MCP Definition` is not `MCP Connection`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "41"
+      ],
+      "ownerCell": "`41`",
+      "completionGate": "[WP-41.02](../planning/work-packages/41-extension-platform-and-integrations.md#rule-wp-41.02), [WP-41.04](../planning/work-packages/41-extension-platform-and-integrations.md#rule-wp-41.04)"
+    },
+    {
+      "id": "I-310",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 560,
+      "coverageLine": 492,
+      "statement": "MCP Prompt ≠ Skill",
+      "architectureHome": "`15-extension-platform-architecture.md`",
+      "mechanism": "Integration test",
+      "plannedVerification": "Assert `MCP Prompt` is not `Skill`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "41"
+      ],
+      "ownerCell": "`41`",
+      "completionGate": "[WP-41.02](../planning/work-packages/41-extension-platform-and-integrations.md#rule-wp-41.02), [WP-41.04](../planning/work-packages/41-extension-platform-and-integrations.md#rule-wp-41.04)"
+    },
+    {
+      "id": "I-311",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 561,
+      "coverageLine": 493,
+      "statement": "Connector ≠ Connection",
+      "architectureHome": "`15-extension-platform-architecture.md`",
+      "mechanism": "Integration test",
+      "plannedVerification": "Assert `Connector` is not `Connection`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "41"
+      ],
+      "ownerCell": "`41`",
+      "completionGate": "[WP-41.02](../planning/work-packages/41-extension-platform-and-integrations.md#rule-wp-41.02), [WP-41.04](../planning/work-packages/41-extension-platform-and-integrations.md#rule-wp-41.04)"
+    },
+    {
+      "id": "I-312",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 562,
+      "coverageLine": 494,
+      "statement": "Connector ≠ imported snapshot",
+      "architectureHome": "`15-extension-platform-architecture.md`",
+      "mechanism": "Integration test",
+      "plannedVerification": "Assert `Connector` is not `imported snapshot`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "41"
+      ],
+      "ownerCell": "`41`",
+      "completionGate": "[WP-41.02](../planning/work-packages/41-extension-platform-and-integrations.md#rule-wp-41.02), [WP-41.04](../planning/work-packages/41-extension-platform-and-integrations.md#rule-wp-41.04)"
+    },
+    {
+      "id": "I-313",
+      "status": "retired",
+      "section": "7",
+      "catalogueLine": 563,
+      "coverageLine": 495,
+      "statement": "**Retired by [P2-006](../decisions/phase-2-specification-decisions.md#rule-p2-006):** external-agent integration is excluded, not a separate agent-profile implementation.",
+      "architectureHome": "—",
+      "mechanism": "Absence test",
+      "plannedVerification": "Assert no external-agent contribution type or delegation adapter is registered; profiles remain data for the sole Harness.",
+      "owningPackages": [
+        "05",
+        "41",
+        "43"
+      ],
+      "ownerCell": "[WP-05](../planning/work-packages/05-architecture-and-repository-policy-tests.md#rule-wp-05), [WP-43.03](../planning/work-packages/43-managed-ai-routing-and-metering.md#rule-wp-43.03), [WP-41.07](../planning/work-packages/41-extension-platform-and-integrations.md#rule-wp-41.07)",
+      "completionGate": "The exclusion is structurally asserted, not merely undocumented"
+    },
+    {
+      "id": "I-314",
+      "status": "retired",
+      "section": "7",
+      "catalogueLine": 564,
+      "coverageLine": 496,
+      "statement": "**Retired by [P2-006](../decisions/phase-2-specification-decisions.md#rule-p2-006):** no external-agent task/delegation adapter is required.",
+      "architectureHome": "—",
+      "mechanism": "Absence test",
+      "plannedVerification": "Assert no ACP/external-agent Task adapter or hidden runtime is required by any active work package.",
+      "owningPackages": [
+        "05",
+        "41",
+        "43"
+      ],
+      "ownerCell": "[WP-05](../planning/work-packages/05-architecture-and-repository-policy-tests.md#rule-wp-05), [WP-43.03](../planning/work-packages/43-managed-ai-routing-and-metering.md#rule-wp-43.03), [WP-41.07](../planning/work-packages/41-extension-platform-and-integrations.md#rule-wp-41.07)",
+      "completionGate": "The exclusion is structurally asserted, not merely undocumented"
+    },
+    {
+      "id": "I-315",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 565,
+      "coverageLine": 497,
+      "statement": "Retained historical distinction: ACP Session ≠ Conversation; ACP integration excluded by [P2-006](../decisions/phase-2-specification-decisions.md#rule-p2-006)",
+      "architectureHome": "`15-extension-platform-architecture.md`",
+      "mechanism": "Exclusion/architecture test",
+      "plannedVerification": "Keep ACP session identifiers out of current generated operations and conversation storage; historical vocabulary does not activate ACP support.",
+      "owningPackages": [
+        "05",
+        "41"
+      ],
+      "ownerCell": "`05`, `41`",
+      "completionGate": "[WP-05](../planning/work-packages/05-architecture-and-repository-policy-tests.md#rule-wp-05), [WP-41](../planning/work-packages/41-extension-platform-and-integrations.md#rule-wp-41)"
+    },
+    {
+      "id": "I-316",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 566,
+      "coverageLine": 498,
+      "statement": "ACP ≠ ArcChat runtime model; no external-agent runtime is implemented",
+      "architectureHome": "`15-extension-platform-architecture.md`",
+      "mechanism": "Exclusion/architecture test",
+      "plannedVerification": "Assert the current runtime has no ACP execution adapter and that the profile/Harness model remains the sole authority.",
+      "owningPackages": [
+        "05",
+        "41"
+      ],
+      "ownerCell": "`05`, `41`",
+      "completionGate": "[WP-05](../planning/work-packages/05-architecture-and-repository-policy-tests.md#rule-wp-05), [WP-41](../planning/work-packages/41-extension-platform-and-integrations.md#rule-wp-41)"
+    },
+    {
+      "id": "I-317",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 567,
+      "coverageLine": 499,
+      "statement": "Extension ≠ third-party Arc App",
+      "architectureHome": "`15-extension-platform-architecture.md`",
+      "mechanism": "Integration test",
+      "plannedVerification": "Assert `Extension` is not `third-party Arc App`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "41"
+      ],
+      "ownerCell": "`41`",
+      "completionGate": "[WP-41.02](../planning/work-packages/41-extension-platform-and-integrations.md#rule-wp-41.02), [WP-41.04](../planning/work-packages/41-extension-platform-and-integrations.md#rule-wp-41.04)"
+    },
+    {
+      "id": "I-318",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 568,
+      "coverageLine": 500,
+      "statement": "Extension Process ≠ Host Process",
+      "architectureHome": "`15-extension-platform-architecture.md`",
+      "mechanism": "Integration test",
+      "plannedVerification": "Assert `Extension Process` is not `Host Process`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "41"
+      ],
+      "ownerCell": "`41`",
+      "completionGate": "[WP-41.02](../planning/work-packages/41-extension-platform-and-integrations.md#rule-wp-41.02), [WP-41.04](../planning/work-packages/41-extension-platform-and-integrations.md#rule-wp-41.04)"
+    },
+    {
+      "id": "I-319",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 569,
+      "coverageLine": 501,
+      "statement": "Extension Private State ≠ Product Domain State",
+      "architectureHome": "`15-extension-platform-architecture.md`",
+      "mechanism": "Integration test",
+      "plannedVerification": "Assert `Extension Private State` is not `Product Domain State`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "41"
+      ],
+      "ownerCell": "`41`",
+      "completionGate": "[WP-41.02](../planning/work-packages/41-extension-platform-and-integrations.md#rule-wp-41.02), [WP-41.04](../planning/work-packages/41-extension-platform-and-integrations.md#rule-wp-41.04)"
+    },
+    {
+      "id": "I-320",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 570,
+      "coverageLine": 502,
+      "statement": "Extension Capability ≠ Permission",
+      "architectureHome": "`15-extension-platform-architecture.md`",
+      "mechanism": "Integration test",
+      "plannedVerification": "Assert `Extension Capability` is not `Permission`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "41"
+      ],
+      "ownerCell": "`41`",
+      "completionGate": "[WP-41.02](../planning/work-packages/41-extension-platform-and-integrations.md#rule-wp-41.02), [WP-41.04](../planning/work-packages/41-extension-platform-and-integrations.md#rule-wp-41.04)"
+    },
+    {
+      "id": "I-321",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 571,
+      "coverageLine": 503,
+      "statement": "Third-party Package ≠ runtime DLL injection",
+      "architectureHome": "`15-extension-platform-architecture.md`",
+      "mechanism": "Integration test",
+      "plannedVerification": "Assert `Third-party Package` is not `runtime DLL injection`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "41"
+      ],
+      "ownerCell": "`41`",
+      "completionGate": "[WP-41.02](../planning/work-packages/41-extension-platform-and-integrations.md#rule-wp-41.02), [WP-41.04](../planning/work-packages/41-extension-platform-and-integrations.md#rule-wp-41.04)"
+    },
+    {
+      "id": "I-322",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 572,
+      "coverageLine": 504,
+      "statement": "Runtime Extension ≠ NuGet package restore",
+      "architectureHome": "`15-extension-platform-architecture.md`",
+      "mechanism": "Integration test",
+      "plannedVerification": "Assert `Runtime Extension` is not `NuGet package restore`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "41"
+      ],
+      "ownerCell": "`41`",
+      "completionGate": "[WP-41.02](../planning/work-packages/41-extension-platform-and-integrations.md#rule-wp-41.02), [WP-41.04](../planning/work-packages/41-extension-platform-and-integrations.md#rule-wp-41.04)"
+    },
+    {
+      "id": "I-323",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 573,
+      "coverageLine": 505,
+      "statement": "Catalog ≠ Marketplace",
+      "architectureHome": "`15-extension-platform-architecture.md`",
+      "mechanism": "Integration test",
+      "plannedVerification": "Assert `Catalog` is not `Marketplace`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "41"
+      ],
+      "ownerCell": "`41`",
+      "completionGate": "[WP-41.02](../planning/work-packages/41-extension-platform-and-integrations.md#rule-wp-41.02), [WP-41.04](../planning/work-packages/41-extension-platform-and-integrations.md#rule-wp-41.04)"
+    },
+    {
+      "id": "I-324",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 574,
+      "coverageLine": 506,
+      "statement": "Catalog ≠ runtime dependency",
+      "architectureHome": "`15-extension-platform-architecture.md`",
+      "mechanism": "Integration test",
+      "plannedVerification": "Assert `Catalog` is not `runtime dependency`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "41"
+      ],
+      "ownerCell": "`41`",
+      "completionGate": "[WP-41.02](../planning/work-packages/41-extension-platform-and-integrations.md#rule-wp-41.02), [WP-41.04](../planning/work-packages/41-extension-platform-and-integrations.md#rule-wp-41.04)"
+    },
+    {
+      "id": "I-325",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 575,
+      "coverageLine": 507,
+      "statement": "Community Package ≠ automatically trusted",
+      "architectureHome": "`15-extension-platform-architecture.md`",
+      "mechanism": "Integration test",
+      "plannedVerification": "Assert `Community Package` is not `automatically trusted`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "41"
+      ],
+      "ownerCell": "`41`",
+      "completionGate": "[WP-41.02](../planning/work-packages/41-extension-platform-and-integrations.md#rule-wp-41.02), [WP-41.04](../planning/work-packages/41-extension-platform-and-integrations.md#rule-wp-41.04)"
+    },
+    {
+      "id": "I-326",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 576,
+      "coverageLine": 508,
+      "statement": "Package Dependency ≠ Capability Dependency",
+      "architectureHome": "`15-extension-platform-architecture.md`",
+      "mechanism": "Integration test",
+      "plannedVerification": "Assert `Package Dependency` is not `Capability Dependency`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "41"
+      ],
+      "ownerCell": "`41`",
+      "completionGate": "[WP-41.02](../planning/work-packages/41-extension-platform-and-integrations.md#rule-wp-41.02), [WP-41.04](../planning/work-packages/41-extension-platform-and-integrations.md#rule-wp-41.04)"
+    },
+    {
+      "id": "I-327",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 577,
+      "coverageLine": 509,
+      "statement": "Public SDK Contract ≠ internal LocalRpc Contract",
+      "architectureHome": "`15-extension-platform-architecture.md`",
+      "mechanism": "Integration test",
+      "plannedVerification": "Assert `Public SDK Contract` is not `internal LocalRpc Contract`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "41"
+      ],
+      "ownerCell": "`41`",
+      "completionGate": "[WP-41.02](../planning/work-packages/41-extension-platform-and-integrations.md#rule-wp-41.02), [WP-41.04](../planning/work-packages/41-extension-platform-and-integrations.md#rule-wp-41.04)"
+    },
+    {
+      "id": "I-328",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 578,
+      "coverageLine": 510,
+      "statement": "Extension Schema ≠ `Dictionary<string, object>`",
+      "architectureHome": "`15-extension-platform-architecture.md`",
+      "mechanism": "Integration test",
+      "plannedVerification": "Assert `Extension Schema` is not ``Dictionary<string, object>``: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "41"
+      ],
+      "ownerCell": "`41`",
+      "completionGate": "[WP-41.02](../planning/work-packages/41-extension-platform-and-integrations.md#rule-wp-41.02), [WP-41.04](../planning/work-packages/41-extension-platform-and-integrations.md#rule-wp-41.04)"
+    },
+    {
+      "id": "I-329",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 579,
+      "coverageLine": 511,
+      "statement": "Dynamic Extension Boundary ≠ core product capability protocol",
+      "architectureHome": "`15-extension-platform-architecture.md`",
+      "mechanism": "Integration test",
+      "plannedVerification": "Assert `Dynamic Extension Boundary` is not `core product capability protocol`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "41"
+      ],
+      "ownerCell": "`41`",
+      "completionGate": "[WP-41.02](../planning/work-packages/41-extension-platform-and-integrations.md#rule-wp-41.02), [WP-41.04](../planning/work-packages/41-extension-platform-and-integrations.md#rule-wp-41.04)"
+    },
+    {
+      "id": "I-330",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 580,
+      "coverageLine": 512,
+      "statement": "Deprecate ≠ Revoke",
+      "architectureHome": "`15-extension-platform-architecture.md`",
+      "mechanism": "Integration test",
+      "plannedVerification": "Assert `Deprecate` is not `Revoke`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "41"
+      ],
+      "ownerCell": "`41`",
+      "completionGate": "[WP-41.02](../planning/work-packages/41-extension-platform-and-integrations.md#rule-wp-41.02), [WP-41.04](../planning/work-packages/41-extension-platform-and-integrations.md#rule-wp-41.04)"
+    },
+    {
+      "id": "I-340",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 586,
+      "coverageLine": 513,
+      "statement": "Policy ≠ Setting",
+      "architectureHome": "`05-cloud-architecture.md` §12; policy client",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Policy` is not `Setting`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "44"
+      ],
+      "ownerCell": "`44`",
+      "completionGate": "[WP-44.00](../planning/work-packages/44-dynamic-policy-and-configuration.md#rule-wp-44.00), [WP-44.02](../planning/work-packages/44-dynamic-policy-and-configuration.md#rule-wp-44.02)"
+    },
+    {
+      "id": "I-341",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 587,
+      "coverageLine": 514,
+      "statement": "Policy ≠ Entitlement",
+      "architectureHome": "`05-cloud-architecture.md` §12; policy client",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Policy` is not `Entitlement`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "44"
+      ],
+      "ownerCell": "`44`",
+      "completionGate": "[WP-44.00](../planning/work-packages/44-dynamic-policy-and-configuration.md#rule-wp-44.00), [WP-44.02](../planning/work-packages/44-dynamic-policy-and-configuration.md#rule-wp-44.02)"
+    },
+    {
+      "id": "I-342",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 588,
+      "coverageLine": 515,
+      "statement": "Policy ≠ Permission",
+      "architectureHome": "`05-cloud-architecture.md` §12; policy client",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Policy` is not `Permission`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "44"
+      ],
+      "ownerCell": "`44`",
+      "completionGate": "[WP-44.00](../planning/work-packages/44-dynamic-policy-and-configuration.md#rule-wp-44.00), [WP-44.02](../planning/work-packages/44-dynamic-policy-and-configuration.md#rule-wp-44.02)"
+    },
+    {
+      "id": "I-343",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 589,
+      "coverageLine": 516,
+      "statement": "Policy ≠ Runtime Health",
+      "architectureHome": "`05-cloud-architecture.md` §12; policy client",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Policy` is not `Runtime Health`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "44"
+      ],
+      "ownerCell": "`44`",
+      "completionGate": "[WP-44.00](../planning/work-packages/44-dynamic-policy-and-configuration.md#rule-wp-44.00), [WP-44.02](../planning/work-packages/44-dynamic-policy-and-configuration.md#rule-wp-44.02)"
+    },
+    {
+      "id": "I-344",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 590,
+      "coverageLine": 517,
+      "statement": "Policy ≠ Domain State",
+      "architectureHome": "`05-cloud-architecture.md` §12; policy client",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Policy` is not `Domain State`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "44"
+      ],
+      "ownerCell": "`44`",
+      "completionGate": "[WP-44.00](../planning/work-packages/44-dynamic-policy-and-configuration.md#rule-wp-44.00), [WP-44.02](../planning/work-packages/44-dynamic-policy-and-configuration.md#rule-wp-44.02)"
+    },
+    {
+      "id": "I-345",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 591,
+      "coverageLine": 518,
+      "statement": "Policy Control Plane ≠ request Data Plane",
+      "architectureHome": "`05-cloud-architecture.md` §12; policy client",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Policy Control Plane` is not `request Data Plane`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "44"
+      ],
+      "ownerCell": "`44`",
+      "completionGate": "[WP-44.00](../planning/work-packages/44-dynamic-policy-and-configuration.md#rule-wp-44.00), [WP-44.02](../planning/work-packages/44-dynamic-policy-and-configuration.md#rule-wp-44.02)"
+    },
+    {
+      "id": "I-346",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 592,
+      "coverageLine": 519,
+      "statement": "Policy Scope ≠ Entitlement Scope",
+      "architectureHome": "`05-cloud-architecture.md` §12; policy client",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Policy Scope` is not `Entitlement Scope`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "44"
+      ],
+      "ownerCell": "`44`",
+      "completionGate": "[WP-44.00](../planning/work-packages/44-dynamic-policy-and-configuration.md#rule-wp-44.00), [WP-44.02](../planning/work-packages/44-dynamic-policy-and-configuration.md#rule-wp-44.02)"
+    },
+    {
+      "id": "I-347",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 593,
+      "coverageLine": 520,
+      "statement": "Feature ≠ Feature Flag",
+      "architectureHome": "`05-cloud-architecture.md` §12; policy client",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Feature` is not `Feature Flag`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "44"
+      ],
+      "ownerCell": "`44`",
+      "completionGate": "[WP-44.00](../planning/work-packages/44-dynamic-policy-and-configuration.md#rule-wp-44.00), [WP-44.02](../planning/work-packages/44-dynamic-policy-and-configuration.md#rule-wp-44.02)"
+    },
+    {
+      "id": "I-348",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 594,
+      "coverageLine": 521,
+      "statement": "Feature Flag ≠ Rollout",
+      "architectureHome": "`05-cloud-architecture.md` §12; policy client",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Feature Flag` is not `Rollout`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "44"
+      ],
+      "ownerCell": "`44`",
+      "completionGate": "[WP-44.00](../planning/work-packages/44-dynamic-policy-and-configuration.md#rule-wp-44.00), [WP-44.02](../planning/work-packages/44-dynamic-policy-and-configuration.md#rule-wp-44.02)"
+    },
+    {
+      "id": "I-349",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 595,
+      "coverageLine": 522,
+      "statement": "Rollout ≠ Experiment",
+      "architectureHome": "`05-cloud-architecture.md` §12; policy client",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Rollout` is not `Experiment`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "44"
+      ],
+      "ownerCell": "`44`",
+      "completionGate": "[WP-44.00](../planning/work-packages/44-dynamic-policy-and-configuration.md#rule-wp-44.00), [WP-44.02](../planning/work-packages/44-dynamic-policy-and-configuration.md#rule-wp-44.02)"
+    },
+    {
+      "id": "I-350",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 596,
+      "coverageLine": 523,
+      "statement": "Experiment ≠ Entitlement",
+      "architectureHome": "`05-cloud-architecture.md` §12; policy client",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Experiment` is not `Entitlement`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "44"
+      ],
+      "ownerCell": "`44`",
+      "completionGate": "[WP-44.00](../planning/work-packages/44-dynamic-policy-and-configuration.md#rule-wp-44.00), [WP-44.02](../planning/work-packages/44-dynamic-policy-and-configuration.md#rule-wp-44.02)"
+    },
+    {
+      "id": "I-351",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 597,
+      "coverageLine": 524,
+      "statement": "Experiment ≠ Security Policy",
+      "architectureHome": "`05-cloud-architecture.md` §12; policy client",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Experiment` is not `Security Policy`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "44"
+      ],
+      "ownerCell": "`44`",
+      "completionGate": "[WP-44.00](../planning/work-packages/44-dynamic-policy-and-configuration.md#rule-wp-44.00), [WP-44.02](../planning/work-packages/44-dynamic-policy-and-configuration.md#rule-wp-44.02)"
+    },
+    {
+      "id": "I-352",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 598,
+      "coverageLine": 525,
+      "statement": "Experiment Assignment ≠ random every request",
+      "architectureHome": "`05-cloud-architecture.md` §12; policy client",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Experiment Assignment` is not `random every request`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "44"
+      ],
+      "ownerCell": "`44`",
+      "completionGate": "[WP-44.00](../planning/work-packages/44-dynamic-policy-and-configuration.md#rule-wp-44.00), [WP-44.02](../planning/work-packages/44-dynamic-policy-and-configuration.md#rule-wp-44.02)"
+    },
+    {
+      "id": "I-353",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 599,
+      "coverageLine": 526,
+      "statement": "Kill Switch ≠ Feature Lifecycle",
+      "architectureHome": "`05-cloud-architecture.md` §12; policy client",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Kill Switch` is not `Feature Lifecycle`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "44"
+      ],
+      "ownerCell": "`44`",
+      "completionGate": "[WP-44.00](../planning/work-packages/44-dynamic-policy-and-configuration.md#rule-wp-44.00), [WP-44.02](../planning/work-packages/44-dynamic-policy-and-configuration.md#rule-wp-44.02)"
+    },
+    {
+      "id": "I-354",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 600,
+      "coverageLine": 527,
+      "statement": "Kill Switch ≠ delete data",
+      "architectureHome": "`05-cloud-architecture.md` §12; policy client",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Kill Switch` is not `delete data`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "44"
+      ],
+      "ownerCell": "`44`",
+      "completionGate": "[WP-44.00](../planning/work-packages/44-dynamic-policy-and-configuration.md#rule-wp-44.00), [WP-44.02](../planning/work-packages/44-dynamic-policy-and-configuration.md#rule-wp-44.02)"
+    },
+    {
+      "id": "I-355",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 601,
+      "coverageLine": 528,
+      "statement": "Remote Config ≠ User Preference",
+      "architectureHome": "`05-cloud-architecture.md` §12; policy client",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Remote Config` is not `User Preference`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "44"
+      ],
+      "ownerCell": "`44`",
+      "completionGate": "[WP-44.00](../planning/work-packages/44-dynamic-policy-and-configuration.md#rule-wp-44.00), [WP-44.02](../planning/work-packages/44-dynamic-policy-and-configuration.md#rule-wp-44.02)"
+    },
+    {
+      "id": "I-356",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 602,
+      "coverageLine": 529,
+      "statement": "Remote Config ≠ arbitrary code",
+      "architectureHome": "`05-cloud-architecture.md` §12; policy client",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Remote Config` is not `arbitrary code`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "44"
+      ],
+      "ownerCell": "`44`",
+      "completionGate": "[WP-44.00](../planning/work-packages/44-dynamic-policy-and-configuration.md#rule-wp-44.00), [WP-44.02](../planning/work-packages/44-dynamic-policy-and-configuration.md#rule-wp-44.02)"
+    },
+    {
+      "id": "I-357",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 603,
+      "coverageLine": 530,
+      "statement": "Remote Config ≠ Project Format",
+      "architectureHome": "`05-cloud-architecture.md` §12; policy client",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Remote Config` is not `Project Format`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "44"
+      ],
+      "ownerCell": "`44`",
+      "completionGate": "[WP-44.00](../planning/work-packages/44-dynamic-policy-and-configuration.md#rule-wp-44.00), [WP-44.02](../planning/work-packages/44-dynamic-policy-and-configuration.md#rule-wp-44.02)"
+    },
+    {
+      "id": "I-358",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 604,
+      "coverageLine": 531,
+      "statement": "Remote Config ≠ transport selection",
+      "architectureHome": "`05-cloud-architecture.md` §12; policy client",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Remote Config` is not `transport selection`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "44"
+      ],
+      "ownerCell": "`44`",
+      "completionGate": "[WP-44.00](../planning/work-packages/44-dynamic-policy-and-configuration.md#rule-wp-44.00), [WP-44.02](../planning/work-packages/44-dynamic-policy-and-configuration.md#rule-wp-44.02)"
+    },
+    {
+      "id": "I-359",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 605,
+      "coverageLine": 532,
+      "statement": "Compatibility Policy ≠ Capability Negotiation",
+      "architectureHome": "`05-cloud-architecture.md` §12; policy client",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Compatibility Policy` is not `Capability Negotiation`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "44"
+      ],
+      "ownerCell": "`44`",
+      "completionGate": "[WP-44.00](../planning/work-packages/44-dynamic-policy-and-configuration.md#rule-wp-44.00), [WP-44.02](../planning/work-packages/44-dynamic-policy-and-configuration.md#rule-wp-44.02)"
+    },
+    {
+      "id": "I-360",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 606,
+      "coverageLine": 533,
+      "statement": "Minimum Cloud Version ≠ Minimum Local Data Version",
+      "architectureHome": "`05-cloud-architecture.md` §12; policy client",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Minimum Cloud Version` is not `Minimum Local Data Version`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "44"
+      ],
+      "ownerCell": "`44`",
+      "completionGate": "[WP-44.00](../planning/work-packages/44-dynamic-policy-and-configuration.md#rule-wp-44.00), [WP-44.02](../planning/work-packages/44-dynamic-policy-and-configuration.md#rule-wp-44.02)"
+    },
+    {
+      "id": "I-361",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 607,
+      "coverageLine": 534,
+      "statement": "Provider Availability ≠ Provider Health",
+      "architectureHome": "`05-cloud-architecture.md` §12; policy client",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Provider Availability` is not `Provider Health`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "44"
+      ],
+      "ownerCell": "`44`",
+      "completionGate": "[WP-44.00](../planning/work-packages/44-dynamic-policy-and-configuration.md#rule-wp-44.00), [WP-44.02](../planning/work-packages/44-dynamic-policy-and-configuration.md#rule-wp-44.02)"
+    },
+    {
+      "id": "I-362",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 608,
+      "coverageLine": 535,
+      "statement": "Model Availability ≠ Model Entitlement",
+      "architectureHome": "`05-cloud-architecture.md` §12; policy client",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Model Availability` is not `Model Entitlement`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "44"
+      ],
+      "ownerCell": "`44`",
+      "completionGate": "[WP-44.00](../planning/work-packages/44-dynamic-policy-and-configuration.md#rule-wp-44.00), [WP-44.02](../planning/work-packages/44-dynamic-policy-and-configuration.md#rule-wp-44.02)"
+    },
+    {
+      "id": "I-363",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 609,
+      "coverageLine": 536,
+      "statement": "Model Availability ≠ Model Capability",
+      "architectureHome": "`05-cloud-architecture.md` §12; policy client",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Model Availability` is not `Model Capability`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "44"
+      ],
+      "ownerCell": "`44`",
+      "completionGate": "[WP-44.00](../planning/work-packages/44-dynamic-policy-and-configuration.md#rule-wp-44.00), [WP-44.02](../planning/work-packages/44-dynamic-policy-and-configuration.md#rule-wp-44.02)"
+    },
+    {
+      "id": "I-364",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 610,
+      "coverageLine": 537,
+      "statement": "Recommended Model ≠ Pinned Model",
+      "architectureHome": "`05-cloud-architecture.md` §12; policy client",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Recommended Model` is not `Pinned Model`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "44"
+      ],
+      "ownerCell": "`44`",
+      "completionGate": "[WP-44.00](../planning/work-packages/44-dynamic-policy-and-configuration.md#rule-wp-44.00), [WP-44.02](../planning/work-packages/44-dynamic-policy-and-configuration.md#rule-wp-44.02)"
+    },
+    {
+      "id": "I-365",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 611,
+      "coverageLine": 538,
+      "statement": "Workspace Policy ≠ Workspace Permission",
+      "architectureHome": "`05-cloud-architecture.md` §12; policy client",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Workspace Policy` is not `Workspace Permission`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "44"
+      ],
+      "ownerCell": "`44`",
+      "completionGate": "[WP-44.00](../planning/work-packages/44-dynamic-policy-and-configuration.md#rule-wp-44.00), [WP-44.02](../planning/work-packages/44-dynamic-policy-and-configuration.md#rule-wp-44.02)"
+    },
+    {
+      "id": "I-366",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 612,
+      "coverageLine": 539,
+      "statement": "Policy Bundle ≠ live mutable database view",
+      "architectureHome": "`05-cloud-architecture.md` §12; policy client",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Policy Bundle` is not `live mutable database view`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "44"
+      ],
+      "ownerCell": "`44`",
+      "completionGate": "[WP-44.00](../planning/work-packages/44-dynamic-policy-and-configuration.md#rule-wp-44.00), [WP-44.02](../planning/work-packages/44-dynamic-policy-and-configuration.md#rule-wp-44.02)"
+    },
+    {
+      "id": "I-367",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 613,
+      "coverageLine": 540,
+      "statement": "Policy Push Event ≠ Policy Authority",
+      "architectureHome": "`05-cloud-architecture.md` §12; policy client",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Policy Push Event` is not `Policy Authority`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "44"
+      ],
+      "ownerCell": "`44`",
+      "completionGate": "[WP-44.00](../planning/work-packages/44-dynamic-policy-and-configuration.md#rule-wp-44.00), [WP-44.02](../planning/work-packages/44-dynamic-policy-and-configuration.md#rule-wp-44.02)"
+    },
+    {
+      "id": "I-368",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 614,
+      "coverageLine": 541,
+      "statement": "Last Known Good ≠ current cloud truth",
+      "architectureHome": "`05-cloud-architecture.md` §12; policy client",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Last Known Good` is not `current cloud truth`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "44"
+      ],
+      "ownerCell": "`44`",
+      "completionGate": "[WP-44.00](../planning/work-packages/44-dynamic-policy-and-configuration.md#rule-wp-44.00), [WP-44.02](../planning/work-packages/44-dynamic-policy-and-configuration.md#rule-wp-44.02)"
+    },
+    {
+      "id": "I-369",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 615,
+      "coverageLine": 542,
+      "statement": "Published Revision ≠ Draft",
+      "architectureHome": "`05-cloud-architecture.md` §12; policy client",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Published Revision` is not `Draft`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "44"
+      ],
+      "ownerCell": "`44`",
+      "completionGate": "[WP-44.00](../planning/work-packages/44-dynamic-policy-and-configuration.md#rule-wp-44.00), [WP-44.02](../planning/work-packages/44-dynamic-policy-and-configuration.md#rule-wp-44.02)"
+    },
+    {
+      "id": "I-370",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 616,
+      "coverageLine": 543,
+      "statement": "Policy Rollback ≠ rewrite history",
+      "architectureHome": "`05-cloud-architecture.md` §12; policy client",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Policy Rollback` is not `rewrite history`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "44"
+      ],
+      "ownerCell": "`44`",
+      "completionGate": "[WP-44.00](../planning/work-packages/44-dynamic-policy-and-configuration.md#rule-wp-44.00), [WP-44.02](../planning/work-packages/44-dynamic-policy-and-configuration.md#rule-wp-44.02)"
+    },
+    {
+      "id": "I-371",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 617,
+      "coverageLine": 544,
+      "statement": "Dynamic Policy ≠ Architecture Constitution",
+      "architectureHome": "`05-cloud-architecture.md` §12; policy client",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Dynamic Policy` is not `Architecture Constitution`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "44"
+      ],
+      "ownerCell": "`44`",
+      "completionGate": "[WP-44.00](../planning/work-packages/44-dynamic-policy-and-configuration.md#rule-wp-44.00), [WP-44.02](../planning/work-packages/44-dynamic-policy-and-configuration.md#rule-wp-44.02)"
+    },
+    {
+      "id": "I-372",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 618,
+      "coverageLine": 545,
+      "statement": "Dynamic Policy ≠ business-logic deployment",
+      "architectureHome": "`05-cloud-architecture.md` §12; policy client",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Dynamic Policy` is not `business-logic deployment`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "44"
+      ],
+      "ownerCell": "`44`",
+      "completionGate": "[WP-44.00](../planning/work-packages/44-dynamic-policy-and-configuration.md#rule-wp-44.00), [WP-44.02](../planning/work-packages/44-dynamic-policy-and-configuration.md#rule-wp-44.02)"
+    },
+    {
+      "id": "I-380",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 624,
+      "coverageLine": 546,
+      "statement": "Fast in Debug ≠ Fast in Production",
+      "architectureHome": "`14-build-packaging-and-release.md`; `04-desktop-application-architecture.md`",
+      "mechanism": "Repository policy test",
+      "plannedVerification": "Assert `Fast in Debug` is not `Fast in Production`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "02",
+        "05",
+        "10"
+      ],
+      "ownerCell": "`02`, `05`, `10`",
+      "completionGate": "[WP-02.02](../planning/work-packages/02-build-governance-and-analyzer-policy.md#rule-wp-02.02), [WP-05.04](../planning/work-packages/05-architecture-and-repository-policy-tests.md#rule-wp-05.04), [WP-10.04](../planning/work-packages/10-design-system-and-desktop-shell.md#rule-wp-10.04)"
+    },
+    {
+      "id": "I-381",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 625,
+      "coverageLine": 547,
+      "statement": "JIT test pass ≠ AOT compatibility",
+      "architectureHome": "`14-build-packaging-and-release.md`; `04-desktop-application-architecture.md`",
+      "mechanism": "Repository policy test",
+      "plannedVerification": "Assert `JIT test pass` is not `AOT compatibility`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "02",
+        "05",
+        "10"
+      ],
+      "ownerCell": "`02`, `05`, `10`",
+      "completionGate": "[WP-02.02](../planning/work-packages/02-build-governance-and-analyzer-policy.md#rule-wp-02.02), [WP-05.04](../planning/work-packages/05-architecture-and-repository-policy-tests.md#rule-wp-05.04), [WP-10.04](../planning/work-packages/10-design-system-and-desktop-shell.md#rule-wp-10.04)"
+    },
+    {
+      "id": "I-382",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 626,
+      "coverageLine": 548,
+      "statement": "Build success ≠ runtime compatibility",
+      "architectureHome": "`14-build-packaging-and-release.md`; `04-desktop-application-architecture.md`",
+      "mechanism": "Repository policy test",
+      "plannedVerification": "Assert `Build success` is not `runtime compatibility`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "02",
+        "05",
+        "10"
+      ],
+      "ownerCell": "`02`, `05`, `10`",
+      "completionGate": "[WP-02.02](../planning/work-packages/02-build-governance-and-analyzer-policy.md#rule-wp-02.02), [WP-05.04](../planning/work-packages/05-architecture-and-repository-policy-tests.md#rule-wp-05.04), [WP-10.04](../planning/work-packages/10-design-system-and-desktop-shell.md#rule-wp-10.04)"
+    },
+    {
+      "id": "I-383",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 627,
+      "coverageLine": 549,
+      "statement": "App Version ≠ Contract Version",
+      "architectureHome": "`14-build-packaging-and-release.md`; `04-desktop-application-architecture.md`",
+      "mechanism": "Repository policy test",
+      "plannedVerification": "Assert `App Version` is not `Contract Version`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "02",
+        "05",
+        "10"
+      ],
+      "ownerCell": "`02`, `05`, `10`",
+      "completionGate": "[WP-02.02](../planning/work-packages/02-build-governance-and-analyzer-policy.md#rule-wp-02.02), [WP-05.04](../planning/work-packages/05-architecture-and-repository-policy-tests.md#rule-wp-05.04), [WP-10.04](../planning/work-packages/10-design-system-and-desktop-shell.md#rule-wp-10.04)"
+    },
+    {
+      "id": "I-384",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 628,
+      "coverageLine": 550,
+      "statement": "Contract Compatibility ≠ Product Policy Availability",
+      "architectureHome": "`14-build-packaging-and-release.md`; `04-desktop-application-architecture.md`",
+      "mechanism": "Repository policy test",
+      "plannedVerification": "Assert `Contract Compatibility` is not `Product Policy Availability`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "02",
+        "05",
+        "10"
+      ],
+      "ownerCell": "`02`, `05`, `10`",
+      "completionGate": "[WP-02.02](../planning/work-packages/02-build-governance-and-analyzer-policy.md#rule-wp-02.02), [WP-05.04](../planning/work-packages/05-architecture-and-repository-policy-tests.md#rule-wp-05.04), [WP-10.04](../planning/work-packages/10-design-system-and-desktop-shell.md#rule-wp-10.04)"
+    },
+    {
+      "id": "I-385",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 629,
+      "coverageLine": 551,
+      "statement": "Read Compatibility ≠ Write Compatibility",
+      "architectureHome": "`14-build-packaging-and-release.md`; `04-desktop-application-architecture.md`",
+      "mechanism": "Repository policy test",
+      "plannedVerification": "Assert `Read Compatibility` is not `Write Compatibility`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "02",
+        "05",
+        "10"
+      ],
+      "ownerCell": "`02`, `05`, `10`",
+      "completionGate": "[WP-02.02](../planning/work-packages/02-build-governance-and-analyzer-policy.md#rule-wp-02.02), [WP-05.04](../planning/work-packages/05-architecture-and-repository-policy-tests.md#rule-wp-05.04), [WP-10.04](../planning/work-packages/10-design-system-and-desktop-shell.md#rule-wp-10.04)"
+    },
+    {
+      "id": "I-386",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 630,
+      "coverageLine": 552,
+      "statement": "Migration Success ≠ Data Semantic Preservation",
+      "architectureHome": "`14-build-packaging-and-release.md`; `04-desktop-application-architecture.md`",
+      "mechanism": "Repository policy test",
+      "plannedVerification": "Assert `Migration Success` is not `Data Semantic Preservation`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "02",
+        "05",
+        "10"
+      ],
+      "ownerCell": "`02`, `05`, `10`",
+      "completionGate": "[WP-02.02](../planning/work-packages/02-build-governance-and-analyzer-policy.md#rule-wp-02.02), [WP-05.04](../planning/work-packages/05-architecture-and-repository-policy-tests.md#rule-wp-05.04), [WP-10.04](../planning/work-packages/10-design-system-and-desktop-shell.md#rule-wp-10.04)"
+    },
+    {
+      "id": "I-387",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 631,
+      "coverageLine": 553,
+      "statement": "Crash-free ≠ Recoverable",
+      "architectureHome": "`14-build-packaging-and-release.md`; `04-desktop-application-architecture.md`",
+      "mechanism": "Repository policy test",
+      "plannedVerification": "Assert `Crash-free` is not `Recoverable`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "02",
+        "05",
+        "10"
+      ],
+      "ownerCell": "`02`, `05`, `10`",
+      "completionGate": "[WP-02.02](../planning/work-packages/02-build-governance-and-analyzer-policy.md#rule-wp-02.02), [WP-05.04](../planning/work-packages/05-architecture-and-repository-policy-tests.md#rule-wp-05.04), [WP-10.04](../planning/work-packages/10-design-system-and-desktop-shell.md#rule-wp-10.04)"
+    },
+    {
+      "id": "I-388",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 632,
+      "coverageLine": 554,
+      "statement": "Small Benchmark ≠ Scale Reliability",
+      "architectureHome": "`14-build-packaging-and-release.md`; `04-desktop-application-architecture.md`",
+      "mechanism": "Repository policy test",
+      "plannedVerification": "Assert `Small Benchmark` is not `Scale Reliability`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "02",
+        "05",
+        "10"
+      ],
+      "ownerCell": "`02`, `05`, `10`",
+      "completionGate": "[WP-02.02](../planning/work-packages/02-build-governance-and-analyzer-policy.md#rule-wp-02.02), [WP-05.04](../planning/work-packages/05-architecture-and-repository-policy-tests.md#rule-wp-05.04), [WP-10.04](../planning/work-packages/10-design-system-and-desktop-shell.md#rule-wp-10.04)"
+    },
+    {
+      "id": "I-389",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 633,
+      "coverageLine": 555,
+      "statement": "Startup Time ≠ Time To Usable",
+      "architectureHome": "`14-build-packaging-and-release.md`; `04-desktop-application-architecture.md`",
+      "mechanism": "Repository policy test",
+      "plannedVerification": "Assert `Startup Time` is not `Time To Usable`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "02",
+        "05",
+        "10"
+      ],
+      "ownerCell": "`02`, `05`, `10`",
+      "completionGate": "[WP-02.02](../planning/work-packages/02-build-governance-and-analyzer-policy.md#rule-wp-02.02), [WP-05.04](../planning/work-packages/05-architecture-and-repository-policy-tests.md#rule-wp-05.04), [WP-10.04](../planning/work-packages/10-design-system-and-desktop-shell.md#rule-wp-10.04)"
+    },
+    {
+      "id": "I-390",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 634,
+      "coverageLine": 556,
+      "statement": "Managed Heap ≠ Total Memory",
+      "architectureHome": "`14-build-packaging-and-release.md`; `04-desktop-application-architecture.md`",
+      "mechanism": "Repository policy test",
+      "plannedVerification": "Assert `Managed Heap` is not `Total Memory`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "02",
+        "05",
+        "10"
+      ],
+      "ownerCell": "`02`, `05`, `10`",
+      "completionGate": "[WP-02.02](../planning/work-packages/02-build-governance-and-analyzer-policy.md#rule-wp-02.02), [WP-05.04](../planning/work-packages/05-architecture-and-repository-policy-tests.md#rule-wp-05.04), [WP-10.04](../planning/work-packages/10-design-system-and-desktop-shell.md#rule-wp-10.04)"
+    },
+    {
+      "id": "I-391",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 635,
+      "coverageLine": 557,
+      "statement": "Process Running ≠ Healthy",
+      "architectureHome": "`14-build-packaging-and-release.md`; `04-desktop-application-architecture.md`",
+      "mechanism": "Repository policy test",
+      "plannedVerification": "Assert `Process Running` is not `Healthy`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "02",
+        "05",
+        "10"
+      ],
+      "ownerCell": "`02`, `05`, `10`",
+      "completionGate": "[WP-02.02](../planning/work-packages/02-build-governance-and-analyzer-policy.md#rule-wp-02.02), [WP-05.04](../planning/work-packages/05-architecture-and-repository-policy-tests.md#rule-wp-05.04), [WP-10.04](../planning/work-packages/10-design-system-and-desktop-shell.md#rule-wp-10.04)"
+    },
+    {
+      "id": "I-392",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 636,
+      "coverageLine": 558,
+      "statement": "Responsive Animation ≠ Responsive Product",
+      "architectureHome": "`14-build-packaging-and-release.md`; `04-desktop-application-architecture.md`",
+      "mechanism": "Repository policy test",
+      "plannedVerification": "Assert `Responsive Animation` is not `Responsive Product`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "02",
+        "05",
+        "10"
+      ],
+      "ownerCell": "`02`, `05`, `10`",
+      "completionGate": "[WP-02.02](../planning/work-packages/02-build-governance-and-analyzer-policy.md#rule-wp-02.02), [WP-05.04](../planning/work-packages/05-architecture-and-repository-policy-tests.md#rule-wp-05.04), [WP-10.04](../planning/work-packages/10-design-system-and-desktop-shell.md#rule-wp-10.04)"
+    },
+    {
+      "id": "I-393",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 637,
+      "coverageLine": 559,
+      "statement": "Accessible Color ≠ Accessible Product",
+      "architectureHome": "`14-build-packaging-and-release.md`; `04-desktop-application-architecture.md`",
+      "mechanism": "Repository policy test",
+      "plannedVerification": "Assert `Accessible Color` is not `Accessible Product`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "02",
+        "05",
+        "10"
+      ],
+      "ownerCell": "`02`, `05`, `10`",
+      "completionGate": "[WP-02.02](../planning/work-packages/02-build-governance-and-analyzer-policy.md#rule-wp-02.02), [WP-05.04](../planning/work-packages/05-architecture-and-repository-policy-tests.md#rule-wp-05.04), [WP-10.04](../planning/work-packages/10-design-system-and-desktop-shell.md#rule-wp-10.04)"
+    },
+    {
+      "id": "I-394",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 638,
+      "coverageLine": 560,
+      "statement": "Keyboard Shortcut ≠ Keyboard Accessibility",
+      "architectureHome": "`14-build-packaging-and-release.md`; `04-desktop-application-architecture.md`",
+      "mechanism": "Repository policy test",
+      "plannedVerification": "Assert `Keyboard Shortcut` is not `Keyboard Accessibility`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "02",
+        "05",
+        "10"
+      ],
+      "ownerCell": "`02`, `05`, `10`",
+      "completionGate": "[WP-02.02](../planning/work-packages/02-build-governance-and-analyzer-policy.md#rule-wp-02.02), [WP-05.04](../planning/work-packages/05-architecture-and-repository-policy-tests.md#rule-wp-05.04), [WP-10.04](../planning/work-packages/10-design-system-and-desktop-shell.md#rule-wp-10.04)"
+    },
+    {
+      "id": "I-395",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 639,
+      "coverageLine": 561,
+      "statement": "Localized UI ≠ Locale-safe Data",
+      "architectureHome": "`14-build-packaging-and-release.md`; `04-desktop-application-architecture.md`",
+      "mechanism": "Repository policy test",
+      "plannedVerification": "Assert `Localized UI` is not `Locale-safe Data`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "02",
+        "05",
+        "10"
+      ],
+      "ownerCell": "`02`, `05`, `10`",
+      "completionGate": "[WP-02.02](../planning/work-packages/02-build-governance-and-analyzer-policy.md#rule-wp-02.02), [WP-05.04](../planning/work-packages/05-architecture-and-repository-policy-tests.md#rule-wp-05.04), [WP-10.04](../planning/work-packages/10-design-system-and-desktop-shell.md#rule-wp-10.04)"
+    },
+    {
+      "id": "I-396",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 640,
+      "coverageLine": 562,
+      "statement": "Display Unit ≠ Canonical Quantity",
+      "architectureHome": "`14-build-packaging-and-release.md`; `04-desktop-application-architecture.md`",
+      "mechanism": "Repository policy test",
+      "plannedVerification": "Assert `Display Unit` is not `Canonical Quantity`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "02",
+        "05",
+        "10"
+      ],
+      "ownerCell": "`02`, `05`, `10`",
+      "completionGate": "[WP-02.02](../planning/work-packages/02-build-governance-and-analyzer-policy.md#rule-wp-02.02), [WP-05.04](../planning/work-packages/05-architecture-and-repository-policy-tests.md#rule-wp-05.04), [WP-10.04](../planning/work-packages/10-design-system-and-desktop-shell.md#rule-wp-10.04)"
+    },
+    {
+      "id": "I-397",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 641,
+      "coverageLine": 563,
+      "statement": "Automated Test ≠ real-hardware validation",
+      "architectureHome": "`14-build-packaging-and-release.md`; `04-desktop-application-architecture.md`",
+      "mechanism": "Repository policy test",
+      "plannedVerification": "Assert `Automated Test` is not `real-hardware validation`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "02",
+        "05",
+        "10"
+      ],
+      "ownerCell": "`02`, `05`, `10`",
+      "completionGate": "[WP-02.02](../planning/work-packages/02-build-governance-and-analyzer-policy.md#rule-wp-02.02), [WP-05.04](../planning/work-packages/05-architecture-and-repository-policy-tests.md#rule-wp-05.04), [WP-10.04](../planning/work-packages/10-design-system-and-desktop-shell.md#rule-wp-10.04)"
+    },
+    {
+      "id": "I-398",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 642,
+      "coverageLine": 564,
+      "statement": "One OS passing ≠ cross-platform support",
+      "architectureHome": "`14-build-packaging-and-release.md`; `04-desktop-application-architecture.md`",
+      "mechanism": "Repository policy test",
+      "plannedVerification": "Assert `One OS passing` is not `cross-platform support`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "02",
+        "05",
+        "10"
+      ],
+      "ownerCell": "`02`, `05`, `10`",
+      "completionGate": "[WP-02.02](../planning/work-packages/02-build-governance-and-analyzer-policy.md#rule-wp-02.02), [WP-05.04](../planning/work-packages/05-architecture-and-repository-policy-tests.md#rule-wp-05.04), [WP-10.04](../planning/work-packages/10-design-system-and-desktop-shell.md#rule-wp-10.04)"
+    },
+    {
+      "id": "I-399",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 643,
+      "coverageLine": 565,
+      "statement": "Diagnostics ≠ Telemetry Consent",
+      "architectureHome": "`14-build-packaging-and-release.md`; `04-desktop-application-architecture.md`",
+      "mechanism": "Repository policy test",
+      "plannedVerification": "Assert `Diagnostics` is not `Telemetry Consent`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "02",
+        "05",
+        "10"
+      ],
+      "ownerCell": "`02`, `05`, `10`",
+      "completionGate": "[WP-02.02](../planning/work-packages/02-build-governance-and-analyzer-policy.md#rule-wp-02.02), [WP-05.04](../planning/work-packages/05-architecture-and-repository-policy-tests.md#rule-wp-05.04), [WP-10.04](../planning/work-packages/10-design-system-and-desktop-shell.md#rule-wp-10.04)"
+    },
+    {
+      "id": "I-400",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 644,
+      "coverageLine": 566,
+      "statement": "Performance Target ≠ Marketing Claim",
+      "architectureHome": "`14-build-packaging-and-release.md`; `04-desktop-application-architecture.md`",
+      "mechanism": "Repository policy test",
+      "plannedVerification": "Assert `Performance Target` is not `Marketing Claim`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "02",
+        "05",
+        "10"
+      ],
+      "ownerCell": "`02`, `05`, `10`",
+      "completionGate": "[WP-02.02](../planning/work-packages/02-build-governance-and-analyzer-policy.md#rule-wp-02.02), [WP-05.04](../planning/work-packages/05-architecture-and-repository-policy-tests.md#rule-wp-05.04), [WP-10.04](../planning/work-packages/10-design-system-and-desktop-shell.md#rule-wp-10.04)"
+    },
+    {
+      "id": "I-401",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 645,
+      "coverageLine": 567,
+      "statement": "Quality Waiver ≠ permanently lower standard",
+      "architectureHome": "`14-build-packaging-and-release.md`; `04-desktop-application-architecture.md`",
+      "mechanism": "Repository policy test",
+      "plannedVerification": "Assert `Quality Waiver` is not `permanently lower standard`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "02",
+        "05",
+        "10"
+      ],
+      "ownerCell": "`02`, `05`, `10`",
+      "completionGate": "[WP-02.02](../planning/work-packages/02-build-governance-and-analyzer-policy.md#rule-wp-02.02), [WP-05.04](../planning/work-packages/05-architecture-and-repository-policy-tests.md#rule-wp-05.04), [WP-10.04](../planning/work-packages/10-design-system-and-desktop-shell.md#rule-wp-10.04)"
+    },
+    {
+      "id": "I-402",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 646,
+      "coverageLine": 568,
+      "statement": "Quality Requirement ≠ Engineering Suggestion",
+      "architectureHome": "`14-build-packaging-and-release.md`; `04-desktop-application-architecture.md`",
+      "mechanism": "Repository policy test",
+      "plannedVerification": "Assert `Quality Requirement` is not `Engineering Suggestion`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "02",
+        "05",
+        "10"
+      ],
+      "ownerCell": "`02`, `05`, `10`",
+      "completionGate": "[WP-02.02](../planning/work-packages/02-build-governance-and-analyzer-policy.md#rule-wp-02.02), [WP-05.04](../planning/work-packages/05-architecture-and-repository-policy-tests.md#rule-wp-05.04), [WP-10.04](../planning/work-packages/10-design-system-and-desktop-shell.md#rule-wp-10.04)"
+    },
+    {
+      "id": "I-403",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 647,
+      "coverageLine": 569,
+      "statement": "SLO ≠ external SLA",
+      "architectureHome": "`14-build-packaging-and-release.md`; `04-desktop-application-architecture.md`",
+      "mechanism": "Repository policy test",
+      "plannedVerification": "Assert `SLO` is not `external SLA`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "02",
+        "05",
+        "10"
+      ],
+      "ownerCell": "`02`, `05`, `10`",
+      "completionGate": "[WP-02.02](../planning/work-packages/02-build-governance-and-analyzer-policy.md#rule-wp-02.02), [WP-05.04](../planning/work-packages/05-architecture-and-repository-policy-tests.md#rule-wp-05.04), [WP-10.04](../planning/work-packages/10-design-system-and-desktop-shell.md#rule-wp-10.04)"
+    },
+    {
+      "id": "I-404",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 648,
+      "coverageLine": 570,
+      "statement": "Focus ≠ Selection",
+      "architectureHome": "`14-build-packaging-and-release.md`; `04-desktop-application-architecture.md`",
+      "mechanism": "Repository policy test",
+      "plannedVerification": "Assert `Focus` is not `Selection`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "02",
+        "05",
+        "10"
+      ],
+      "ownerCell": "`02`, `05`, `10`",
+      "completionGate": "[WP-02.02](../planning/work-packages/02-build-governance-and-analyzer-policy.md#rule-wp-02.02), [WP-05.04](../planning/work-packages/05-architecture-and-repository-policy-tests.md#rule-wp-05.04), [WP-10.04](../planning/work-packages/10-design-system-and-desktop-shell.md#rule-wp-10.04)"
+    },
+    {
+      "id": "I-405",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 649,
+      "coverageLine": 571,
+      "statement": "Push Notification ≠ Durable Attention State",
+      "architectureHome": "`14-build-packaging-and-release.md`; `04-desktop-application-architecture.md`",
+      "mechanism": "Repository policy test",
+      "plannedVerification": "Assert `Push Notification` is not `Durable Attention State`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "02",
+        "05",
+        "10"
+      ],
+      "ownerCell": "`02`, `05`, `10`",
+      "completionGate": "[WP-02.02](../planning/work-packages/02-build-governance-and-analyzer-policy.md#rule-wp-02.02), [WP-05.04](../planning/work-packages/05-architecture-and-repository-policy-tests.md#rule-wp-05.04), [WP-10.04](../planning/work-packages/10-design-system-and-desktop-shell.md#rule-wp-10.04)"
+    },
+    {
+      "id": "I-410",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 655,
+      "coverageLine": 572,
+      "statement": "Feedback ≠ Support Case",
+      "architectureHome": "`13-observability-and-operations.md`",
+      "mechanism": "Integration test",
+      "plannedVerification": "Assert `Feedback` is not `Support Case`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "12",
+        "45"
+      ],
+      "ownerCell": "`12`, `45`",
+      "completionGate": "[WP-12.02](../planning/work-packages/12-observability-foundation.md#rule-wp-12.02), [WP-45.04](../planning/work-packages/45-operations-support-and-trust-safety.md#rule-wp-45.04)"
+    },
+    {
+      "id": "I-411",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 656,
+      "coverageLine": 573,
+      "statement": "Bug Report ≠ Engineering Defect",
+      "architectureHome": "`13-observability-and-operations.md`",
+      "mechanism": "Integration test",
+      "plannedVerification": "Assert `Bug Report` is not `Engineering Defect`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "12",
+        "45"
+      ],
+      "ownerCell": "`12`, `45`",
+      "completionGate": "[WP-12.02](../planning/work-packages/12-observability-foundation.md#rule-wp-12.02), [WP-45.04](../planning/work-packages/45-operations-support-and-trust-safety.md#rule-wp-45.04)"
+    },
+    {
+      "id": "I-412",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 657,
+      "coverageLine": 574,
+      "statement": "Feature Request ≠ Product Commitment",
+      "architectureHome": "`13-observability-and-operations.md`",
+      "mechanism": "Integration test",
+      "plannedVerification": "Assert `Feature Request` is not `Product Commitment`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "12",
+        "45"
+      ],
+      "ownerCell": "`12`, `45`",
+      "completionGate": "[WP-12.02](../planning/work-packages/12-observability-foundation.md#rule-wp-12.02), [WP-45.04](../planning/work-packages/45-operations-support-and-trust-safety.md#rule-wp-45.04)"
+    },
+    {
+      "id": "I-413",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 658,
+      "coverageLine": 575,
+      "statement": "Known Issue ≠ Incident",
+      "architectureHome": "`13-observability-and-operations.md`",
+      "mechanism": "Integration test",
+      "plannedVerification": "Assert `Known Issue` is not `Incident`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "12",
+        "45"
+      ],
+      "ownerCell": "`12`, `45`",
+      "completionGate": "[WP-12.02](../planning/work-packages/12-observability-foundation.md#rule-wp-12.02), [WP-45.04](../planning/work-packages/45-operations-support-and-trust-safety.md#rule-wp-45.04)"
+    },
+    {
+      "id": "I-414",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 659,
+      "coverageLine": 576,
+      "statement": "Incident ≠ Security Advisory",
+      "architectureHome": "`13-observability-and-operations.md`",
+      "mechanism": "Integration test",
+      "plannedVerification": "Assert `Incident` is not `Security Advisory`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "12",
+        "45"
+      ],
+      "ownerCell": "`12`, `45`",
+      "completionGate": "[WP-12.02](../planning/work-packages/12-observability-foundation.md#rule-wp-12.02), [WP-45.04](../planning/work-packages/45-operations-support-and-trust-safety.md#rule-wp-45.04)"
+    },
+    {
+      "id": "I-415",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 660,
+      "coverageLine": 577,
+      "statement": "Support ≠ Impersonation",
+      "architectureHome": "`13-observability-and-operations.md`",
+      "mechanism": "Integration test",
+      "plannedVerification": "Assert `Support` is not `Impersonation`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "12",
+        "45"
+      ],
+      "ownerCell": "`12`, `45`",
+      "completionGate": "[WP-12.02](../planning/work-packages/12-observability-foundation.md#rule-wp-12.02), [WP-45.04](../planning/work-packages/45-operations-support-and-trust-safety.md#rule-wp-45.04)"
+    },
+    {
+      "id": "I-416",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 661,
+      "coverageLine": 578,
+      "statement": "Operator ≠ User",
+      "architectureHome": "`13-observability-and-operations.md`",
+      "mechanism": "Integration test",
+      "plannedVerification": "Assert `Operator` is not `User`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "12",
+        "45"
+      ],
+      "ownerCell": "`12`, `45`",
+      "completionGate": "[WP-12.02](../planning/work-packages/12-observability-foundation.md#rule-wp-12.02), [WP-45.04](../planning/work-packages/45-operations-support-and-trust-safety.md#rule-wp-45.04)"
+    },
+    {
+      "id": "I-417",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 662,
+      "coverageLine": 579,
+      "statement": "Operator Role ≠ unlimited access",
+      "architectureHome": "`13-observability-and-operations.md`",
+      "mechanism": "Integration test",
+      "plannedVerification": "Assert `Operator Role` is not `unlimited access`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "12",
+        "45"
+      ],
+      "ownerCell": "`12`, `45`",
+      "completionGate": "[WP-12.02](../planning/work-packages/12-observability-foundation.md#rule-wp-12.02), [WP-45.04](../planning/work-packages/45-operations-support-and-trust-safety.md#rule-wp-45.04)"
+    },
+    {
+      "id": "I-418",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 663,
+      "coverageLine": 580,
+      "statement": "Support Access ≠ User Session",
+      "architectureHome": "`13-observability-and-operations.md`",
+      "mechanism": "Integration test",
+      "plannedVerification": "Assert `Support Access` is not `User Session`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "12",
+        "45"
+      ],
+      "ownerCell": "`12`, `45`",
+      "completionGate": "[WP-12.02](../planning/work-packages/12-observability-foundation.md#rule-wp-12.02), [WP-45.04](../planning/work-packages/45-operations-support-and-trust-safety.md#rule-wp-45.04)"
+    },
+    {
+      "id": "I-419",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 664,
+      "coverageLine": 581,
+      "statement": "Support Access ≠ permanent permission",
+      "architectureHome": "`13-observability-and-operations.md`",
+      "mechanism": "Integration test",
+      "plannedVerification": "Assert `Support Access` is not `permanent permission`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "12",
+        "45"
+      ],
+      "ownerCell": "`12`, `45`",
+      "completionGate": "[WP-12.02](../planning/work-packages/12-observability-foundation.md#rule-wp-12.02), [WP-45.04](../planning/work-packages/45-operations-support-and-trust-safety.md#rule-wp-45.04)"
+    },
+    {
+      "id": "I-420",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 665,
+      "coverageLine": 582,
+      "statement": "Break Glass ≠ Impersonation",
+      "architectureHome": "`13-observability-and-operations.md`",
+      "mechanism": "Integration test",
+      "plannedVerification": "Assert `Break Glass` is not `Impersonation`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "12",
+        "45"
+      ],
+      "ownerCell": "`12`, `45`",
+      "completionGate": "[WP-12.02](../planning/work-packages/12-observability-foundation.md#rule-wp-12.02), [WP-45.04](../planning/work-packages/45-operations-support-and-trust-safety.md#rule-wp-45.04)"
+    },
+    {
+      "id": "I-421",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 666,
+      "coverageLine": 583,
+      "statement": "Break Glass ≠ global superuser",
+      "architectureHome": "`13-observability-and-operations.md`",
+      "mechanism": "Integration test",
+      "plannedVerification": "Assert `Break Glass` is not `global superuser`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "12",
+        "45"
+      ],
+      "ownerCell": "`12`, `45`",
+      "completionGate": "[WP-12.02](../planning/work-packages/12-observability-foundation.md#rule-wp-12.02), [WP-45.04](../planning/work-packages/45-operations-support-and-trust-safety.md#rule-wp-45.04)"
+    },
+    {
+      "id": "I-422",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 667,
+      "coverageLine": 584,
+      "statement": "Operator Console ≠ Database Console",
+      "architectureHome": "`13-observability-and-operations.md`",
+      "mechanism": "Integration test",
+      "plannedVerification": "Assert `Operator Console` is not `Database Console`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "12",
+        "45"
+      ],
+      "ownerCell": "`12`, `45`",
+      "completionGate": "[WP-12.02](../planning/work-packages/12-observability-foundation.md#rule-wp-12.02), [WP-45.04](../planning/work-packages/45-operations-support-and-trust-safety.md#rule-wp-45.04)"
+    },
+    {
+      "id": "I-423",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 668,
+      "coverageLine": 585,
+      "statement": "Operator Console ≠ Domain Owner",
+      "architectureHome": "`13-observability-and-operations.md`",
+      "mechanism": "Integration test",
+      "plannedVerification": "Assert `Operator Console` is not `Domain Owner`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "12",
+        "45"
+      ],
+      "ownerCell": "`12`, `45`",
+      "completionGate": "[WP-12.02](../planning/work-packages/12-observability-foundation.md#rule-wp-12.02), [WP-45.04](../planning/work-packages/45-operations-support-and-trust-safety.md#rule-wp-45.04)"
+    },
+    {
+      "id": "I-424",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 669,
+      "coverageLine": 586,
+      "statement": "Diagnostic Bundle ≠ automatic telemetry upload",
+      "architectureHome": "`13-observability-and-operations.md`",
+      "mechanism": "Integration test",
+      "plannedVerification": "Assert `Diagnostic Bundle` is not `automatic telemetry upload`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "12",
+        "45"
+      ],
+      "ownerCell": "`12`, `45`",
+      "completionGate": "[WP-12.02](../planning/work-packages/12-observability-foundation.md#rule-wp-12.02), [WP-45.04](../planning/work-packages/45-operations-support-and-trust-safety.md#rule-wp-45.04)"
+    },
+    {
+      "id": "I-425",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 670,
+      "coverageLine": 587,
+      "statement": "Diagnostic Bundle ≠ Recovery Package",
+      "architectureHome": "`13-observability-and-operations.md`",
+      "mechanism": "Integration test",
+      "plannedVerification": "Assert `Diagnostic Bundle` is not `Recovery Package`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "12",
+        "45"
+      ],
+      "ownerCell": "`12`, `45`",
+      "completionGate": "[WP-12.02](../planning/work-packages/12-observability-foundation.md#rule-wp-12.02), [WP-45.04](../planning/work-packages/45-operations-support-and-trust-safety.md#rule-wp-45.04)"
+    },
+    {
+      "id": "I-426",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 671,
+      "coverageLine": 588,
+      "statement": "Recovery ≠ direct SQL mutation",
+      "architectureHome": "`13-observability-and-operations.md`",
+      "mechanism": "Integration test",
+      "plannedVerification": "Assert `Recovery` is not `direct SQL mutation`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "12",
+        "45"
+      ],
+      "ownerCell": "`12`, `45`",
+      "completionGate": "[WP-12.02](../planning/work-packages/12-observability-foundation.md#rule-wp-12.02), [WP-45.04](../planning/work-packages/45-operations-support-and-trust-safety.md#rule-wp-45.04)"
+    },
+    {
+      "id": "I-427",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 672,
+      "coverageLine": 589,
+      "statement": "Recovery ≠ silent overwrite",
+      "architectureHome": "`13-observability-and-operations.md`",
+      "mechanism": "Integration test",
+      "plannedVerification": "Assert `Recovery` is not `silent overwrite`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "12",
+        "45"
+      ],
+      "ownerCell": "`12`, `45`",
+      "completionGate": "[WP-12.02](../planning/work-packages/12-observability-foundation.md#rule-wp-12.02), [WP-45.04](../planning/work-packages/45-operations-support-and-trust-safety.md#rule-wp-45.04)"
+    },
+    {
+      "id": "I-428",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 673,
+      "coverageLine": 590,
+      "statement": "Recovery ≠ guaranteed recovery of missing data",
+      "architectureHome": "`13-observability-and-operations.md`",
+      "mechanism": "Integration test",
+      "plannedVerification": "Assert `Recovery` is not `guaranteed recovery of missing data`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "12",
+        "45"
+      ],
+      "ownerCell": "`12`, `45`",
+      "completionGate": "[WP-12.02](../planning/work-packages/12-observability-foundation.md#rule-wp-12.02), [WP-45.04](../planning/work-packages/45-operations-support-and-trust-safety.md#rule-wp-45.04)"
+    },
+    {
+      "id": "I-429",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 674,
+      "coverageLine": 591,
+      "statement": "Report ≠ Investigation ≠ Enforcement ≠ Appeal",
+      "architectureHome": "`13-observability-and-operations.md`",
+      "mechanism": "Integration test",
+      "plannedVerification": "Assert `Report` is not `Investigation`, `Investigation` is not `Enforcement`, `Enforcement` is not `Appeal`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "12",
+        "45"
+      ],
+      "ownerCell": "`12`, `45`",
+      "completionGate": "[WP-12.02](../planning/work-packages/12-observability-foundation.md#rule-wp-12.02), [WP-45.04](../planning/work-packages/45-operations-support-and-trust-safety.md#rule-wp-45.04)"
+    },
+    {
+      "id": "I-430",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 675,
+      "coverageLine": 592,
+      "statement": "Community Report ≠ Enforcement",
+      "architectureHome": "`13-observability-and-operations.md`",
+      "mechanism": "Integration test",
+      "plannedVerification": "Assert `Community Report` is not `Enforcement`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "12",
+        "45"
+      ],
+      "ownerCell": "`12`, `45`",
+      "completionGate": "[WP-12.02](../planning/work-packages/12-observability-foundation.md#rule-wp-12.02), [WP-45.04](../planning/work-packages/45-operations-support-and-trust-safety.md#rule-wp-45.04)"
+    },
+    {
+      "id": "I-431",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 676,
+      "coverageLine": 593,
+      "statement": "Report Count ≠ Guilt",
+      "architectureHome": "`13-observability-and-operations.md`",
+      "mechanism": "Integration test",
+      "plannedVerification": "Assert `Report Count` is not `Guilt`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "12",
+        "45"
+      ],
+      "ownerCell": "`12`, `45`",
+      "completionGate": "[WP-12.02](../planning/work-packages/12-observability-foundation.md#rule-wp-12.02), [WP-45.04](../planning/work-packages/45-operations-support-and-trust-safety.md#rule-wp-45.04)"
+    },
+    {
+      "id": "I-432",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 677,
+      "coverageLine": 594,
+      "statement": "Delist ≠ Revoke",
+      "architectureHome": "`13-observability-and-operations.md`",
+      "mechanism": "Integration test",
+      "plannedVerification": "Assert `Delist` is not `Revoke`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "12",
+        "45"
+      ],
+      "ownerCell": "`12`, `45`",
+      "completionGate": "[WP-12.02](../planning/work-packages/12-observability-foundation.md#rule-wp-12.02), [WP-45.04](../planning/work-packages/45-operations-support-and-trust-safety.md#rule-wp-45.04)"
+    },
+    {
+      "id": "I-433",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 678,
+      "coverageLine": 595,
+      "statement": "Publisher Yank ≠ platform enforcement",
+      "architectureHome": "`13-observability-and-operations.md`",
+      "mechanism": "Integration test",
+      "plannedVerification": "Assert `Publisher Yank` is not `platform enforcement`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "12",
+        "45"
+      ],
+      "ownerCell": "`12`, `45`",
+      "completionGate": "[WP-12.02](../planning/work-packages/12-observability-foundation.md#rule-wp-12.02), [WP-45.04](../planning/work-packages/45-operations-support-and-trust-safety.md#rule-wp-45.04)"
+    },
+    {
+      "id": "I-434",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 679,
+      "coverageLine": 596,
+      "statement": "Package Revocation ≠ delete user project",
+      "architectureHome": "`13-observability-and-operations.md`",
+      "mechanism": "Integration test",
+      "plannedVerification": "Assert `Package Revocation` is not `delete user project`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "12",
+        "45"
+      ],
+      "ownerCell": "`12`, `45`",
+      "completionGate": "[WP-12.02](../planning/work-packages/12-observability-foundation.md#rule-wp-12.02), [WP-45.04](../planning/work-packages/45-operations-support-and-trust-safety.md#rule-wp-45.04)"
+    },
+    {
+      "id": "I-435",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 680,
+      "coverageLine": 597,
+      "statement": "Package Revocation ≠ delete created resources",
+      "architectureHome": "`13-observability-and-operations.md`",
+      "mechanism": "Integration test",
+      "plannedVerification": "Assert `Package Revocation` is not `delete created resources`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "12",
+        "45"
+      ],
+      "ownerCell": "`12`, `45`",
+      "completionGate": "[WP-12.02](../planning/work-packages/12-observability-foundation.md#rule-wp-12.02), [WP-45.04](../planning/work-packages/45-operations-support-and-trust-safety.md#rule-wp-45.04)"
+    },
+    {
+      "id": "I-436",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 681,
+      "coverageLine": 598,
+      "statement": "Copyright Removal ≠ delete local canonical data",
+      "architectureHome": "`13-observability-and-operations.md`",
+      "mechanism": "Integration test",
+      "plannedVerification": "Assert `Copyright Removal` is not `delete local canonical data`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "12",
+        "45"
+      ],
+      "ownerCell": "`12`, `45`",
+      "completionGate": "[WP-12.02](../planning/work-packages/12-observability-foundation.md#rule-wp-12.02), [WP-45.04](../planning/work-packages/45-operations-support-and-trust-safety.md#rule-wp-45.04)"
+    },
+    {
+      "id": "I-437",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 682,
+      "coverageLine": 599,
+      "statement": "Public Share Removal ≠ delete private source",
+      "architectureHome": "`13-observability-and-operations.md`",
+      "mechanism": "Integration test",
+      "plannedVerification": "Assert `Public Share Removal` is not `delete private source`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "12",
+        "45"
+      ],
+      "ownerCell": "`12`, `45`",
+      "completionGate": "[WP-12.02](../planning/work-packages/12-observability-foundation.md#rule-wp-12.02), [WP-45.04](../planning/work-packages/45-operations-support-and-trust-safety.md#rule-wp-45.04)"
+    },
+    {
+      "id": "I-438",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 683,
+      "coverageLine": 600,
+      "statement": "Account Cloud Restriction ≠ local data lock",
+      "architectureHome": "`11-mobile-architecture.md`; `20-cross-system-lifecycles.md`",
+      "mechanism": "Integration test",
+      "plannedVerification": "Restrictions revoke Cloud authority, quarantine/preserve pending work and clear acknowledged cache per policy; independent native capture/media remains readable/exportable. Do not promise full Cloud-backed Notes/Chat functionality.",
+      "owningPackages": [
+        "22",
+        "25",
+        "31",
+        "49"
+      ],
+      "ownerCell": "`22`, `25`, `31`, `49`",
+      "completionGate": "[Client/recovery journeys](../architecture/contracts/07-client-journeys-and-ports.md)"
+    },
+    {
+      "id": "I-439",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 684,
+      "coverageLine": 601,
+      "statement": "Appeal ≠ delete enforcement history",
+      "architectureHome": "`13-observability-and-operations.md`",
+      "mechanism": "Integration test",
+      "plannedVerification": "Assert `Appeal` is not `delete enforcement history`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "12",
+        "45"
+      ],
+      "ownerCell": "`12`, `45`",
+      "completionGate": "[WP-12.02](../planning/work-packages/12-observability-foundation.md#rule-wp-12.02), [WP-45.04](../planning/work-packages/45-operations-support-and-trust-safety.md#rule-wp-45.04)"
+    },
+    {
+      "id": "I-440",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 685,
+      "coverageLine": 602,
+      "statement": "Security Report ≠ public bug report",
+      "architectureHome": "`13-observability-and-operations.md`",
+      "mechanism": "Integration test",
+      "plannedVerification": "Assert `Security Report` is not `public bug report`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "12",
+        "45"
+      ],
+      "ownerCell": "`12`, `45`",
+      "completionGate": "[WP-12.02](../planning/work-packages/12-observability-foundation.md#rule-wp-12.02), [WP-45.04](../planning/work-packages/45-operations-support-and-trust-safety.md#rule-wp-45.04)"
+    },
+    {
+      "id": "I-441",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 686,
+      "coverageLine": 603,
+      "statement": "Security Advisory ≠ Kill Switch",
+      "architectureHome": "`13-observability-and-operations.md`",
+      "mechanism": "Integration test",
+      "plannedVerification": "Assert `Security Advisory` is not `Kill Switch`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "12",
+        "45"
+      ],
+      "ownerCell": "`12`, `45`",
+      "completionGate": "[WP-12.02](../planning/work-packages/12-observability-foundation.md#rule-wp-12.02), [WP-45.04](../planning/work-packages/45-operations-support-and-trust-safety.md#rule-wp-45.04)"
+    },
+    {
+      "id": "I-442",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 687,
+      "coverageLine": 604,
+      "statement": "Security Advisory ≠ Package Revocation",
+      "architectureHome": "`13-observability-and-operations.md`",
+      "mechanism": "Integration test",
+      "plannedVerification": "Assert `Security Advisory` is not `Package Revocation`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "12",
+        "45"
+      ],
+      "ownerCell": "`12`, `45`",
+      "completionGate": "[WP-12.02](../planning/work-packages/12-observability-foundation.md#rule-wp-12.02), [WP-45.04](../planning/work-packages/45-operations-support-and-trust-safety.md#rule-wp-45.04)"
+    },
+    {
+      "id": "I-443",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 688,
+      "coverageLine": 605,
+      "statement": "Official Advisory ≠ self-host policy authority; Advisory ≠ remote policy authority",
+      "architectureHome": "`13-observability-and-operations.md`",
+      "mechanism": "Integration test",
+      "plannedVerification": "Assert `Official Advisory` is not `self-host policy authority; Advisory`, `self-host policy authority; Advisory` is not `remote policy authority`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "12",
+        "45"
+      ],
+      "ownerCell": "`12`, `45`",
+      "completionGate": "[WP-12.02](../planning/work-packages/12-observability-foundation.md#rule-wp-12.02), [WP-45.04](../planning/work-packages/45-operations-support-and-trust-safety.md#rule-wp-45.04)"
+    },
+    {
+      "id": "I-444",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 689,
+      "coverageLine": 606,
+      "statement": "Staff Access ≠ Secret Access",
+      "architectureHome": "`13-observability-and-operations.md`",
+      "mechanism": "Integration test",
+      "plannedVerification": "Assert `Staff Access` is not `Secret Access`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "12",
+        "45"
+      ],
+      "ownerCell": "`12`, `45`",
+      "completionGate": "[WP-12.02](../planning/work-packages/12-observability-foundation.md#rule-wp-12.02), [WP-45.04](../planning/work-packages/45-operations-support-and-trust-safety.md#rule-wp-45.04)"
+    },
+    {
+      "id": "I-445",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 690,
+      "coverageLine": 607,
+      "statement": "Support Attachment ≠ product resource authority",
+      "architectureHome": "`13-observability-and-operations.md`",
+      "mechanism": "Integration test",
+      "plannedVerification": "Assert `Support Attachment` is not `product resource authority`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "12",
+        "45"
+      ],
+      "ownerCell": "`12`, `45`",
+      "completionGate": "[WP-12.02](../planning/work-packages/12-observability-foundation.md#rule-wp-12.02), [WP-45.04](../planning/work-packages/45-operations-support-and-trust-safety.md#rule-wp-45.04)"
+    },
+    {
+      "id": "I-446",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 691,
+      "coverageLine": 608,
+      "statement": "Audit ≠ operator-editable history",
+      "architectureHome": "`13-observability-and-operations.md`",
+      "mechanism": "Integration test",
+      "plannedVerification": "Assert `Audit` is not `operator-editable history`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "12",
+        "45"
+      ],
+      "ownerCell": "`12`, `45`",
+      "completionGate": "[WP-12.02](../planning/work-packages/12-observability-foundation.md#rule-wp-12.02), [WP-45.04](../planning/work-packages/45-operations-support-and-trust-safety.md#rule-wp-45.04)"
+    },
+    {
+      "id": "I-447",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 692,
+      "coverageLine": 609,
+      "statement": "Data exists in the Cloud ≠ support has the right to browse it",
+      "architectureHome": "`13-observability-and-operations.md`",
+      "mechanism": "Integration test",
+      "plannedVerification": "Assert `Data exists in the Cloud` is not `support has the right to browse it`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "12",
+        "45"
+      ],
+      "ownerCell": "`12`, `45`",
+      "completionGate": "[WP-12.02](../planning/work-packages/12-observability-foundation.md#rule-wp-12.02), [WP-45.04](../planning/work-packages/45-operations-support-and-trust-safety.md#rule-wp-45.04)"
+    },
+    {
+      "id": "I-448",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 693,
+      "coverageLine": 610,
+      "statement": "Archive ≠ Delete",
+      "architectureHome": "`13-observability-and-operations.md`",
+      "mechanism": "Integration test",
+      "plannedVerification": "Assert `Archive` is not `Delete`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "12",
+        "45"
+      ],
+      "ownerCell": "`12`, `45`",
+      "completionGate": "[WP-12.02](../planning/work-packages/12-observability-foundation.md#rule-wp-12.02), [WP-45.04](../planning/work-packages/45-operations-support-and-trust-safety.md#rule-wp-45.04)"
+    },
+    {
+      "id": "I-460",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 699,
+      "coverageLine": 611,
+      "statement": "Notebook ≠ Workspace; Folder ≠ Tag; Document ≠ File; Block ≠ Markdown Line",
+      "architectureHome": "per-product architecture and product requirements",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Notebook` is not `Workspace; Folder`, `Workspace; Folder` is not `Tag; Document`, `Tag; Document` is not `File; Block`, `File; Block` is not `Markdown Line`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "15",
+        "18",
+        "33",
+        "36"
+      ],
+      "ownerCell": "`15`, `18`, `33`, `36`",
+      "completionGate": "owning product package gate"
+    },
+    {
+      "id": "I-461",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 700,
+      "coverageLine": 612,
+      "statement": "Note ≠ a second content model independent of Document",
+      "architectureHome": "per-product architecture and product requirements",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Note` is not `a second content model independent of Document`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "15",
+        "18",
+        "33",
+        "36"
+      ],
+      "ownerCell": "`15`, `18`, `33`, `36`",
+      "completionGate": "owning product package gate"
+    },
+    {
+      "id": "I-462",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 701,
+      "coverageLine": 613,
+      "statement": "Property ≠ Document Content; Saved View ≠ Ownership",
+      "architectureHome": "per-product architecture and product requirements",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Property` is not `Document Content; Saved View`, `Document Content; Saved View` is not `Ownership`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "15",
+        "18",
+        "33",
+        "36"
+      ],
+      "ownerCell": "`15`, `18`, `33`, `36`",
+      "completionGate": "owning product package gate"
+    },
+    {
+      "id": "I-463",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 702,
+      "coverageLine": 614,
+      "statement": "Attachment ≠ embedded base64",
+      "architectureHome": "per-product architecture and product requirements",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Attachment` is not `embedded base64`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "15",
+        "18",
+        "33",
+        "36"
+      ],
+      "ownerCell": "`15`, `18`, `33`, `36`",
+      "completionGate": "owning product package gate"
+    },
+    {
+      "id": "I-464",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 703,
+      "coverageLine": 615,
+      "statement": "ArcNotes Checklist Item ≠ ArcChat Agent Task",
+      "architectureHome": "per-product architecture and product requirements",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `ArcNotes Checklist Item` is not `ArcChat Agent Task`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "15",
+        "18",
+        "33",
+        "36"
+      ],
+      "ownerCell": "`15`, `18`, `33`, `36`",
+      "completionGate": "owning product package gate"
+    },
+    {
+      "id": "I-465",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 704,
+      "coverageLine": 616,
+      "statement": "ArcScope Project ≠ ArcForges Workspace",
+      "architectureHome": "per-product architecture and product requirements",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `ArcScope Project` is not `ArcForges Workspace`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "15",
+        "18",
+        "33",
+        "36"
+      ],
+      "ownerCell": "`15`, `18`, `33`, `36`",
+      "completionGate": "owning product package gate"
+    },
+    {
+      "id": "I-466",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 705,
+      "coverageLine": 617,
+      "statement": "Device ≠ DataSource; ConnectionProfile ≠ Connection",
+      "architectureHome": "per-product architecture and product requirements",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Device` is not `DataSource; ConnectionProfile`, `DataSource; ConnectionProfile` is not `Connection`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "15",
+        "18",
+        "33",
+        "36"
+      ],
+      "ownerCell": "`15`, `18`, `33`, `36`",
+      "completionGate": "owning product package gate"
+    },
+    {
+      "id": "I-467",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 706,
+      "coverageLine": 618,
+      "statement": "Session ≠ Connection; Session ≠ Capture",
+      "architectureHome": "per-product architecture and product requirements",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Session` is not `Connection; Session`, `Connection; Session` is not `Capture`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "15",
+        "18",
+        "33",
+        "36"
+      ],
+      "ownerCell": "`15`, `18`, `33`, `36`",
+      "completionGate": "owning product package gate"
+    },
+    {
+      "id": "I-468",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 707,
+      "coverageLine": 619,
+      "statement": "Channel ≠ Signal; Signal ≠ Event; Raw Signal ≠ Derived Signal",
+      "architectureHome": "per-product architecture and product requirements",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Channel` is not `Signal; Signal`, `Signal; Signal` is not `Event; Raw Signal`, `Event; Raw Signal` is not `Derived Signal`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "15",
+        "18",
+        "33",
+        "36"
+      ],
+      "ownerCell": "`15`, `18`, `33`, `36`",
+      "completionGate": "owning product package gate"
+    },
+    {
+      "id": "I-469",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 708,
+      "coverageLine": 620,
+      "statement": "Live View ≠ Recording; Pause View ≠ Pause Capture",
+      "architectureHome": "per-product architecture and product requirements",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Live View` is not `Recording; Pause View`, `Recording; Pause View` is not `Pause Capture`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "15",
+        "18",
+        "33",
+        "36"
+      ],
+      "ownerCell": "`15`, `18`, `33`, `36`",
+      "completionGate": "owning product package gate"
+    },
+    {
+      "id": "I-470",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 709,
+      "coverageLine": 621,
+      "statement": "Display Decimation ≠ Measurement Data",
+      "architectureHome": "per-product architecture and product requirements",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Display Decimation` is not `Measurement Data`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "15",
+        "18",
+        "33",
+        "36"
+      ],
+      "ownerCell": "`15`, `18`, `33`, `36`",
+      "completionGate": "owning product package gate"
+    },
+    {
+      "id": "I-471",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 710,
+      "coverageLine": 622,
+      "statement": "Measurement ≠ Analysis; Decoder Output ≠ Raw Data",
+      "architectureHome": "per-product architecture and product requirements",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Measurement` is not `Analysis; Decoder Output`, `Analysis; Decoder Output` is not `Raw Data`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "15",
+        "18",
+        "33",
+        "36"
+      ],
+      "ownerCell": "`15`, `18`, `33`, `36`",
+      "completionGate": "owning product package gate"
+    },
+    {
+      "id": "I-472",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 711,
+      "coverageLine": 623,
+      "statement": "Annotation ≠ data mutation; Comparison ≠ Merge",
+      "architectureHome": "per-product architecture and product requirements",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Annotation` is not `data mutation; Comparison`, `data mutation; Comparison` is not `Merge`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "15",
+        "18",
+        "33",
+        "36"
+      ],
+      "ownerCell": "`15`, `18`, `33`, `36`",
+      "completionGate": "owning product package gate"
+    },
+    {
+      "id": "I-473",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 712,
+      "coverageLine": 624,
+      "statement": "Source Profile ≠ historical Session configuration",
+      "architectureHome": "per-product architecture and product requirements",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Source Profile` is not `historical Session configuration`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "15",
+        "18",
+        "33",
+        "36"
+      ],
+      "ownerCell": "`15`, `18`, `33`, `36`",
+      "completionGate": "owning product package gate"
+    },
+    {
+      "id": "I-474",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 713,
+      "coverageLine": 625,
+      "statement": "ArcScope Cloud Sync ≠ raw capture upload",
+      "architectureHome": "per-product architecture and product requirements",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `ArcScope Cloud Sync` is not `raw capture upload`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "15",
+        "18",
+        "33",
+        "36"
+      ],
+      "ownerCell": "`15`, `18`, `33`, `36`",
+      "completionGate": "owning product package gate"
+    },
+    {
+      "id": "I-475",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 714,
+      "coverageLine": 626,
+      "statement": "View ≠ Signal Ownership",
+      "architectureHome": "per-product architecture and product requirements",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `View` is not `Signal Ownership`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "15",
+        "18",
+        "33",
+        "36"
+      ],
+      "ownerCell": "`15`, `18`, `33`, `36`",
+      "completionGate": "owning product package gate"
+    },
+    {
+      "id": "I-476",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 715,
+      "coverageLine": 627,
+      "statement": "ArcSlate Project ≠ Sequence; Project ≠ Media Folder",
+      "architectureHome": "per-product architecture and product requirements",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `ArcSlate Project` is not `Sequence; Project`, `Sequence; Project` is not `Media Folder`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "15",
+        "18",
+        "33",
+        "36"
+      ],
+      "ownerCell": "`15`, `18`, `33`, `36`",
+      "completionGate": "owning product package gate"
+    },
+    {
+      "id": "I-477",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 716,
+      "coverageLine": 628,
+      "statement": "Source Media ≠ Timeline Clip; Clip ≠ Source Media; MediaAsset ≠ Clip",
+      "architectureHome": "per-product architecture and product requirements",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Source Media` is not `Timeline Clip; Clip`, `Timeline Clip; Clip` is not `Source Media; MediaAsset`, `Source Media; MediaAsset` is not `Clip`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "15",
+        "18",
+        "33",
+        "36"
+      ],
+      "ownerCell": "`15`, `18`, `33`, `36`",
+      "completionGate": "owning product package gate"
+    },
+    {
+      "id": "I-478",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 717,
+      "coverageLine": 629,
+      "statement": "Source Time ≠ Timeline Time; Video Frame Time ≠ Audio Sample Time",
+      "architectureHome": "per-product architecture and product requirements",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Source Time` is not `Timeline Time; Video Frame Time`, `Timeline Time; Video Frame Time` is not `Audio Sample Time`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "15",
+        "18",
+        "33",
+        "36"
+      ],
+      "ownerCell": "`15`, `18`, `33`, `36`",
+      "completionGate": "owning product package gate"
+    },
+    {
+      "id": "I-479",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 718,
+      "coverageLine": 630,
+      "statement": "Playback ≠ final render; Preview Quality ≠ Export Quality",
+      "architectureHome": "per-product architecture and product requirements",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Playback` is not `final render; Preview Quality`, `final render; Preview Quality` is not `Export Quality`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "15",
+        "18",
+        "33",
+        "36"
+      ],
+      "ownerCell": "`15`, `18`, `33`, `36`",
+      "completionGate": "owning product package gate"
+    },
+    {
+      "id": "I-480",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 719,
+      "coverageLine": 631,
+      "statement": "Viewer frame drop ≠ source data loss; dropped preview frame ≠ dropped media data",
+      "architectureHome": "per-product architecture and product requirements",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Viewer frame drop` is not `source data loss; dropped preview frame`, `source data loss; dropped preview frame` is not `dropped media data`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "15",
+        "18",
+        "33",
+        "36"
+      ],
+      "ownerCell": "`15`, `18`, `33`, `36`",
+      "completionGate": "owning product package gate"
+    },
+    {
+      "id": "I-481",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 720,
+      "coverageLine": 632,
+      "statement": "Transition ≠ random clip overlap state",
+      "architectureHome": "per-product architecture and product requirements",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Transition` is not `random clip overlap state`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "15",
+        "18",
+        "33",
+        "36"
+      ],
+      "ownerCell": "`15`, `18`, `33`, `36`",
+      "completionGate": "owning product package gate"
+    },
+    {
+      "id": "I-482",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 721,
+      "coverageLine": 633,
+      "statement": "Effect Definition ≠ Effect Instance; Effect Stack ≠ separate effect engine",
+      "architectureHome": "per-product architecture and product requirements",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Effect Definition` is not `Effect Instance; Effect Stack`, `Effect Instance; Effect Stack` is not `separate effect engine`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "15",
+        "18",
+        "33",
+        "36"
+      ],
+      "ownerCell": "`15`, `18`, `33`, `36`",
+      "completionGate": "owning product package gate"
+    },
+    {
+      "id": "I-483",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 722,
+      "coverageLine": 634,
+      "statement": "Node Graph ≠ arbitrary script runtime; Keyframe ≠ current parameter value",
+      "architectureHome": "per-product architecture and product requirements",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Node Graph` is not `arbitrary script runtime; Keyframe`, `arbitrary script runtime; Keyframe` is not `current parameter value`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "15",
+        "18",
+        "33",
+        "36"
+      ],
+      "ownerCell": "`15`, `18`, `33`, `36`",
+      "completionGate": "owning product package gate"
+    },
+    {
+      "id": "I-484",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 723,
+      "coverageLine": 635,
+      "statement": "Proxy ≠ Render Cache; Render Cache ≠ Project Authority",
+      "architectureHome": "per-product architecture and product requirements",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Proxy` is not `Render Cache; Render Cache`, `Render Cache; Render Cache` is not `Project Authority`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "15",
+        "18",
+        "33",
+        "36"
+      ],
+      "ownerCell": "`15`, `18`, `33`, `36`",
+      "completionGate": "owning product package gate"
+    },
+    {
+      "id": "I-485",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 724,
+      "coverageLine": 636,
+      "statement": "Native Render Job ≠ Cloud Agent Task ≠ UI progress dialog; Rendered Artifact ≠ ArcSlate Project",
+      "architectureHome": "per-product architecture and product requirements",
+      "mechanism": "Unit test",
+      "plannedVerification": "Persist and recover native render progress independently of its UI dialog and any Cloud Agent Task; verify a rendered artifact references but cannot replace the canonical Slate project.",
+      "owningPackages": [
+        "15",
+        "18",
+        "33",
+        "36"
+      ],
+      "ownerCell": "`15`, `18`, `33`, `36`",
+      "completionGate": "owning product package gate"
+    },
+    {
+      "id": "I-486",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 725,
+      "coverageLine": 637,
+      "statement": "Transcript ≠ Subtitle; AI Analysis ≠ Timeline Edit",
+      "architectureHome": "per-product architecture and product requirements",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Transcript` is not `Subtitle; AI Analysis`, `Subtitle; AI Analysis` is not `Timeline Edit`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "15",
+        "18",
+        "33",
+        "36"
+      ],
+      "ownerCell": "`15`, `18`, `33`, `36`",
+      "completionGate": "owning product package gate"
+    },
+    {
+      "id": "I-487",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 726,
+      "coverageLine": 638,
+      "statement": "Agent Context ≠ media upload; Project Sync ≠ original media upload",
+      "architectureHome": "per-product architecture and product requirements",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `Agent Context` is not `media upload; Project Sync`, `media upload; Project Sync` is not `original media upload`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "15",
+        "18",
+        "33",
+        "36"
+      ],
+      "ownerCell": "`15`, `18`, `33`, `36`",
+      "completionGate": "owning product package gate"
+    },
+    {
+      "id": "I-488",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 727,
+      "coverageLine": 639,
+      "statement": "External Media ≠ Managed Media",
+      "architectureHome": "per-product architecture and product requirements",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `External Media` is not `Managed Media`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "15",
+        "18",
+        "33",
+        "36"
+      ],
+      "ownerCell": "`15`, `18`, `33`, `36`",
+      "completionGate": "owning product package gate"
+    },
+    {
+      "id": "I-489",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 728,
+      "coverageLine": 640,
+      "statement": "ArcSlate Link ≠ shared identity",
+      "architectureHome": "per-product architecture and product requirements",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `ArcSlate Link` is not `shared identity`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "15",
+        "18",
+        "33",
+        "36"
+      ],
+      "ownerCell": "`15`, `18`, `33`, `36`",
+      "completionGate": "owning product package gate"
+    },
+    {
+      "id": "I-490",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 729,
+      "coverageLine": 641,
+      "statement": "ArcSlate Sequence ≠ Timeline Clip",
+      "architectureHome": "per-product architecture and product requirements",
+      "mechanism": "Unit test",
+      "plannedVerification": "Assert `ArcSlate Sequence` is not `Timeline Clip`: a value, type or state satisfying one side is rejected where the other is required, and the refusal names this invariant.",
+      "owningPackages": [
+        "15",
+        "18",
+        "33",
+        "36"
+      ],
+      "ownerCell": "`15`, `18`, `33`, `36`",
+      "completionGate": "owning product package gate"
+    },
+    {
+      "id": "I-491",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 737,
+      "coverageLine": 642,
+      "statement": "Model loop location ≠ tool execution location",
+      "architectureHome": "`17-agent-harness.md` §1, §10; `09-ai-and-agent-runtime-architecture.md` §9",
+      "mechanism": "Structural test",
+      "plannedVerification": "Assert no desktop, mobile or browser assembly references a provider adapter or runs a turn loop; assert a Step's `toolLocality` is independent of Task ownership",
+      "owningPackages": [
+        "05",
+        "52"
+      ],
+      "ownerCell": "[WP-52.00](../planning/work-packages/52-cloud-harness.md#rule-wp-52.00), [WP-05](../planning/work-packages/05-architecture-and-repository-policy-tests.md#rule-wp-05)",
+      "completionGate": "No client-side model loop is reachable"
+    },
+    {
+      "id": "I-492",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 738,
+      "coverageLine": 643,
+      "statement": "Actual measured tokens ≠ estimated tokens; cumulative stream usage ≠ per-event delta",
+      "architectureHome": "`16-billing-and-commerce-architecture.md` §7.4; `data-model/01-cloud-data-model.md` §8.1",
+      "mechanism": "Integration test",
+      "plannedVerification": "Assert a pre-call estimate never becomes the settled amount; assert a later `usage_revision` replaces rather than sums, under duplicate and reordered delivery",
+      "owningPackages": [
+        "43"
+      ],
+      "ownerCell": "[WP-43.07](../planning/work-packages/43-managed-ai-routing-and-metering.md#rule-wp-43.07), [WP-43.02](../planning/work-packages/43-managed-ai-routing-and-metering.md#rule-wp-43.02)",
+      "completionGate": "Streamed and duplicated usage settle once, at measured quantities"
+    },
+    {
+      "id": "I-493",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 739,
+      "coverageLine": 644,
+      "statement": "Included recoverable capacity ≠ purchased credits ≠ supplier cost ≠ subscription payment",
+      "architectureHome": "`16-billing-and-commerce-architecture.md` §7.1; `data-model/01-cloud-data-model.md` §8.1",
+      "mechanism": "Unit and integration test",
+      "plannedVerification": "Assert the four quantities live in separate stores with separate units, are never summed into one figure, and that a refund of one cannot mint another",
+      "owningPackages": [
+        "42"
+      ],
+      "ownerCell": "[WP-42.11](../planning/work-packages/42-commerce-entitlement-and-credits.md#rule-wp-42.11), [WP-42.08](../planning/work-packages/42-commerce-entitlement-and-credits.md#rule-wp-42.08)",
+      "completionGate": "The four are separately queryable and never conflated"
+    },
+    {
+      "id": "I-494",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 740,
+      "coverageLine": 645,
+      "statement": "Current configuration ≠ historical pricing snapshot; changing configuration ≠ resetting customer balances",
+      "architectureHome": "`22-deployment-and-release-execution.md` §3.1; `16-billing-and-commerce-architecture.md` §7.7",
+      "mechanism": "Integration test",
+      "plannedVerification": "Replace every current rate and replay a historical charge, asserting the original amount reproduces; assert replacement resets no usage, capacity, credit or hold",
+      "owningPackages": [
+        "43",
+        "44"
+      ],
+      "ownerCell": "[WP-44.01](../planning/work-packages/44-dynamic-policy-and-configuration.md#rule-wp-44.01), [WP-43.07](../planning/work-packages/43-managed-ai-routing-and-metering.md#rule-wp-43.07)",
+      "completionGate": "Historical charges reproduce after full configuration replacement"
+    },
+    {
+      "id": "I-495",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 741,
+      "coverageLine": 646,
+      "statement": "Open executable policy logic ≠ private deployment values; secret mount ≠ customer BYOK",
+      "architectureHome": "`16-billing-and-commerce-architecture.md` §2.2; `08-security-architecture.md` §6",
+      "mechanism": "Policy test",
+      "plannedVerification": "Assert the public repository builds and validates with the public sample alone; assert no operation, field or UI accepts a customer provider credential",
+      "owningPackages": [
+        "05",
+        "43"
+      ],
+      "ownerCell": "[WP-43.03](../planning/work-packages/43-managed-ai-routing-and-metering.md#rule-wp-43.03), [WP-05](../planning/work-packages/05-architecture-and-repository-policy-tests.md#rule-wp-05)",
+      "completionGate": "Public code runs on public samples; no customer credential path exists"
+    },
+    {
+      "id": "I-496",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 742,
+      "coverageLine": 647,
+      "statement": "Synthetic capture ≠ hardware evidence; preview sample ≠ canonical simulation data",
+      "architectureHome": "`23-simulator-and-interchange.md` §1",
+      "mechanism": "Integration test",
+      "plannedVerification": "Assert simulated data is labelled synthetic through session, export and copy; assert preview decimation never drops a canonical sample",
+      "owningPackages": [
+        "51"
+      ],
+      "ownerCell": "[WP-51.01](../planning/work-packages/51-arcscope-cloud-simulator.md#rule-wp-51.01), [WP-51.04](../planning/work-packages/51-arcscope-cloud-simulator.md#rule-wp-51.04)",
+      "completionGate": "Synthetic data never enters a hardware-evidence path"
+    },
+    {
+      "id": "I-497",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 743,
+      "coverageLine": 648,
+      "statement": "OTIO interchange ≠ ArcSlate working project ≠ embedded source media",
+      "architectureHome": "`23-simulator-and-interchange.md` §2",
+      "mechanism": "Integration test",
+      "plannedVerification": "Assert import creates ArcSlate-owned objects rather than an OTIO working store; assert export binds a committed revision; assert no media is collected, uploaded or embedded",
+      "owningPackages": [
+        "39"
+      ],
+      "ownerCell": "[WP-39.05](../planning/work-packages/39-arcslate-integration-and-portability.md#rule-wp-39.05)",
+      "completionGate": "Interchange is a file, never the project and never the media"
+    },
+    {
+      "id": "I-498",
+      "status": "active",
+      "section": "7",
+      "catalogueLine": 744,
+      "coverageLine": 649,
+      "statement": "Evictable acknowledged cache ≠ unacknowledged edits/uploads/tool receipts",
+      "architectureHome": "`data-model/02-desktop-data-model.md` §1.4",
+      "mechanism": "Integration test",
+      "plannedVerification": "Assert eviction is refused while an unacknowledged change, staged upload or unreturned receipt references the row, under cache pressure, sign-out, account switch and subscription restriction",
+      "owningPackages": [
+        "18",
+        "25"
+      ],
+      "ownerCell": "[WP-25.01](../planning/work-packages/25-sync-engine-and-blob-lifecycle.md#rule-wp-25.01), [WP-18.05](../planning/work-packages/18-arcnotes-document-core.md#rule-wp-18.05)",
+      "completionGate": "No path discards unacknowledged work as cache"
+    }
+  ]
+}
diff --git a/eng/test_design_policy.py b/eng/test_design_policy.py
new file mode 100644
index 0000000..985b768
--- /dev/null
+++ b/eng/test_design_policy.py
@@ -0,0 +1,378 @@
+# SPDX-License-Identifier: AGPL-3.0-only
+"""Independent, deliberately corrupted documentation and real Git/CLI fixtures."""
+
+from copy import deepcopy
+import json
+from pathlib import Path
+import subprocess
+import sys
+import tempfile
+import unittest
+
+import design_corpus as corpus
+import design_policy as policy
+from design_graph import graph
+
+
+INDEX = 'docs/planning/work-packages/README.md'
+SEQUENCE = 'docs/planning/implementation-sequence.md'
+WP = 'docs/planning/work-packages/01-second.md'
+INVARIANT = '| I-001 | Workspace differs from account |'
+MAPPING = ('| [I-001](../requirements/01-normative-glossary-and-invariants.md#rule-i-001) | '
+           'Workspace differs from account | `fixture.md` | Unit | Independent assertion | `01` | Unit passes |')
+
+
+def fixture():
+    docs = {
+        policy.GLOSSARY: '''# Glossary
+## 1. Identity
+| Term | Space | Meaning |
+|---|---|---|
+| **Workspace** | domain, wire | An owned workspace. |
+## 5. Product terms
+### 5.1 Notes
+| **ArcNotes.Document** / **ArcNotes.Note** | domain, storage | Two names, preserved as written. |
+| **ArcNotes.OldView** | retired | Removed by scope. |
+## 6. Term spaces
+| Space | Meaning |
+|---|---|
+| domain | A domain concept. |
+| wire | A transport concept. |
+| UI | A visible concept. |
+| storage | A persisted concept. |
+| commercial | A sold concept. |
+## 7. Invariant catalogue
+<a id="rule-i-001"></a>
+''' + INVARIANT + '''
+<a id="rule-i-002"></a>
+| I-002 | Retired by scope: removed distinction |
+## 8. Forbidden aliases
+| Forbidden / obsolete | Reason | Instead |
+|---|---|---|
+| Bare local name | Context matters. | Use the qualified name. |
+''',
+        policy.COVERAGE: '''# Coverage
+### 4.2 Mechanism distribution
+| Mechanism | Count | Meaning |
+|---|---|---|
+| Unit | 1 | Active |
+| Absence test | 1 | Retired |
+| **Total** | **2** | Rows |
+### 4.3 Other
+## 7. Item-level mapping
+''' + MAPPING + '''
+| [I-002](../requirements/01-normative-glossary-and-invariants.md#rule-i-002) | Retired by scope: removed distinction | `fixture.md` | Absence test | No removed type | `02` | Absence passes |
+''',
+        'docs/architecture/fixture.md': '# Fixture\n',
+        'docs/architecture/29-design-policy-export.md': '# Authority fixture\n',
+        INDEX: '''# Packages
+| 00 | First | — |
+| 01 | Second | `00` |
+| 02 | Third | `01` |
+| 20 | Future | — |
+## Downstream dependency index
+| 00 | `01` |
+| 01 | `02` |
+| 02 | — |
+## Deferred-gate scheduling
+''',
+        SEQUENCE: '''# Sequence
+All 3 active packages
+Serial execution: 00, 01, 02.
+WP42.11 precedes 42.10.
+Total active dependency edges: 2.
+## 9. Dependencies
+| 00 | — |
+| 01 | `00` |
+| 02 | `01` |
+''',
+        'docs/planning/work-packages/20-future.md': '# Future\nNo active edges.\n',
+    }
+    for key, title, up, down in [('00', 'first', '—', '`01`'), ('01', 'second', '`00`', '`02`'),
+                                  ('02', 'third', '`01`', '—')]:
+        text = f'# Package {key}\n> Upstream: {up} · Downstream: {down}\n'
+        for number in range(1, 10):
+            text += f'## {number}. Section\n'
+            if number == 6:
+                text += f'<a id="rule-wp-{key}.90"></a>\n### WP-{key}.90 — Evidence\n'
+            elif number == 7:
+                text += f'| [WP-{key}.90](#rule-wp-{key}.90) | Evidence is required |\n'
+            elif number == 9:
+                text += f'**Upstream:** {up}\n**Downstream:** {down}\n'
+        docs[f'docs/planning/work-packages/{key}-{title}.md'] = text
+    return docs
+
+
+def register(items=None):
+    return {'schemaVersion': 1, 'license': 'AGPL-3.0-only',
+            'authority': 'docs/architecture/29-design-policy-export.md', 'classifications': items or []}
+
+
+class Fixture(unittest.TestCase):
+    def setUp(self):
+        self.temp = tempfile.TemporaryDirectory()
+        self.addCleanup(self.temp.cleanup)
+        self.root = Path(self.temp.name).resolve() / 'design'
+        self.root.mkdir()
+        self.output = self.root.parent / 'policy'
+        self.output.mkdir()
+        self.docs = fixture()
+        for name, value in self.docs.items():
+            self.write(name, value)
+        self.write(policy.CLASSIFICATIONS, policy.encode(register()).decode())
+        self.git('init', '--quiet')
+        self.git('config', 'core.autocrlf', 'false')
+        self.git('remote', 'add', 'origin', 'https://github.com/' + policy.REPOSITORY + '.git')
+        self.git('add', '.')
+        self.git('-c', 'user.name=Fixture', '-c', 'user.email=fixture@example.invalid',
+                 '-c', 'commit.gpgsign=false', '-c', 'core.hooksPath=' + str(self.root / 'no-hooks'),
+                 'commit', '--quiet', '-m', 'Independent fixture')
+        self.pin = {'schemaVersion': 1, 'license': 'AGPL-3.0-only', 'repository': policy.REPOSITORY,
+                    'commit': self.git('rev-parse', 'HEAD'),
+                    'sourceHashes': {p: policy.text_hash(corpus.read_document(self.root, p))
+                                     for p in [policy.GLOSSARY, policy.COVERAGE, policy.CLASSIFICATIONS]},
+                    'corpusSha256': policy.canonical_hash([{'path': p, 'sha256': policy.text_hash(t)}
+                                                          for p, t in sorted(self.docs.items())])}
+        self.save_pin()
+
+    def write(self, path, text):
+        target = self.root / path
+        target.parent.mkdir(parents=True, exist_ok=True)
+        target.write_text(text, encoding='utf8', newline='\n')
+
+    def git(self, *args):
+        return subprocess.check_output(['git', *args], cwd=self.root, stderr=subprocess.PIPE).decode().strip()
+
+    def save_pin(self):
+        (self.output / 'design-source.json').write_bytes(policy.encode(self.pin))
+
+    def export(self):
+        return policy.verify(self.root, self.output, refresh=True)
+
+
+class ExportTests(Fixture):
+    def test_real_git_round_trip_preserves_rows_and_planned_status(self):
+        result = self.export()
+        self.assertEqual(result['counts'], {'terms': 3, 'names': 4, 'invariants': 2, 'forbiddenAliases': 1})
+        vocabulary = policy.read_json(self.output / 'glossary-terms.json')
+        self.assertEqual(vocabulary['terms'][1]['names'], ['ArcNotes.Document', 'ArcNotes.Note'])
+        self.assertEqual(vocabulary['terms'][2]['spaces'], [])
+        mapping = policy.read_json(self.output / 'invariants.json')
+        self.assertEqual(mapping['verificationState'], 'planned-only')
+        self.assertEqual(mapping['records'][1]['mechanism'], 'Absence test')
+        self.assertEqual(mapping['records'][0]['plannedVerification'], 'Independent assertion')
+        self.assertEqual(mapping['records'][0]['owningPackages'], ['01'])
+        self.assertEqual(policy.verify(self.root, self.output)['outputs'], result['outputs'])
+
+    def test_missing_duplicate_and_edited_export_records_fail(self):
+        self.export()
+        for name, key in [('glossary-terms.json', 'terms'), ('invariants.json', 'records')]:
+            target = self.output / name
+            original = target.read_bytes()
+            for mutation in ('missing', 'duplicate', 'extra-field', 'reordered'):
+                with self.subTest(name=name, mutation=mutation):
+                    value = json.loads(original)
+                    if mutation == 'missing': value[key].pop()
+                    elif mutation == 'duplicate': value[key].append(value[key][0])
+                    elif mutation == 'extra-field': value[key][0]['invented'] = True
+                    else: value[key].reverse()
+                    target.write_bytes(policy.encode(value))
+                    with self.assertRaisesRegex(ValueError, 'export drift: ' + name):
+                        policy.verify(self.root, self.output)
+                    target.write_bytes(original)
+            target.unlink()
+            with self.assertRaisesRegex(ValueError, 'export drift: ' + name): policy.verify(self.root, self.output)
+            target.write_bytes(original)
+
+    def test_dirty_wrong_commit_and_wrong_source_hash_fail(self):
+        self.export()
+        self.write('README.md', '# Uncommitted\n')
+        with self.assertRaisesRegex(ValueError, 'exact clean pinned'): policy.verify(self.root, self.output)
+        (self.root / 'README.md').unlink()
+        original = deepcopy(self.pin)
+        for key in ('commit', 'corpusSha256', 'sourceHashes'):
+            self.pin = deepcopy(original)
+            if key == 'sourceHashes': self.pin[key][policy.GLOSSARY] = 'f' * 64
+            else: self.pin[key] = 'f' * len(self.pin[key])
+            self.save_pin()
+            with self.subTest(key=key), self.assertRaises(ValueError): policy.verify(self.root, self.output)
+
+    def test_preview_is_read_only_and_reports_dirty_state(self):
+        self.export()
+        original = {p: p.read_bytes() for p in self.output.iterdir()}
+        self.write('README.md', '# Proposed change\n')
+        result = policy.verify(self.root, self.output, preview=True)
+        self.assertEqual(result['mode'], 'preview')
+        self.assertTrue(result['source']['status'])
+        self.assertEqual({p: p.read_bytes() for p in self.output.iterdir()}, original)
+        with self.assertRaisesRegex(ValueError, 'preview cannot write'):
+            policy.verify(self.root, self.output, preview=True, refresh=True)
+
+    def test_cli_reports_real_failure_and_nonzero_exit(self):
+        self.export()
+        self.write('README.md', '[missing](no-such-file.md)\n')
+        receipt = self.root.parent / 'receipt.json'
+        result = subprocess.run([sys.executable, str(Path(policy.__file__)), '--design-root', str(self.root),
+                                 '--policy-root', str(self.output), '--preview', '--report', str(receipt)],
+                                capture_output=True, text=True)
+        self.assertEqual(result.returncode, 1)
+        evidence = policy.read_json(receipt)
+        self.assertEqual(evidence['result'], 'failed')
+        self.assertIn('README.md', evidence['error'])
+        self.assertIn('no-such-file.md', evidence['error'])
+
+    def test_wrong_repository_and_duplicate_json_keys_fail(self):
+        self.git('remote', 'set-url', 'origin', 'https://github.com/example/other.git')
+        with self.assertRaisesRegex(ValueError, 'repository identity'): self.export()
+        target = self.output / 'duplicate.json'
+        target.write_text('{"key":1,"key":2}', encoding='utf8')
+        with self.assertRaisesRegex(ValueError, 'duplicate JSON key'): policy.read_json(target)
+
+    def test_deprecated_bodies_are_excluded_before_reading(self):
+        self.write('docs/deprecated-inputs/README.md', '# Historical filenames\n')
+        self.write('docs/deprecated-inputs/body.md', '')
+        (self.root / 'docs/deprecated-inputs/body.md').write_bytes(b'\xff\xfe\xfa')
+        loaded = corpus.load(self.root)
+        self.assertIn('docs/deprecated-inputs/README.md', loaded)
+        self.assertNotIn('docs/deprecated-inputs/body.md', loaded)
+
+    def test_path_escape_is_rejected(self):
+        with self.assertRaisesRegex(ValueError, 'escapes Design root'):
+            corpus.read_document(self.root, '../private.md')
+
+
+class SourceTests(Fixture):
+    def check_mapping(self, docs):
+        return policy.invariants(self.root, docs, self.pin['commit'], {'00', '01', '02'})
+
+    def test_catalogue_mapping_missing_duplicate_statement_owner_home_and_totals(self):
+        cases = [
+            (policy.GLOSSARY, INVARIANT, '', 'ID sets'),
+            (policy.GLOSSARY, INVARIANT, INVARIANT + '\n' + INVARIANT, 'duplicate catalogue'),
+            (policy.COVERAGE, MAPPING, '', 'ID sets'),
+            (policy.COVERAGE, MAPPING, MAPPING + '\n' + MAPPING, 'duplicate/incomplete mapping'),
+            (policy.COVERAGE, 'Workspace differs from account', 'Workspace equals account', 'statement mismatch'),
+            (policy.COVERAGE, '`01`', '`20`', 'invalid invariant owner'),
+            (policy.COVERAGE, '`fixture.md`', '`missing.md`', 'missing architecture home'),
+            (policy.COVERAGE, '| Unit | 1 |', '| Unit | 2 |', 'distribution mismatch'),
+            (policy.COVERAGE, '| Absence test | No removed type', '| Unit | No removed type', 'absence test'),
+        ]
+        for path, old, new, diagnostic in cases:
+            with self.subTest(diagnostic=diagnostic):
+                docs = dict(self.docs); self.assertIn(old, docs[path]); docs[path] = docs[path].replace(old, new)
+                with self.assertRaisesRegex(ValueError, diagnostic): self.check_mapping(docs)
+
+    def test_glossary_rejects_duplicate_names_missing_spaces_and_unqualified_products(self):
+        for old, new, diagnostic in [
+            ('**ArcNotes.Document** / **ArcNotes.Note**', '**Workspace**', 'duplicate canonical term'),
+            ('**ArcNotes.Document** / **ArcNotes.Note**', '**Document**', 'unqualified product'),
+            ('| domain, wire |', '| mystery |', 'invalid term spaces'),
+            ('| domain, wire |', '|  |', 'invalid term spaces'),
+        ]:
+            docs = dict(self.docs); docs[policy.GLOSSARY] = docs[policy.GLOSSARY].replace(old, new)
+            with self.subTest(diagnostic=diagnostic), self.assertRaisesRegex(ValueError, diagnostic):
+                policy.glossary(docs, self.pin['commit'])
+
+
+class CorpusTests(Fixture):
+    def audit_texts(self, values):
+        for p, t in values.items(): self.write(p, t)
+        return corpus.audit(self.root, values)
+
+    def test_scoped_same_spelling_and_lowercase_suffix_relocations(self):
+        texts = {'a.md': '<a id="rule-an-01"></a>\n| AN-01 | First |\n',
+                 'b.md': '<a id="rule-an-01"></a>\n| AN-01 | Second |\n<a id="rule-v-05a"></a>\n',
+                 'c.md': '[AN-01](a.md#rule-an-01) and [explanation AN-01](b.md#rule-an-01)\n[V-05a](b.md#rule-v-05a)\n'}
+        result = self.audit_texts(texts)
+        self.assertEqual(result['errors'], [])
+        self.assertEqual(result['missingAnchors'], [])
+        self.assertEqual(len(result['citations']), 3)
+        self.assertEqual([x[3] for x in result['citations']], ['a.md', 'b.md', 'b.md'])
+        self.assertEqual(len(result['localLinks']), 3)
+
+    def test_missing_duplicate_wrong_home_wrong_anchor_and_compound_labels(self):
+        base = '<a id="rule-an-01"></a>\n| AN-01 | First |\n<a id="rule-an-02"></a>\n| AN-02 | Second |\n'
+        cases = [
+            ('[AN-01](missing.md#rule-an-01)', 'missing target'),
+            ('[AN-03](a.md#rule-an-03)', 'missing rule definition'),
+            ('[description AN-01](a.md#rule-an-02)', 'wrong rule anchor'),
+            ('[AN-01/AN-02](a.md#rule-an-01)', 'wrong rule anchor'),
+            ('[AN-01](https://example.invalid/#rule-an-01)', 'external rule home'),
+            ('[file](../outside.md)', 'link escapes'),
+            ('![diagram](missing.png)', 'missing target'),
+            ('[AN-01][rule]\n[rule]: a.md#rule-an-01', 'reference-link syntax'),
+        ]
+        for value, diagnostic in cases:
+            with self.subTest(value=value):
+                result = self.audit_texts({'a.md': base, 'b.md': value})
+                self.assertIn(diagnostic, repr(result['errors']))
+        result = self.audit_texts({'a.md': base + '<a id="rule-an-01"></a>\n| AN-01 | Duplicate |\n'})
+        self.assertIn('duplicate anchor', repr(result['errors']))
+        self.assertIn('duplicate definition', repr(result['errors']))
+        self.assertTrue(self.audit_texts({'a.md': '| AN-01 | Missing anchor |\n'})['missingAnchors'])
+
+    def test_fences_heading_suffixes_reference_findings_and_unclosed_fence(self):
+        text = ('# Same\n# Same\n[second](#same-1)\n````example\n```\n'
+                '[AN-99](missing.md)\n````\n<a id="rule-f-an-2"></a>\n| F-AN-2 | Finding |\n')
+        result = self.audit_texts({'a.md': text})
+        self.assertEqual(result['errors'], [])
+        self.assertEqual(result['definitions'], 1)
+        self.assertEqual(result['links'], 1)
+        self.assertIn('duplicate anchor', repr(self.audit_texts({'a.md': '<a id="same"></a>\n# Same\n'})['errors']))
+        with self.assertRaisesRegex(ValueError, 'unclosed code fence'): list(corpus.lines('~~~python\nunclosed'))
+
+    def test_unqualified_rules_and_exact_classification_drift(self):
+        line = 'Hash uses SHA-256.'
+        docs = {'a.md': line + '\n'}
+        report = self.audit_texts(docs)
+        item = {'path': 'a.md', 'lineSha256': policy.text_hash(line), 'token': 'SHA-256',
+                'occurrences': 1, 'kind': 'standard-name', 'reason': 'A standard, not a rule.',
+                'reviewOwner': 'Fixture reviewer', 'reviewed': '2026-09-18'}
+        self.assertEqual(policy.classify(docs, report, register([item]))['occurrences'], 1)
+        for key, value in [('occurrences', 2), ('lineSha256', 'f' * 64), ('kind', 'historical-excerpt')]:
+            changed = {**item, key: value}
+            with self.subTest(key=key), self.assertRaises(ValueError): policy.classify(docs, report, register([changed]))
+        with self.assertRaisesRegex(ValueError, 'duplicate occurrence'):
+            policy.classify(docs, report, register([item, item]))
+        with self.assertRaises(ValueError): policy.classify(docs, report, register())
+        docs = {'a.md': 'Current AN-01 must resolve.\n'}; report = self.audit_texts(docs)
+        self.assertEqual(report['raw'][0][2], 'AN-01')
+        changed = {**item, 'lineSha256': policy.text_hash(docs['a.md'].strip()), 'token': 'AN-01'}
+        with self.assertRaisesRegex(ValueError, 'invalid standard-name context'):
+            policy.classify(docs, report, register([changed]))
+
+
+class GraphTests(Fixture):
+    def test_independent_graph_and_every_drift_representation(self):
+        self.assertEqual(graph(self.root, self.docs)['errors'], [])
+        cases = [
+            (SEQUENCE, '| 02 | `01` |', '| 02 | `00` |', 'forward'),
+            (INDEX, '| 01 | Second | `00` |', '| 01 | Second | — |', 'forward/phase'),
+            (INDEX, '| 00 | `01` |', '| 00 | `02` |', 'transpose'),
+            (WP, '> Upstream: `00`', '> Upstream: `02`', 'header/dependency'),
+            (WP, '**Upstream:** `00`', '**Upstream:** `02`', 'forward mismatch'),
+            (WP, '**Downstream:** `02`', '**Downstream:** `00`', 'downstream mismatch'),
+            (SEQUENCE, '00, 01, 02.', '02, 01, 00.', 'producer ordered later'),
+            (SEQUENCE, '00, 01, 02.', '00, 01, 01.', 'serial node set'),
+            (SEQUENCE, 'All 3 active', 'All 4 active', 'node count'),
+            (SEQUENCE, 'edges: 2.', 'edges: 3.', 'edge count'),
+            (WP, '## 8. Section', '## 7. Section', 'duplicate numbered section'),
+            (WP, '## 8. Section', '## Missing', 'mandatory sections'),
+            (WP, '| [WP-01.90](#rule-wp-01.90) | Evidence is required |', '', 'owned .90'),
+            (WP, '| [WP-01.90](#rule-wp-01.90) | Evidence is required |',
+             '| [WP-01.90](#rule-wp-01.90) | One |\n| [WP-01.90](#rule-wp-01.90) | Two |', 'owned .90'),
+            (SEQUENCE, 'WP42.11 precedes 42.10.', '', 'commerce substep'),
+            (INDEX, '| 20 | Future | — |', '| 20 | Future | `01` |', 'inactive phase edges'),
+            (SEQUENCE, '| 02 | `01` |', '| 02 | `20` |', 'inactive producer'),
+            ('docs/planning/work-packages/20-future.md', 'No active edges.', '> Upstream: `01`', 'inactive package edges'),
+        ]
+        for path, old, new, diagnostic in cases:
+            with self.subTest(diagnostic=diagnostic):
+                docs = dict(self.docs); self.assertIn(old, docs[path]); docs[path] = docs[path].replace(old, new)
+                self.assertIn(diagnostic, repr(graph(self.root, docs)['errors']))
+        docs = {**self.docs, 'docs/planning/work-packages/01-duplicate.md': self.docs[WP]}
+        self.assertIn('duplicate package identifier', repr(graph(self.root, docs)['errors']))
+
+
+if __name__ == '__main__':
+    unittest.main()