Cut: SubjectDeclaration.authority_scope and SubjectState.authority_scope with
their four production readers; DecisionOpportunity.state_digest and every reader
of it, including the kernel's whole-world gate, ControllerRunner::select's
struct-equality filter, PersonaTurnBinding.state_digest, the two runtime.rs
surface-freshness comparisons, and the caller-supplied envelope revision for
opportunity-bearing commands; EdgeKind's Relation, Commitment, and Pressure arms.
Add: a positions partition and Position, EntityRecord.container with containment
acyclicity over the complete candidate graph, Route written into the existing
edges partition with AccessKind, Cost, and an open flag, the four inhabited
ComponentOp variants, and resolve_patch as the one owner of declarations,
references, topology admission, and operation preconditions, closing the complete
mismatch set before the first ID mints. A proposal now binds the digest of the
components its verification reads -- controller assignment, grants, Position, and
incident routes -- so an unchanged scope commits at a later revision and a changed
one is refused with KernelError::ScopeChanged. Schema bumps to topology.v1.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
24addfb21e