Pre-push review: feature/relational-references

diff --git a/Asterism/Asterism.xcodeproj/project.pbxproj b/Asterism/Asterism.xcodeproj/project.pbxprojindex 803497e..23840b2 100644--- a/Asterism/Asterism.xcodeproj/project.pbxproj+++ b/Asterism/Asterism.xcodeproj/project.pbxproj@@ -402,7 +402,7 @@ 				DEVELOPMENT_TEAM = V24684SCZN; 				GENERATE_INFOPLIST_FILE = NO; 				INFOPLIST_FILE = AsterismShareExtension/Info.plist;-				IPHONEOS_DEPLOYMENT_TARGET = 26.5;+				IPHONEOS_DEPLOYMENT_TARGET = 26.0; 				LD_RUNPATH_SEARCH_PATHS = ( 					"$(inherited)", 					"@executable_path/Frameworks",@@ -431,7 +431,7 @@ 				DEVELOPMENT_TEAM = V24684SCZN; 				GENERATE_INFOPLIST_FILE = NO; 				INFOPLIST_FILE = AsterismShareExtension/Info.plist;-				IPHONEOS_DEPLOYMENT_TARGET = 26.5;+				IPHONEOS_DEPLOYMENT_TARGET = 26.0; 				LD_RUNPATH_SEARCH_PATHS = ( 					"$(inherited)", 					"@executable_path/Frameworks",@@ -475,7 +475,7 @@ 				"INFOPLIST_KEY_UIStatusBarStyle[sdk=iphonesimulator*]" = UIStatusBarStyleDefault; 				INFOPLIST_KEY_UISupportedInterfaceOrientations_iPad = "UIInterfaceOrientationPortrait UIInterfaceOrientationPortraitUpsideDown UIInterfaceOrientationLandscapeLeft UIInterfaceOrientationLandscapeRight"; 				INFOPLIST_KEY_UISupportedInterfaceOrientations_iPhone = "UIInterfaceOrientationPortrait UIInterfaceOrientationLandscapeLeft UIInterfaceOrientationLandscapeRight";-				IPHONEOS_DEPLOYMENT_TARGET = 26.5;+				IPHONEOS_DEPLOYMENT_TARGET = 26.0; 				LD_RUNPATH_SEARCH_PATHS = "@executable_path/Frameworks"; 				"LD_RUNPATH_SEARCH_PATHS[sdk=macosx*]" = "@executable_path/../Frameworks"; 				MACOSX_DEPLOYMENT_TARGET = 26.5;@@ -523,7 +523,7 @@ 				"INFOPLIST_KEY_UIStatusBarStyle[sdk=iphonesimulator*]" = UIStatusBarStyleDefault; 				INFOPLIST_KEY_UISupportedInterfaceOrientations_iPad = "UIInterfaceOrientationPortrait UIInterfaceOrientationPortraitUpsideDown UIInterfaceOrientationLandscapeLeft UIInterfaceOrientationLandscapeRight"; 				INFOPLIST_KEY_UISupportedInterfaceOrientations_iPhone = "UIInterfaceOrientationPortrait UIInterfaceOrientationLandscapeLeft UIInterfaceOrientationLandscapeRight";-				IPHONEOS_DEPLOYMENT_TARGET = 26.5;+				IPHONEOS_DEPLOYMENT_TARGET = 26.0; 				LD_RUNPATH_SEARCH_PATHS = "@executable_path/Frameworks"; 				"LD_RUNPATH_SEARCH_PATHS[sdk=macosx*]" = "@executable_path/../Frameworks"; 				MACOSX_DEPLOYMENT_TARGET = 26.5;@@ -668,7 +668,7 @@ 				CURRENT_PROJECT_VERSION = 1; 				DEVELOPMENT_TEAM = V24684SCZN; 				GENERATE_INFOPLIST_FILE = YES;-				IPHONEOS_DEPLOYMENT_TARGET = 26.5;+				IPHONEOS_DEPLOYMENT_TARGET = 26.0; 				MACOSX_DEPLOYMENT_TARGET = 26.5; 				MARKETING_VERSION = 1.0; 				PRODUCT_BUNDLE_IDENTIFIER = me.nore.ig.AsterismTests;@@ -694,7 +694,7 @@ 				CURRENT_PROJECT_VERSION = 1; 				DEVELOPMENT_TEAM = V24684SCZN; 				GENERATE_INFOPLIST_FILE = YES;-				IPHONEOS_DEPLOYMENT_TARGET = 26.5;+				IPHONEOS_DEPLOYMENT_TARGET = 26.0; 				MACOSX_DEPLOYMENT_TARGET = 26.5; 				MARKETING_VERSION = 1.0; 				PRODUCT_BUNDLE_IDENTIFIER = me.nore.ig.AsterismTests;@@ -719,7 +719,7 @@ 				CURRENT_PROJECT_VERSION = 1; 				DEVELOPMENT_TEAM = V24684SCZN; 				GENERATE_INFOPLIST_FILE = YES;-				IPHONEOS_DEPLOYMENT_TARGET = 26.5;+				IPHONEOS_DEPLOYMENT_TARGET = 26.0; 				MACOSX_DEPLOYMENT_TARGET = 26.5; 				MARKETING_VERSION = 1.0; 				PRODUCT_BUNDLE_IDENTIFIER = me.nore.ig.AsterismUITests;@@ -744,7 +744,7 @@ 				CURRENT_PROJECT_VERSION = 1; 				DEVELOPMENT_TEAM = V24684SCZN; 				GENERATE_INFOPLIST_FILE = YES;-				IPHONEOS_DEPLOYMENT_TARGET = 26.5;+				IPHONEOS_DEPLOYMENT_TARGET = 26.0; 				MACOSX_DEPLOYMENT_TARGET = 26.5; 				MARKETING_VERSION = 1.0; 				PRODUCT_BUNDLE_IDENTIFIER = me.nore.ig.AsterismUITests;

diff --git a/Asterism/Asterism/Asterism.Development.entitlements b/Asterism/Asterism/Asterism.Development.entitlementsindex baf648a..3377355 100644--- a/Asterism/Asterism/Asterism.Development.entitlements+++ b/Asterism/Asterism/Asterism.Development.entitlements@@ -1,5 +1,22 @@ <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">-<plist version="1.0"><dict>-<key>com.apple.security.application-groups</key><array><string>group.me.nore.ig.Asterism.dev</string></array>-</dict></plist>+<plist version="1.0">+<dict>+	<key>aps-environment</key>+	<string>development</string>+	<key>com.apple.developer.aps-environment</key>+	<string>development</string>+	<key>com.apple.developer.icloud-container-identifiers</key>+	<array>+		<string>iCloud.me.nore.ig.Asterism.dev</string>+	</array>+	<key>com.apple.developer.icloud-services</key>+	<array>+		<string>CloudKit</string>+	</array>+	<key>com.apple.security.application-groups</key>+	<array>+		<string>group.me.nore.ig.Asterism.dev</string>+	</array>+</dict>+</plist>

diff --git a/Asterism/Asterism/Asterism.Personal.entitlements b/Asterism/Asterism/Asterism.Personal.entitlementsindex 8fa6706..8354973 100644--- a/Asterism/Asterism/Asterism.Personal.entitlements+++ b/Asterism/Asterism/Asterism.Personal.entitlements@@ -1,5 +1,22 @@ <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">-<plist version="1.0"><dict>-<key>com.apple.security.application-groups</key><array><string>group.me.nore.ig.Asterism</string></array>-</dict></plist>+<plist version="1.0">+<dict>+	<key>aps-environment</key>+	<string>development</string>+	<key>com.apple.developer.aps-environment</key>+	<string>development</string>+	<key>com.apple.developer.icloud-container-identifiers</key>+	<array>+		<string>iCloud.me.nore.ig.Asterism</string>+	</array>+	<key>com.apple.developer.icloud-services</key>+	<array>+		<string>CloudKit</string>+	</array>+	<key>com.apple.security.application-groups</key>+	<array>+		<string>group.me.nore.ig.Asterism</string>+	</array>+</dict>+</plist>

diff --git a/Asterism/Asterism/Info.plist b/Asterism/Asterism/Info.plistindex 2899649..c8e9c56 100644--- a/Asterism/Asterism/Info.plist+++ b/Asterism/Asterism/Info.plist@@ -2,9 +2,13 @@ <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict>-    <key>AsterismAppGroupIdentifier</key>-    <string>$(ASTERISM_APP_GROUP_IDENTIFIER)</string>-    <key>AsterismStoreRelativePath</key>-    <string>$(ASTERISM_STORE_RELATIVE_PATH)</string>+	<key>AsterismAppGroupIdentifier</key>+	<string>$(ASTERISM_APP_GROUP_IDENTIFIER)</string>+	<key>AsterismStoreRelativePath</key>+	<string>$(ASTERISM_STORE_RELATIVE_PATH)</string>+	<key>UIBackgroundModes</key>+	<array>+		<string>remote-notification</string>+	</array> </dict> </plist>

diff --git a/Asterism/Asterism/Views/RecentView.swift b/Asterism/Asterism/Views/RecentView.swiftindex 38cdd2c..42bb4d5 100644--- a/Asterism/Asterism/Views/RecentView.swift+++ b/Asterism/Asterism/Views/RecentView.swift@@ -224,14 +224,17 @@ struct RecentEntryRow: View {     }      /// One short sentence per cause, saying what is unresolved rather than that-    /// something is. No action is offered here: for three of the four causes-    /// teaching is refused, and the route is the diagnosis screen (Req 4.1).+    /// something is. The label itself offers no action: for three of the five+    /// causes teaching is refused, and the route is the diagnosis screen+    /// (Req 4.1). `citationUnresolved` is the exception — its hostname is+    /// teachable, so the row keeps the Re-teach pill beside this label.     private static func attentionLabel(_ attention: RecentRowAttention) -> String {         switch attention {         case .siteMissing: "No site record for this address"         case .siteDuplicated: "This site is stored more than once"         case .siteRulesInvalid: "This site's saved rules are not valid"         case .workMissing: "The work this entry belongs to is missing"+        case .citationUnresolved: "The rule that named this entry is missing"         }     } 

diff --git a/Asterism/AsterismTests/CrossViewRefreshTests.swift b/Asterism/AsterismTests/CrossViewRefreshTests.swiftindex 50e8f80..ec29d7a 100644--- a/Asterism/AsterismTests/CrossViewRefreshTests.swift+++ b/Asterism/AsterismTests/CrossViewRefreshTests.swift@@ -5,7 +5,11 @@ import Testing @testable import Asterism  /// Creates a real empty V4 store and its readiness marker so the app bootstrap-/// (openV4ForApp) reaches `.ready`.+/// (openV4ForApp) reaches `.ready`. The store is built at the current schema,+/// so it is marked migrated — the extension opens no other version (Q14).+/// The store is *empty*, so there is nothing for the relationship pass to+/// populate and no record here carries a nil `site` (task 19): this is exactly+/// mark-at-birth's shape, which certifies at `"5"` and runs no pass (Q26). private func publishV3ReadyForTests(for config: LibraryConfiguration) {     let storeDir = config.v4StoreURL.deletingLastPathComponent()     try? FileManager.default.createDirectory(at: storeDir, withIntermediateDirectories: true)@@ -14,7 +18,7 @@ private func publishV3ReadyForTests(for config: LibraryConfiguration) {         try? context.save()         withExtendedLifetime(container) {}     }-    try? LibraryRepository.publishV4Readiness(at: config.v4MarkerURL)+    try? LibraryRepository.publishV5Readiness(at: config.v4MarkerURL) }  /// Tests for cross-view refresh: mutations in detail models trigger

diff --git a/Asterism/AsterismTests/Helpers/MockLibraryProvider.swift b/Asterism/AsterismTests/Helpers/MockLibraryProvider.swiftindex f5c883b..b6d52da 100644--- a/Asterism/AsterismTests/Helpers/MockLibraryProvider.swift+++ b/Asterism/AsterismTests/Helpers/MockLibraryProvider.swift@@ -127,9 +127,6 @@ final class MockLibraryProvider: LibraryProviding, @unchecked Sendable {     var entryTeachingDetailResult: Result<EntryTeachingDetail, Error> = .failure(MockError.notConfigured)     var entryTeachingDetailCallCount = 0 -    var titlePatternResult: Result<TitlePatternSnapshot, Error> = .failure(MockError.notConfigured)-    var titlePatternCallCount = 0-     var projectInitialTeachingResult: Result<TeachingContract, Error> = .failure(MockError.notConfigured)     var projectInitialTeachingCallCount = 0 @@ -161,11 +158,6 @@ final class MockLibraryProvider: LibraryProviding, @unchecked Sendable {     var commitCaptureCallCount = 0     var lastCommittedCaptureContract: CaptureContract? -    func titlePattern(id: UUID) async throws -> TitlePatternSnapshot {-        titlePatternCallCount += 1-        return try titlePatternResult.get()-    }-     func entryTeachingDetail(id: UUID) async throws -> EntryTeachingDetail {         entryTeachingDetailCallCount += 1         return try entryTeachingDetailResult.get()

diff --git a/Asterism/AsterismTests/IntegrationSafetyNetTests.swift b/Asterism/AsterismTests/IntegrationSafetyNetTests.swiftindex 90d3a1e..d077c3c 100644--- a/Asterism/AsterismTests/IntegrationSafetyNetTests.swift+++ b/Asterism/AsterismTests/IntegrationSafetyNetTests.swift@@ -249,11 +249,15 @@ struct IntegrationSafetyNetTests {         let (openResult, _) = try await LibraryRepository.openV4ForApp(config)         #expect(openResult == .ready(.zero)) -        // The extension can capture from here on. This is the guard T-1969-        // deliberately gives up: capture into a fresh library is now possible-        // before a reader restores a backup through Settings. A replace-style-        // import would discard that capture, but only behind the two-step-        // destructive confirmation, which shows the current counts first.+        // The extension can capture from here on — mark-at-birth certifies an+        // empty store at "5" (Q26), so the handoff proved here is the real+        // app→extension one, with nothing standing in for it.+        //+        // This is the guard T-1969 deliberately gives up: capture into a fresh+        // library is now possible before a reader restores a backup through+        // Settings. A replace-style import would discard that capture, but only+        // behind the two-step destructive confirmation, which shows the current+        // counts first.         let (extResult, extRepo) = try await LibraryRepository.openV4ForExtension(config)         #expect(extResult == .ready(.zero))         let captured = try await extRepo.capture(@@ -316,7 +320,9 @@ struct IntegrationSafetyNetTests {         #expect(counts.entries == 1)         #expect(counts.works == 1) -        // Extension should now work on the target configuration+        // Extension should now work on the target configuration: the fresh open+        // above created an empty store, which mark-at-birth certifies at "5"+        // (Q26), and a fill import does not republish the marker.         let (_, extRepo) = try await LibraryRepository.openV4ForExtension(targetConfig)         let observed = try await extRepo.entry(id: entry.id)         #expect(observed.note == "Import note ✓")@@ -1073,14 +1079,18 @@ private func publishV3Ready(for config: LibraryConfiguration) throws { }  /// Creates a real empty V4 store and its readiness marker so the app bootstrap-/// (openV4ForApp) reaches `.ready`.+/// (openV4ForApp) reaches `.ready`. The store is built at the current schema,+/// so it is marked migrated — the extension opens no other version (Q14).+/// The store is *empty*, so there is nothing for the relationship pass to+/// populate and no record here carries a nil `site` (task 19): this is exactly+/// mark-at-birth's shape, which certifies at `"5"` and runs no pass (Q26). private func createReadyV4Library(for config: LibraryConfiguration) throws {     let storeDir = config.v4StoreURL.deletingLastPathComponent()     try FileManager.default.createDirectory(at: storeDir, withIntermediateDirectories: true)     let container = try LibraryRepository.openV4Container(at: config.v4StoreURL)     try ModelContext(container).save()     withExtendedLifetime(container) {}-    try LibraryRepository.publishV4Readiness(at: config.v4MarkerURL)+    try LibraryRepository.publishV5Readiness(at: config.v4MarkerURL) }  private func openV3AppRepository(

diff --git a/CHANGELOG.md b/CHANGELOG.mdindex 2d85c9f..cda6fde 100644--- a/CHANGELOG.md+++ b/CHANGELOG.md@@ -8,9 +8,17 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).  ### Upgrading -- **Your library migrates to schema V4 the first time you open the app after-  this update.** The migration is crash-safe and needs no action from you: it-  runs once, verifies itself, and marks the library ready.+- **Your library migrates to schema V5 the first time you open the app after+  this update.** A library still on an older schema traverses every intervening+  step in that same single open. The migration is crash-safe and needs no action+  from you: it runs once, verifies itself, and marks the library ready.+- **On a large library that first launch takes a noticeable moment.** The pass+  that gives every entry and work a real link to its site dominates it: measured+  at roughly 17 s for a 5,000-entry library on a Mac, which is the deliberate+  worst case — every one of those entries on a single site. A library of a few+  hundred notes is well under a second. The pass commits all at once, so an+  interrupted launch simply runs it again rather than leaving the library+  half-converted. - **Open the app once before sharing to it.** The share extension deliberately   refuses to capture until the app has completed the migration, so a share   attempted before the first launch will fail closed rather than write to a@@ -22,6 +30,12 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).   comes from whichever rule supplies it. Existing taught Sites carry over   without re-teaching. +### Changed++- An Entry and a Work now carry a modelled relationship to their Site (schema V5) alongside the hostname strings they have always recorded. The relationship is the reference the app will act on; the strings remain capture-time evidence and the archive's reference format, so backups are unaffected. The store converts to V5 the first time the app opens it after this update, and the same launch populates the relationships from the recorded hostnames — on a large library this pass dominates that first launch: five thousand entries measured ~17 s in a host release build, above the 10 s the requirements budgeted, recorded as a known issue while the device number remains unmeasured. The pass itself: every hostname resolves through the same deterministic row selection the app uses everywhere else, records whose hostname matches no Site keep a nil relationship as a tolerated state, and the whole pass commits as one save with the readiness marker published only afterwards — an interrupted launch simply re-runs the pass and converges. The share extension declines to capture into a library until that certification has happened; a fresh, empty library is certified immediately and shares from first launch. After certification, every write the app makes — capture, creating a Work, moving an entry, teaching commits, and backup import — sets the relationship together with the hostname it has always recorded, selecting the Site row the same way the migration does, so the two halves cannot drift apart.+- Resolving a rule an Entry cites now looks only among the rules owned by the Site record the Entry itself points at, instead of searching the union of every row sharing the hostname — with each record carrying its own reference, the ambiguity that union existed to bridge is gone. Which Site presents a screen is unchanged: mode, title cleaning, and offered actions still follow the hostname's current teaching, while a record's recorded provenance now survives any change in which row that is.+- Recent and an Entry's detail screen now render a row whose cited title pattern cannot be resolved — marked as needing attention, with the cited pattern's identity kept visible as evidence — instead of the one unresolvable citation failing the whole feed or screen. Re-teaching the site remains available on such a row, because re-teaching is the repair.+ ### Fixed  - Fixed a new library becoming permanently unopenable, and removed the first-run setup screen that caused it. A fresh install used to create its library and then withhold the marker that certifies it until you answered "import a backup or start empty" — a question with nothing behind it, since there was no library to import into yet. Anything writing in that gap left a library the app could no longer classify, and every later launch refused to open it with no way back short of deleting the app. The library is now marked the moment it is created, so a fresh install opens straight into an empty library and the question is gone. One consequence worth knowing: the share extension now works from first launch instead of waiting for that answer, so a page shared before you restore a backup will be in the library when you do — restoring still shows you what it is about to discard and still asks twice. Importing a backup is unchanged and still lives in Settings. A library that is nonempty but uncertified is still refused rather than guessed at, which is the case that check was written for; a certified library whose store file has gone now says so instead of quietly starting you over on an empty one.@@ -30,7 +44,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). - Fixed Teach being offered on sites where teaching is refused. A site with duplicate rows no longer shows a Teach action in Recent or on an entry's detail screen, and its entries no longer count toward the "needs teaching" total — tapping that total previously filtered to a list of rows carrying no action. The rows still appear and are still marked as needing attention; the diagnostics screen is the route for them. A site whose stored rules are merely inconsistent is unaffected and still offers Teach, because re-teaching is exactly what repairs it. - Fixed teaching being offered on sites where it could not be saved. Teaching, the Work-only transition, and the URL identity review now decline up front on a site with duplicate rows — where teaching cannot be trusted and could not have been committed anyway — instead of accepting the work and failing at the end. A site that simply has no stored row is unaffected and still teachable; it also repairs itself the next time you capture from that host. - Fixed Recent, Entry detail and Work Merge failing entirely because of one unresolvable record. Recent now emits a row it cannot fully resolve rather than refusing the whole feed — identified by its capture title, or the Work's display title, and marked as needing attention, with the cause being either no Site row for the hostname or a missing referenced Work. Such a row offers no Teach action, because teaching a hostname with no Site row was itself a dead end. A Site whose stored rules are internally inconsistent no longer breaks the feed either; it renders without a mode instead. Entry detail and Work Merge resolve a single row where they previously asserted there was exactly one. Merge is deliberately more conservative than the rest: it commits where the records involved are unaffected, and otherwise **refuses with a stated reason** rather than merging part of a duplicated set — previously it could have moved one twin's Entries and deleted it while the other survived.-- Fixed an Entry's recorded provenance appearing and disappearing when a hostname has more than one Site row. Which row "wins" depends on what each one has been taught, so a teaching commit elsewhere could flip it — and a pattern belonging to the row that lost became unfindable, making the affected Entries' replay fail until the winner happened to flip back. Resolving a pattern or rule an Entry already cites now searches every Site row for that hostname, so it keeps resolving regardless of which row currently wins. Applying rules to a *new* capture still uses the winning row only, which is the one case where picking a single row is the point.+- Fixed an Entry's recorded provenance appearing and disappearing when a hostname has more than one Site row. Which row "wins" depends on what each one has been taught, so a teaching commit elsewhere could flip it — and a pattern belonging to the row that lost became unfindable, making the affected Entries' replay fail until the winner happened to flip back. Provenance no longer flickers that way. The mechanism is the one described under Changed: a record now carries its own relationship to the Site whose rules it cites, and resolution follows that fixed reference instead of searching every row sharing the hostname. Applying rules to a *new* capture still uses the winning row only, which is the one case where picking a single row is the point. - Fixed a single damaged record locking you out of the whole library. Three states that previously refused the open now degrade instead: an Entry or Work whose hostname has no Site row, more than one Site row for a hostname, and two records sharing an application identifier. The validator gained a tolerant entry point that records these as diagnoses rather than throwing, and the identity lookups resolve a deterministic winner instead of giving up — `fetchSites`, `fetchEntry`, `fetchWork` and the pattern lookup no longer cap their fetch at two rows, which previously made three or more duplicates unresolvable in principle. Capture from the share extension now succeeds in all three states, and a re-share update against a duplicated Entry saves instead of reporting the capture invalid. Backup **import** is deliberately unaffected: all three import gates now call a strict entry point that keeps today's exact behaviour, so an incoherent archive is still refused. States outside the tolerated set are unchanged — an unrecognised stored value or an unreadable store still fails closed, and a blank hostname or Work title still quarantines that hostname. - Fixed the performance suites reporting success without measuring anything. Four independent defects stacked: the opt-in gate was written `ASTERISM_RUN_PHYSICAL_PERFORMANCE=1 $(PIPEFAIL) <cmd>` and `PIPEFAIL` expands to `set -o pipefail;`, so the assignment applied to `set` and never reached the test process, which then skipped the whole suite and reported green; the device targets could not have passed the gate to the XCTest runner regardless, because `xcodebuild` forwards only `TEST_RUNNER_`-prefixed variables; a passing run printed no number, because `#expect` reports only on failure, leaving nothing to record a baseline from; and the `Asterism Personal` scheme's test action listed the `AsterismTests` unit bundle, which needs `ENABLE_TESTABILITY` — set only on `Development` — so it failed to compile and cancelled the whole test action, including the UI suites. The M4 suite additionally ran in debug, and cannot compile in release without `-DASTERISM_PERFORMANCE_TESTING`, since the fixture it depends on is guarded on `DEBUG`. No measured performance number predating this change should be trusted. The M4 suite now records a distribution — min, median, p95, max and spread — rather than a single value, and asserts the median against the budget on every run while keeping the p95 tail check for controlled runs. The previous statistic was the second-slowest of twenty samples, so one scheduling hiccup set the recorded number: three consecutive runs of unchanged code spanned 0.7389 s to 1.2789 s and breached the budget once. - Fixed the unsettled-chapters acknowledgment's confirm button being unreachable to VoiceOver and to UI tests: an accessibility identifier on the container without a matching containment trait collapsed the subtree and hid the controls inside it.@@ -158,6 +172,8 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).  ### Changed +- Enabled the iCloud (CloudKit) capability on both app configurations, each paired with its own container, along with the remote-notification background mode that CloudKit's change signalling depends on. This is groundwork for the mirroring milestone and nothing syncs yet — the app still opens its store with mirroring off. The share extensions deliberately carry no iCloud entitlement, so a later change that tried to sync from the extension fails at container load instead of quietly exporting the same records twice.+- Lowered the minimum iOS version from 26.5 to 26.0. The design document has always said iOS 26+, but every build configuration pinned 26.5, so the app refused to install on a device running any earlier 26.x — which is how this was found: a second device on 26.2 was ruled ineligible outright. Nothing in the code depended on an API newer than 26.0; both configurations build and the unit suite passes unchanged. - Split the planned M4 CloudKit milestone into three specs and specified the first of them, Library Integrity Tolerance. The original plan assumed the hazard of enabling sync before reconciliation was duplicate records; the larger hazard is missing ones. `Entry.hostname` and `Work.siteHostname` are plain strings rather than modelled relationships, so CloudKit cannot preserve the ordering the store-level validator assumes, and an Entry arriving before its Site — the expected transient state of every sync — currently throws at store level and leaves the library unopenable in both processes. That is also circular, since the app cannot run the reconciliation that would repair the graph while the graph prevents the store opening. M4a therefore makes three states degrade instead of failing (absent Site row, more than one Site row per hostname, duplicate application UUIDs): seventeen throw sites demote to recorded diagnoses, ambiguous identity lookups resolve to a deterministic winner, cited pattern ids resolve across all rows for a hostname so provenance replay survives duplication, a diagnosis surface makes the state visible, and re-teaching can clear a diagnosis it fixes — which it currently cannot, because the teaching commit compares post-commit diagnoses with no pre-commit baseline. No CloudKit, no schema change, no archive-format change; every requirement is verifiable offline. M4b then enables mirroring and M4c reconciles duplicates, so the reconciler is written against duplicates actually observed rather than guessed at. - Recorded two constraints for M4b found while specifying M4a. Only the app will mirror: TN3164's "Avoid synchronizing a store with multiple persistent containers" names the app-and-extension-share-a-store case directly, each container keeps its own export history token so both processes can export one object twice, and an extension is terminated too soon after completing its request for an asynchronous export to finish anyway. And the backup half of that milestone is an archive-format change rather than a policy change: export self-validates by decoding its own bytes, that decode runs the reference validator, and duplicate Site rows cannot be represented at all because `BackupV4Site` is keyed by hostname and every reference to a Site is a hostname string. Probing `initializeCloudKitSchema` established that the V4 and V3 schemas need no change to mirror, leaving CKRecord round-tripping of the Codable-struct (composite) attributes as M4b's first task. - Restructured the design document's milestone section to match the shipped state: M1–M3 marked shipped, the unplanned M3.5 Unified Teaching Composition recorded as its own entry because it consumed schema V4 and the `.m4` capability gate, and a warning that milestone labels and gate names of the same number no longer refer to the same work. The document header now states that implementation is under way and that the per-milestone specs in `specs/` are the newer record wherever they contradict it — a precedence rule that did not previously exist, and which several sections now need (§2.3 describes duplicate handling as pairs, while M4c must handle three or more).

diff --git a/CLAUDE.md b/CLAUDE.mdindex 1b8c21f..04a0aac 100644--- a/CLAUDE.md+++ b/CLAUDE.md@@ -43,11 +43,13 @@ invocations where a target exists. - `make test-core` — AsterismCore package tests (host, fast, safe) - `make test-quick` — unit-test bundle only (simulator) - `make test` / `make test-ui` — full suites (simulator)-- `make test-performance-m4` — M4 Core budgets, host only, no device, safe to run+- `make test-performance-m4` — M4 Core budgets, host only, no device, safe to run. **Takes ~30 minutes** since the V4→V5 migration measurement joined it: each sample is ~17 s of migration plus a ~13 s reset that has to be committed and reopened to be a pre-pass graph at all (Q58 of `specs/relational-references`). - `make test-performance`, `make test-performance-m4-recent` — **physical device, see above**  The `-m4` and `-m4-recent` targets are easy to confuse and only one of them is safe: `test-performance-m4` is a `swift test` run of the `AsterismCore` package on the host, while `test-performance-m4-recent` builds the `Personal` configuration and installs it over the real app on a phone. +If you run `swift test` by hand instead of through the Makefile, pass `--no-parallel`. It is load-bearing, not a flakiness preference: mixed-schema suites in one parallel process fight over SwiftData's global entity registry and die with `NSUnknownKeyException`. See `docs/agent-notes/testing.md`.+ There is no linter or formatter configured in this repo — no `.swiftformat`, `.swiftlint.yml`, or `.swift-format`, and no `make lint`/`format` target. A clean `make test-core` with no new compiler warnings is the pre-commit bar.

diff --git a/Makefile b/Makefileindex 8fe0f33..fa9efeb 100644--- a/Makefile+++ b/Makefile@@ -65,6 +65,9 @@ help:  .PHONY: test-core # Swift package tests are not members of the app scheme's test plan.+# `--no-parallel` is load-bearing, not a speed choice: parallel `swift test`+# crashes the run with `NSUnknownKeyException: the entity Site is not key value+# coding-compliant for the key "entries"` (Q34, docs/agent-notes/testing.md). test-core: 	$(PIPEFAIL) swift test --package-path Packages/AsterismCore --no-parallel $(if $(CORE_TEST),--filter '$(CORE_TEST)',) $(PIPE_PRETTY) @@ -223,6 +226,15 @@ test-performance-m4-recent: # ASTERISM_RUN_PHYSICAL_PERFORMANCE=1, so the default `make test-core` never runs # them. Run this target to exercise the budgets (Req 8.5, 6.5, Q9). #+# It also carries the relational-references scale work: store-level validation+# (Req 5.3) in M4ScalePerformanceTests, and the V4 -> V5 relationship migration+# against its 10 s budget (Req 2.6) in M4MigrationScalePerformanceTests.+#+# Budget your time: one RUNS=1 pass takes ~30 minutes, most of it in the+# migration suite. Every sample there is ~17 s of migration plus a ~13 s reset+# that has to be committed and reopened to be a pre-pass graph at all, and there+# is no shortcut that does not turn the measurement into one of a warm store.+# # Set PERFORMANCE_LOG to collect the measured distributions into a file. Each # line carries median, p95, min, max and the max/min spread. #@@ -263,7 +275,7 @@ test-performance-m4: 			--no-parallel \ 			-c release \ 			-Xswiftc -DASTERISM_PERFORMANCE_TESTING \-			--filter 'M4(ScalePerformance|ToleratedScalePerformance|ToleratedFixture)Tests' \+			--filter 'M4(ScalePerformance|ToleratedScalePerformance|ToleratedFixture|MigrationScalePerformance)Tests' \ 			|| exit $$?; \ 	done 

diff --git a/Packages/AsterismCore/Sources/AsterismCore/AsterismSchemaV3.swift b/Packages/AsterismCore/Sources/AsterismCore/AsterismSchemaV3.swiftindex 3cef15b..9b298b5 100644--- a/Packages/AsterismCore/Sources/AsterismCore/AsterismSchemaV3.swift+++ b/Packages/AsterismCore/Sources/AsterismCore/AsterismSchemaV3.swift@@ -13,6 +13,17 @@ import SwiftData /// ("Entry", "Site", …) as the live V4 classes without a top-level collision: the /// only top-level references are typealiases (Decision 6). `buildSidecar` reads /// the M3 interpretation + trim off these frozen classes before conversion.+///+/// # Frozen *by reference*, not only by file+///+/// The nesting freezes the class bodies; it does **not** freeze the value types+/// they store. `URLIdentityRule`, `JunkSuffixRule`, `WorkTitleTrimRule`,+/// `SegmentRangeSpec` and `SegmentPositionSpec` are live top-level types in+/// `ValueObjects.swift`, shared with the V4 snapshot and the live V5 classes.+/// Editing the stored shape of any of them silently redefines this frozen+/// schema, and per Q20 a redefined frozen schema makes a store recorded at that+/// version refuse to open (134504). A stored-shape change to any of them+/// therefore needs new versioned copies nested here, not an edit in place. public enum AsterismSchemaV3: VersionedSchema {     public static let versionIdentifier = Schema.Version(3, 0, 0) 

diff --git a/Packages/AsterismCore/Sources/AsterismCore/AsterismSchemaV4.swift b/Packages/AsterismCore/Sources/AsterismCore/AsterismSchemaV4.swiftindex 1f82b3a..733a174 100644--- a/Packages/AsterismCore/Sources/AsterismCore/AsterismSchemaV4.swift+++ b/Packages/AsterismCore/Sources/AsterismCore/AsterismSchemaV4.swift@@ -1,17 +1,37 @@ import Foundation import SwiftData -/// The M4 runtime schema (Decision 6) — the schema the app and the share-/// extension actually open.+/// The frozen M4 schema (Decision 6, Q20). Its model classes are immutable+/// snapshots of the M4 shape: `Site` has already lost `titleInterpretationRaw`+/// and `workTitleTrimRule`, and no relational reference exists yet — `Entry` and+/// `Work` name their Site only by string. ///-/// The live model classes are V4's: `Site` no longer carries-/// `titleInterpretationRaw` or `workTitleTrimRule`, and every reader resolves-/// naming and trims from the Site's active title rule instead. The pre-M4 shape-/// survives only as the frozen nested snapshots in `AsterismSchemaV3`, which-/// exist to give the migration plan a `from` version. Freezing V3 and dropping-/// the two columns landed together (Decision 6): the freeze is not implementable-/// while the live classes are still V3's, and the drop is inseparable from-/// rewriting the readers of those columns.+/// V4 is frozen because *any* edit to its body makes a V4-recorded store refuse+/// to open: `addPersistentStore` fails with `NSCocoaErrorDomain` 134504,+/// "Cannot use staged migration with an unknown model version" (Q20, probed).+/// The live classes therefore moved to `AsterismSchemaV5`, and this declaration+/// exists only to give the migration plan a `from` version for stores recorded+/// at 4.0.0.+///+/// The classes are nested here so they can carry the same SwiftData entity names+/// ("Entry", "Site", …) as the live V5 classes without a top-level collision: the+/// only top-level references are typealiases (Decision 6). Nothing reads a+/// V4-shaped object at runtime — unlike the V3 snapshot, whose dropped columns+/// `buildSidecar` still reads — so these carry stored columns only.+///+/// # These snapshots are frozen *by reference*, not only by file+///+/// The nesting freezes the class bodies; it does **not** freeze the value types+/// they store. `SegmentRangeSpec`, `SegmentPositionSpec`, `URLIdentityRule` and+/// `JunkSuffixRule` are live top-level types in `ValueObjects.swift`, shared with+/// the V3 snapshot and with the live V5 classes. Editing any of them changes the+/// stored shape of this frozen schema silently — and per Q20 that is exactly what+/// makes a recorded store refuse to open (134504).+///+/// So: **any change to the stored shape of those four types requires new+/// versioned copies of them**, nested beside these classes and repointed here,+/// rather than an edit in place. Adding a computed member or a method to them is+/// safe; adding, removing or retyping a stored property is not. public enum AsterismSchemaV4: VersionedSchema {     public static let versionIdentifier = Schema.Version(4, 0, 0) @@ -20,23 +40,119 @@ public enum AsterismSchemaV4: VersionedSchema {     } } -/// `[V3, V4]` migration plan. The V3 → V4 schema change is lightweight — the-/// M4-additive `Entry`/`TitlePattern` columns are nullable/defaulted, so-/// SwiftData adds them automatically for a real pre-M4 store, and declaring the-/// path lets a V3-recorded store open under the V4 schema.-///-/// The Work-only → whole-title-rule data transformation and the durable-sidecar-/// crash-safety (Decision 3) are **not** carried by a SwiftData custom stage: a-/// custom stage does not fire between structurally shared schemas, and it would-/// also run inside the share extension (which must never migrate — Req 5.4). The-/// bootstrap (`openV4ForApp`) instead writes the sidecar and runs the completion-/// pass itself, app-only, under the exclusive lock. See `V4Migration`.-public enum AsterismV4MigrationPlan: SchemaMigrationPlan {-    public static var schemas: [any VersionedSchema.Type] {-        [AsterismSchemaV3.self, AsterismSchemaV4.self]+extension AsterismSchemaV4 {+    @Model+    public final class Entry {+        public var id: UUID = UUID()+        public var captureTitle: String = ""+        public var captureTitleSourceRaw: String = CaptureTitleSource.manual.rawValue+        public var rawURLString: String = ""+        public var canonicalURLString: String?+        public var hostname: String = ""+        public var entryIdentityKey: String = ""+        public var identityKeyVersion: Int = 1+        public var conservativeIdentityKey: String = ""+        public var identityBasisRaw: String = EntryIdentityBasis.conservative.rawValue+        public var identityURLRuleID: UUID?+        public var identityURLRuleVersion: Int?+        public var identityNameTitleRuleID: UUID?+        public var identityNameTitleRuleVersion: Int?+        public var urlWorkIdentity: String?+        public var urlWorkRuleID: UUID?+        public var urlWorkRuleVersion: Int?+        public var chapterSequence: String?+        public var chapterSequenceRuleID: UUID?+        public var chapterSequenceRuleVersion: Int?+        public var chapterTitle: String?+        public var chapterTitleProvenanceRaw: String = FieldProvenanceKind.none.rawValue+        public var chapterPatternID: UUID?+        public var chapterPatternVersion: Int?+        public var note: String = ""+        public var ratingRaw: String?+        public var firstCapturedAt: Date = Date(timeIntervalSince1970: 0)+        public var lastSharedAt: Date = Date(timeIntervalSince1970: 0)+        public var modifiedAt: Date = Date(timeIntervalSince1970: 0)+        public var work: Work?+        public var workAssignmentProvenanceRaw: String = FieldProvenanceKind.none.rawValue+        public var workPatternID: UUID?+        public var workPatternVersion: Int?+        public var workURLRuleID: UUID?+        public var workURLRuleVersion: Int?+        public var workURLAssignmentKindRaw: String?+        public var intentionallyUnattached: Bool = false++        public init() {}+    }++    @Model+    public final class Work {+        public var id: UUID = UUID()+        public var displayTitle: String = ""+        public var lastParsedTitle: String?+        public var siteHostname: String = ""+        public var urlIdentity: String?+        public var urlIdentityStateRaw: String = WorkURLIdentityState.none.rawValue+        public var urlIdentityRuleID: UUID?+        public var urlIdentityRuleVersion: Int?+        public var workURLString: String?+        public var genericNotes: String = ""+        public var typeRaw: String = WorkType.other.rawValue+        public var genreTags: [String] = []+        public var titleProvenanceRaw: String = TitleProvenance.manual.rawValue+        public var createdAt: Date = Date(timeIntervalSince1970: 0)+        public var modifiedAt: Date = Date(timeIntervalSince1970: 0)+        @Relationship(deleteRule: .nullify, inverse: \Entry.work)+        public var entries: [Entry]?++        public init() {}+    }++    @Model+    public final class Site {+        public var hostname: String = ""+        public var displayName: String = ""+        public var modeRaw: String = SiteMode.untaught.rawValue+        @Relationship(deleteRule: .cascade, inverse: \TitlePattern.site)+        public var patterns: [TitlePattern]?+        @Relationship(deleteRule: .cascade, inverse: \URLRulePattern.site)+        public var urlRules: [URLRulePattern]?+        public var urlIdentityRule: URLIdentityRule?+        public var junkSuffixRule: JunkSuffixRule?++        public init() {}     } -    public static var stages: [MigrationStage] {-        [.lightweight(fromVersion: AsterismSchemaV3.self, toVersion: AsterismSchemaV4.self)]+    @Model+    public final class TitlePattern {+        public var id: UUID = UUID()+        public var version: Int = 1+        public var isActive: Bool = false+        public var createdAt: Date = Date(timeIntervalSince1970: 0)+        public var formRaw: String = PatternForm.segment.rawValue+        public var segmentWorkAnchor: SegmentRangeSpec?+        public var segmentIgnoredAnchors: [SegmentPositionSpec]?+        public var phrasePrefix: String?+        public var phraseSeparator: String?+        public var phraseSuffix: String?+        public var fieldOrderRaw: String?+        public var trimPrefix: String?+        public var trimSuffix: String?+        public var chapterless: Bool = false+        public var site: Site?++        public init() {}+    }++    @Model+    public final class URLRulePattern {+        public var id: UUID = UUID()+        public var version: Int = 1+        public var isCurrent: Bool = false+        public var createdAt: Date = Date(timeIntervalSince1970: 0)+        public var originRaw: String = URLRuleOrigin.readerTaught.rawValue+        public var definitionData: Data = Data()+        public var site: Site?++        public init() {}     } }

diff --git a/Packages/AsterismCore/Sources/AsterismCore/AsterismSchemaV5.swift b/Packages/AsterismCore/Sources/AsterismCore/AsterismSchemaV5.swiftnew file mode 100644index 0000000..d61d4ce--- /dev/null+++ b/Packages/AsterismCore/Sources/AsterismCore/AsterismSchemaV5.swift@@ -0,0 +1,54 @@+import Foundation+import SwiftData++/// The M4a runtime schema — the schema the app and the share extension actually+/// open. Its body is `Models.swift`, which opens `extension AsterismSchemaV5`.+///+/// V5 adds the two relational references this milestone exists for:+/// `Entry.site` and `Work.site`, both optional, with the `.nullify` inverses+/// `Site.entries` and `Site.works`. The hostname strings stay beside them as+/// capture-time evidence (Q3). Nothing is removed, so the V4 → V5 change is+/// lightweight.+///+/// The inverses are `internal` while `Site` is `public` (Q17): CloudKit requires+/// every relationship to have one, but traversing `Site.entries` faults every+/// Entry for a hostname, which the Req 5.1 budgets would pay for. There is+/// deliberately no `entryValues` / `workValues` accessor beside `patternValues`+/// / `urlRuleValues`.+public enum AsterismSchemaV5: VersionedSchema {+    public static let versionIdentifier = Schema.Version(5, 0, 0)++    public static var models: [any PersistentModel.Type] {+        [Entry.self, Work.self, Site.self, TitlePattern.self, URLRulePattern.self]+    }+}++/// `[V3, V4, V5]` migration plan, replacing `AsterismV4MigrationPlan`. Both+/// stages are lightweight: V3 → V4 adds the M4-additive columns and drops the+/// two Site columns, V4 → V5 adds the two relationships and their inverses. A+/// V3-recorded store traverses both stages in a single open (Q22).+///+/// Both stages are needed and both must be structurally real. Freezing V4 with a+/// V5 that is a verbatim copy of it aborts the process on the first real+/// migration with `NSInvalidArgumentException`, "Duplicate version checksums+/// detected."; dropping the V4 → V5 stage instead fails the open with+/// `NSCocoaErrorDomain` 134504, "Cannot use staged migration with an unknown+/// coordinator model version." The relationships are what make V5 distinct, so+/// the freeze and the relationships ship together (Q22).+///+/// The data pass that populates the relationships is **not** a SwiftData custom+/// stage: a custom stage would also run inside the share extension, which must+/// never migrate (Req 2.3). The app bootstrap runs it under the exclusive lock,+/// as V4's completion pass already does. See `V4Migration`.+public enum AsterismV5MigrationPlan: SchemaMigrationPlan {+    public static var schemas: [any VersionedSchema.Type] {+        [AsterismSchemaV3.self, AsterismSchemaV4.self, AsterismSchemaV5.self]+    }++    public static var stages: [MigrationStage] {+        [+            .lightweight(fromVersion: AsterismSchemaV3.self, toVersion: AsterismSchemaV4.self),+            .lightweight(fromVersion: AsterismSchemaV4.self, toVersion: AsterismSchemaV5.self),+        ]+    }+}

diff --git a/Packages/AsterismCore/Sources/AsterismCore/CitedRuleResolution.swift b/Packages/AsterismCore/Sources/AsterismCore/CitedRuleResolution.swiftdeleted file mode 100644index 4f064cd..0000000--- a/Packages/AsterismCore/Sources/AsterismCore/CitedRuleResolution.swift+++ /dev/null@@ -1,72 +0,0 @@-import Foundation-import SwiftData--// Decision 9, and the half of it that is easy to lose.-//-// A hostname carrying more than one Site row has **two** resolution rules, and-// which one applies depends on what the caller is asking:-//-// - **Applying rules to a new capture** — which title rule parses this title,-//   which URL rule derives this identity — uses the winning row only. Two rows-//   can own conflicting *current* rules, the ambiguity is genuine, and-//   `SiteResolutionOrder` picking one is the honest resolution. That side lives-//   in `IdentityResolution.swift`.-//-// - **Resolving a pattern or rule id a record already cites** — provenance-//   replay in the validator, Entry detail disclosure, Recent's candidate-//   replay, `titlePattern(id:)` — searches the **union** of every Site row for-//   the hostname. There is no ambiguity to resolve: exactly one record carries-//   that id, and which row happens to own it says nothing about the Entry's-//   provenance. This file is that side.-//-// **Do not collapse these into one rule.** It is the obvious simplification and-// it reintroduces a bug the design already paid for. The winner is-// *content-dependent* — measurement showed a teaching commit on either row-// flipping it immediately — so a winner-only cited lookup makes an Entry's-// replay resolve, then fail, then resolve again as unrelated teaching lands,-// with no diagnosis that could explain it. A union is order-independent by-// construction, so it is *more* deterministic than the winner-only form, not-// less. See Decision 9, Req 2.6, and Q18 (which narrowed Req 2.2 because of it).-//-// Cost: this is a read-path concern only. Every entry point below is O(1) or-// short-circuits for a single row before touching a relationship, so neither-// capture nor extension open pays for it (Decision 10).--/// Resolves rule ids that a record **already cites**, across every Site row for-/// the hostname. The counterpart to `SiteResolutionOrder`, which answers the-/// other question — see the file comment before merging them.-public enum CitedRuleResolution {--    /// Whether a cited `TitlePattern` resolves for a record on `hostname`: true-    /// when **any** Site row for that hostname owns it.-    ///-    /// Replaces the winner-only `pattern.site === site` identity test. For a-    /// hostname with one row the two are equivalent; for a duplicated hostname-    /// only this form survives a winner flip.-    public static func resolves(_ pattern: TitlePattern, forRecordsOn hostname: String) -> Bool {-        pattern.site?.hostname == hostname-    }--    /// Whether a cited `URLRulePattern` resolves for a record on `hostname`.-    /// Same rule, same reason.-    public static func resolves(_ rule: URLRulePattern, forRecordsOn hostname: String) -> Bool {-        rule.site?.hostname == hostname-    }--    /// Every title pattern retained by any of `rows`, which are the Site rows for-    /// one hostname, winner first. Callers replaying an Entry's cited pattern-    /// search this rather than the winner's own `patternValues`.-    ///-    /// Returns the single row's own array untouched when there is nothing to-    /// union, so the ordinary library allocates nothing extra.-    public static func retainedPatterns(across rows: [Site]) -> [TitlePattern] {-        guard rows.count > 1 else { return rows.first?.patternValues ?? [] }-        return rows.flatMap(\.patternValues)-    }--    /// Every URL rule retained by any of `rows`. Same shape, same fast path.-    public static func retainedURLRules(across rows: [Site]) -> [URLRulePattern] {-        guard rows.count > 1 else { return rows.first?.urlRuleValues ?? [] }-        return rows.flatMap(\.urlRuleValues)-    }-}

diff --git a/Packages/AsterismCore/Sources/AsterismCore/IdentityResolution.swift b/Packages/AsterismCore/Sources/AsterismCore/IdentityResolution.swiftindex 3d92a00..ac359e0 100644--- a/Packages/AsterismCore/Sources/AsterismCore/IdentityResolution.swift+++ b/Packages/AsterismCore/Sources/AsterismCore/IdentityResolution.swift@@ -19,12 +19,17 @@ import SwiftData  /// Orders the Site rows sharing one hostname, winner first. ///-/// **This answers one of two questions, not both** (Decision 9). The winner is-/// what *applying rules to a new capture* uses, where two rows can own-/// conflicting current rules and the ambiguity is genuine. Resolving a pattern-/// or rule id a record **already cites** must not come through here: see-/// `CitedRuleResolution`, which searches the union of the rows instead, and the-/// file comment there for why merging the two reintroduces a bug.+/// **This answers one of two questions, not both** — Decision 9 of+/// `specs/library-integrity-tolerance`, as amended by Decision 5 of+/// `specs/relational-references`. The winner is what *presentation* and+/// *applying rules to a new capture* use: which teaching governs this hostname+/// today, where two rows can own conflicting current rules and the ambiguity is+/// genuine (Req 3.1, 3.3). Resolving a pattern or rule id a record **already+/// cites** must not come through here: it resolves among the rules the citing+/// record's own Site relationship owns (Req 3.2). The winner is+/// *content-dependent* — a teaching commit on either row flips it — so routing a+/// cited lookup through it made an Entry's provenance replay resolve, then fail,+/// then resolve again as unrelated teaching landed. public enum SiteResolutionOrder {      /// Total order, stable across processes and relaunches for one store file.@@ -35,6 +40,21 @@ public enum SiteResolutionOrder {         return sites.map(SiteOrderKey.init).sorted(by: precedes).map(\.site)     } +    /// The winning row for every hostname present in `sites`, keyed by hostname.+    ///+    /// The shape every whole-store pass needs: the migration passes resolve each+    /// record's hostname through it, and Recent presents each hostname through+    /// it. One helper so a second one cannot drift into a different winner rule+    /// — the `sitesByHost[hostname] = site` last-write-wins map the V4 pass once+    /// built is exactly what Q16 removed.+    public static func winnersByHostname(_ sites: [Site]) -> [String: Site] {+        var winners: [String: Site] = [:]+        for (hostname, rows) in Dictionary(grouping: sites, by: \.hostname) {+            winners[hostname] = sorted(rows).first+        }+        return winners+    }+     /// The comparator behind `sorted`, exposed for the order-algebra tests.     /// Recomputes both rows' keys, so `sorted` uses the memoised form instead.     internal static func precedes(_ lhs: Site, _ rhs: Site) -> Bool {

diff --git a/Packages/AsterismCore/Sources/AsterismCore/LibraryProviding.swift b/Packages/AsterismCore/Sources/AsterismCore/LibraryProviding.swiftindex 593a662..3088f17 100644--- a/Packages/AsterismCore/Sources/AsterismCore/LibraryProviding.swift+++ b/Packages/AsterismCore/Sources/AsterismCore/LibraryProviding.swift@@ -10,7 +10,6 @@ public protocol LibraryProviding: Sendable {     func entry(id: UUID) async throws -> EntrySnapshot     func work(id: UUID) async throws -> WorkSnapshot     func workDestinations(for entryID: UUID) async throws -> [WorkSnapshot]-    func titlePattern(id: UUID) async throws -> TitlePatternSnapshot      /// Coherent entry teaching detail: site mode, pattern summaries, settlements,     /// available actions, and unresolved replay. Built in one locked context.

diff --git a/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+BackupImport.swift b/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+BackupImport.swiftindex 29f3c01..a4f0068 100644--- a/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+BackupImport.swift+++ b/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+BackupImport.swift@@ -165,7 +165,7 @@ extension LibraryRepository {             return .stale(reason: "expected ready store for replacement, but state changed")         } -        try validateV4MarkerContent(at: configuration.v4MarkerURL)+        try validateMarkerContentForApp(at: configuration.v4MarkerURL)          let container: ModelContainer         do {

diff --git a/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+BackupImportV4.swift b/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+BackupImportV4.swiftindex bf6a461..8563c11 100644--- a/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+BackupImportV4.swift+++ b/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+BackupImportV4.swift@@ -15,7 +15,10 @@ extension LibraryRepository {     static func validateImportPlanPayloadV4(         _ payload: BackupV4Payload     ) throws -> LibraryRecordCounts {-        let schema = Schema(versionedSchema: AsterismSchemaV4.self)+        // The live schema, not the frozen `AsterismSchemaV4`: `materializeV4Payload`+        // inserts live classes, and after the V4 freeze those are different+        // entities from V4's snapshots (Q20).+        let schema = Schema(versionedSchema: AsterismSchemaV5.self)         let configuration = ModelConfiguration(             schema: schema,             isStoredInMemoryOnly: true,@@ -100,6 +103,13 @@ extension LibraryRepository {             work.titleProvenanceRaw = record.titleProvenance.rawValue             work.modifiedAt = record.modifiedAt             context.insert(work)+            // Req 2.5: an archive references its Site by hostname, so the+            // relationship is derived from exactly that — the same map the+            // rules above are wired from. Nothing republishes the readiness+            // marker after an import, so the relationship pass never runs over+            // what this writes; if it were left nil here it would stay nil+            // forever (Decision 2).+            work.site = sitesByHostname[record.siteHostname]             worksByID[record.id] = work         } @@ -144,6 +154,7 @@ extension LibraryRepository {             entry.workURLAssignmentKindRaw = record.workURLAssignmentKind?.rawValue             entry.intentionallyUnattached = record.intentionallyUnattached             context.insert(entry)+            entry.site = sitesByHostname[record.hostname]         }     } }

diff --git a/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+ComposedTeaching.swift b/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+ComposedTeaching.swiftindex ec3aa9e..e92f079 100644--- a/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+ComposedTeaching.swift+++ b/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+ComposedTeaching.swift@@ -170,7 +170,7 @@ extension LibraryRepository {              // 6. Apply the composed outcome to Entries and Works.             try Self.applyComposedOutcome(-                context: context, hostname: hostname, outcome: currentOutcome,+                context: context, hostname: hostname, site: site, outcome: currentOutcome,                 titleRuleID: titleRuleID, titleVersion: titleVersion,                 titleDefinition: contract.request.titleDefinition,                 titleTrimPrefix: Self.nonEmpty(contract.request.trimPrefix),@@ -305,7 +305,7 @@ extension LibraryRepository {             }              try Self.applyComposedOutcome(-                context: context, hostname: hostname, outcome: currentOutcome,+                context: context, hostname: hostname, site: site, outcome: currentOutcome,                 titleRuleID: activePattern.id, titleVersion: activePattern.version,                 titleDefinition: contract.request.titleDefinition,                 titleTrimPrefix: Self.nonEmpty(contract.request.trimPrefix),@@ -477,8 +477,13 @@ extension LibraryRepository {     /// Writes the composed outcome to the live Entries and Works: identity keys,     /// sequences, chapter titles, provenance, Work-identity dispositions, and     /// prospective-Work creation. Shared by composed teaching and recalculation.+    /// `site` is the row every Work this call creates points at (Req 1.4): the+    /// caller's own row, resolved once under the lock it already holds, so a+    /// composed commit and the relationship pass cannot disagree about a+    /// duplicated hostname and no second lookup can drift from the first.     static func applyComposedOutcome(-        context: ModelContext, hostname: String, outcome: ComposedTeachingOutcome,+        context: ModelContext, hostname: String, site: Site,+        outcome: ComposedTeachingOutcome,         titleRuleID: UUID, titleVersion: Int, titleDefinition: PatternDefinition,         titleTrimPrefix: String?, titleTrimSuffix: String?,         url: (id: UUID, version: Int, definition: URLRuleDefinition)?, timestamp: Date@@ -498,6 +503,7 @@ extension LibraryRepository {         var createdByKey: [ProspectiveWorkKey: Work] = [:]         for intent in outcome.prospectiveWorks {             let work = Work(displayTitle: intent.displayTitle.value, siteHostname: hostname, timestamp: timestamp)+            work.site = site             work.lastParsedTitle = intent.lastParsedTitle.value             work.titleProvenanceRaw = TitleProvenance.parsed.rawValue             if case .urlIdentity(let identity) = intent.key, let url {

diff --git a/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+Contracts.swift b/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+Contracts.swiftindex 7e2f6a8..6fd9f6a 100644--- a/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+Contracts.swift+++ b/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+Contracts.swift@@ -324,6 +324,9 @@ extension LibraryRepository {                 work.lastParsedTitle = title                 work.titleProvenanceRaw = TitleProvenance.parsed.rawValue                 context.insert(work)+                // Both halves in the same save (Req 1.4); `site` is this+                // commit's `fetchSites().first`.+                work.site = site                 createdWorks[title] = work             } 

diff --git a/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+EntryDetail.swift b/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+EntryDetail.swiftindex bea8d2f..98d03c4 100644--- a/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+EntryDetail.swift+++ b/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+EntryDetail.swift@@ -16,12 +16,19 @@ extension LibraryRepository {             let entrySnap = try Self.snapshot(entry)             let hostname = entrySnap.hostname -            // Req 2.1: this guard asserted `sites.count == 1` and threw in **two**-            // tolerated states — more than one row, and none — failing the whole-            // detail screen for either. Both now resolve: `fetchSites` returns the-            // rows in `SiteResolutionOrder` with the winner first, and a hostname-            // with no row is simply an untaught hostname (Q12), which is a state-            // every path already handles.+            // **Presentation follows the hostname winner; provenance follows the+            // relationship** (Decision 5 of `specs/relational-references`).+            // Which mode this hostname is in, what it currently teaches, and+            // which actions it offers are hostname-level questions — teaching+            // refuses a duplicated hostname at every entry point, so "what does+            // this hostname's teaching say" has one answer per hostname, and it+            // must be the same answer Recent gives for the same Entry. The+            // citation replay below is the record-level half and follows+            // `entry.site` instead.+            //+            // `fetchSites` returns the rows in `SiteResolutionOrder` with the+            // winner first, and a hostname with no row is simply an untaught+            // hostname (Q12), which is a state every path already handles.             let sites = try Self.fetchSites(hostname: hostname, context: context)             let site = sites.first             let siteMode: SiteMode@@ -37,13 +44,15 @@ extension LibraryRepository {                 siteMode = .untaught             } -            // Two searches, deliberately (Decision 9). `allPatterns` is the-            // winning row's own tuple: what it currently teaches, and what the-            // summaries below disclose. `citedPatterns` is the union across-            // every row for the hostname, and is what a provenance replay of an-            // id the Entry already recorded searches — see the replay below.+            // Two searches, deliberately (Decision 5). `allPatterns` is the+            // winning row's own tuple: what the hostname currently teaches, and+            // what the summaries below disclose. What a provenance replay of an+            // id the Entry already recorded searches is what the Entry's *own*+            // Site retains (Req 3.2) — see the replay below, which faults that+            // relationship only when there is a citation to replay. A fixed+            // pointer, so the replay cannot change as unrelated teaching flips+            // the winner.             let allPatterns = site?.patternValues ?? []-            let citedPatterns = CitedRuleResolution.retainedPatterns(across: sites)             let activePatterns = allPatterns.filter(\.isActive)             let isWorkOnly = site?.isWorkOnlyTitleRule ?? false             switch siteMode {@@ -107,7 +116,7 @@ extension LibraryRepository {                 hasValue: entrySnap.chapterTitle != nil             ) -            let assignmentSettlement = Self.buildFieldSettlement(+            let baseAssignmentSettlement = Self.buildFieldSettlement(                 provenance: entrySnap.workAssignmentProvenance,                 fieldName: "assignment",                 hasValue: entrySnap.workID != nil,@@ -142,46 +151,39 @@ extension LibraryRepository {                 : Self.computeAvailableActions(siteMode: siteMode, isWorkOnly: isWorkOnly)              // An unresolved assignment is replayed with the exact retained pattern-            // referenced by assignment provenance, never whichever pattern is active now.-            // The id is one the Entry already cites, so the search is the union-            // of the hostname's Site rows and not the winner's own patterns-            // (Decision 9) — otherwise this replay would start failing the-            // moment a teaching commit elsewhere flipped which row wins.+            // referenced by assignment provenance, never whichever pattern is+            // active now. The id is one the Entry already cites, so the search+            // is the Entry's own Site's retained patterns (Req 3.2) — a fixed+            // pointer, so this replay cannot start failing the moment a teaching+            // commit elsewhere flips which row wins the hostname.             //-            // The two throws below are NOT caught locally — they propagate out and-            // fail the whole detail screen. Unreachable for the three tolerated-            // states (this branch requires a resolved Site, and the union covers-            // every row for the hostname), so it holds today. It is a sharp edge-            // for whoever widens that set: this call site does not look like it-            // needs attention when the set grows, and it does. The same applies to-            // `replayRecentCandidate` in `+RecentPresentation.swift`.-            let unresolvedCandidateTitle: String?-            if !sites.isEmpty,-               entrySnap.workID == nil,-               entrySnap.workAssignmentProvenance.kind == .pattern,-               !entrySnap.intentionallyUnattached {-                guard let patternID = entrySnap.workAssignmentProvenance.patternID,-                      let patternVersion = entrySnap.workAssignmentProvenance.patternVersion,-                      let producingPattern = citedPatterns.first(where: {-                          $0.id == patternID && $0.version == patternVersion-                      }) else {-                    throw LibraryRepositoryError.corruptLibrary(-                        operation: "entry teaching detail replay",-                        reason: "Unresolved assignment references a missing retained pattern"-                    )-                }-                let parseResult = TitlePatternApplicator.apply(definition: try producingPattern.definition, to: entrySnap.captureTitle)-                switch parseResult {-                case .success(let parsed):-                    unresolvedCandidateTitle = parsed.workTitle-                case .failure(let error):-                    throw LibraryRepositoryError.corruptLibrary(-                        operation: "entry teaching detail replay",-                        reason: "Retained assignment pattern cannot reproduce its candidate title: \(error)"-                    )-                }+            // **Both arms of this replay used to throw, and neither throw was+            // caught locally — they propagated out and failed the whole detail+            // screen.** Resolution follows `entry.site`, so a nil relationship+            // reaches the failure branches on the first hydration. An+            // unresolvable citation is therefore disclosed rather than thrown+            // (Q13, Req 3.4), in the vocabulary this screen already uses for a+            // degraded field: the assignment settlement says the citation does+            // not resolve, and keeps the cited `(id, version)` visible as+            // evidence (Req 4.2). Recent renders the same replay as a marked+            // row, from this same helper — which is also where the rule that an+            // Entry with no Site relationship has nothing to replay against, and+            // so is not applicable rather than unresolvable, now lives.+            let replay = Self.replayCitedPattern(+                for: entrySnap, citingSite: { entry.site })+            let assignmentSettlement: FieldSettlement+            if replay == .unresolvable,+               let patternID = entrySnap.workAssignmentProvenance.patternID,+               let patternVersion = entrySnap.workAssignmentProvenance.patternVersion {+                assignmentSettlement = .patternUnsettled(+                    patternID: patternID,+                    version: patternVersion,+                    reason: "Cited title pattern does not resolve")             } else {-                unresolvedCandidateTitle = nil+                // Includes the citation that carries no identity at all:+                // `buildFieldSettlement` already names that as corrupt, and+                // repeating it here would be a worse description of the same fact.+                assignmentSettlement = baseAssignmentSettlement             }              return EntryTeachingDetail(@@ -192,7 +194,7 @@ extension LibraryRepository {                 chapterSettlement: chapterSettlement,                 assignmentSettlement: assignmentSettlement,                 availableActions: availableActions,-                unresolvedCandidateTitle: unresolvedCandidateTitle,+                unresolvedCandidateTitle: replay.candidateTitle,                 // With no Site row there is no cleaning or trimming to apply, so                 // the immutable capture title is the presentation title.                 displayTitle: site.map {

diff --git a/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+RecentPresentation.swift b/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+RecentPresentation.swiftindex 80bf8fa..54c22e6 100644--- a/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+RecentPresentation.swift+++ b/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+RecentPresentation.swift@@ -26,27 +26,39 @@ extension LibraryRepository {             recentPerformanceSignposter.endInterval("RecentPublication", signpostState)         }         return try await withLockedContext(mode: .shared, operation: "building Recent presentation") { context in-            let entries = try context.fetch(FetchDescriptor<Entry>()).map(Self.snapshot)+            // The records travel with their snapshots because a candidate replay+            // resolves a pattern id the Entry already cites among the rules the+            // Entry's *own* Site owns (Req 3.2) — `entry.site`, a relationship+            // the snapshot deliberately does not carry.+            let entries = try context.fetch(FetchDescriptor<Entry>())+                .map { (snapshot: try Self.snapshot($0), record: $0) }             let works = try context.fetch(FetchDescriptor<Work>())             let sites = try context.fetch(FetchDescriptor<Site>())              let workTitles = Self.recentWorkTitles(works)-            // Decision 9: `sitesByHostname` resolves the row whose *current*-            // teaching drives the row's mode and presentation, while a candidate-            // replay resolves a pattern id the Entry already cites — which any-            // row for the hostname may own. Two questions, one grouping, both-            // computed once for the whole publication rather than per Entry.-            let siteRowsByHostname = Self.recentSiteRowsByHostname(sites)-            let sitesByHostname = siteRowsByHostname.compactMapValues {-                SiteResolutionOrder.sorted($0).first-            }-            let citedPatternsByHostname = siteRowsByHostname.mapValues(-                CitedRuleResolution.retainedPatterns(across:))+            // `sitesByHostname` resolves the row whose *current* teaching drives+            // the row's mode and presentation — a genuine winner-selection+            // question, since the Entry may point at a different row than the+            // one whose teaching presents the hostname today.+            //+            // **Presentation follows the hostname winner; provenance follows the+            // relationship** (Decision 5 of `specs/relational-references`). This+            // is the presentation half, and Entry detail resolves it the same+            // way, so the two screens cannot disagree about the same Entry. The+            // provenance half is `replayCitedPattern` below, which searches+            // `entry.site`'s own patterns. Converting this to a per-Entry+            // `record.site` read would also charge 5,000 to-one faults to a path+            // on a 2 s budget (Req 5.1).+            // More than one row for a hostname is one of the three tolerated+            // states, so this resolves a winner rather than throwing.+            let sitesByHostname = SiteResolutionOrder.winnersByHostname(sites)             // `compactMapValues` drops the hostnames whose winning row retains an             // illegal tuple, so a missing mode and a missing row look the same             // here and are told apart by `sitesByHostname` below.             let siteModesByHostname = sitesByHostname.compactMapValues(Self.validatedRecentSiteMode)-            let sortedEntries = entries.sorted(by: Self.recentEntryOrder)+            let sortedEntries = entries.sorted {+                Self.recentEntryOrder($0.snapshot, $1.snapshot)+            }             // Req 3.4, read from the same list `requireNoDuplicateSiteRows` reads             // rather than from the fetched rows, so the rows that offer an action             // and the commit that accepts one cannot disagree about which@@ -58,7 +70,7 @@ extension LibraryRepository {             var rowsByDay: [(day: Date, rows: [RecentPresentationRow])] = []             var actionableCount = 0 -            for entry in sortedEntries {+            for (entry, record) in sortedEntries {                 // Req 2.1 and 2.2: a row that cannot be resolved is still emitted,                 // identified by its capture title and marked with what is wrong.                 // Each of these three used to throw and take the whole publication@@ -69,14 +81,16 @@ extension LibraryRepository {                 let missingWork = entry.workID != nil && workDisplayTitle == nil                 let isDuplicatedHostname = duplicatedHostnames.contains(entry.hostname) -                // One row, one cause. The Site causes rank first because they also-                // explain why the row carries no mode and therefore no action.+                // One row, one cause — the Site-shaped half of it, since the fifth+                // cause is only known once the citation has been replayed below.+                // These rank first because they also explain why the row carries+                // no mode and therefore no action.                 // Duplication outranks an illegal tuple, inverting Q24's order for                 // the quarantine payload: there the tuple reason wins because it is                 // the actionable one, but on a duplicated hostname re-teaching is                 // refused, so naming the tuple would promise a repair that is not                 // available.-                let attention: RecentRowAttention? =+                let siteAttention: RecentRowAttention? =                     if site == nil { .siteMissing }                     else if isDuplicatedHostname { .siteDuplicated }                     else if mode == nil { .siteRulesInvalid }@@ -102,7 +116,7 @@ extension LibraryRepository {                     && (mode.map { Self.isRecentEntryActionable(entry, siteMode: $0) } ?? false)                 let actionType: RecentRowActionType                 let displayCaptureTitle: String-                let unresolvedCandidateTitle: String?+                let replay: CitationReplay                 if let site, let mode {                     // Whole-title (Work-only) Sites are re-taught through the                     // composed surface, not the Recent inline re-teach pill.@@ -117,10 +131,7 @@ extension LibraryRepository {                         siteMode: mode,                         site: site                     )-                    unresolvedCandidateTitle = try Self.replayRecentCandidate(-                        for: entry,-                        retainedPatterns: citedPatternsByHostname[entry.hostname] ?? []-                    )+                    replay = Self.replayCitedPattern(for: entry, citingSite: { record.site })                 } else {                     actionType = .none                     // Immutable capture input, so it is always available — which is@@ -128,9 +139,16 @@ extension LibraryRepository {                     // satisfiable for a row nothing else resolves.                     displayCaptureTitle = entry.captureTitle                     // No trustworthy rules to replay the citation against.-                    unresolvedCandidateTitle = nil+                    replay = .notApplicable                 } +                // The Site causes still rank first — they explain why a row+                // carries no mode and therefore no action, which an unresolvable+                // citation does not. The two cannot collide in any case: a replay+                // only happens once a Site and mode resolved, and only for an+                // Entry holding no Work, which is what `.workMissing` requires.+                let attention = siteAttention ?? (replay == .unresolvable ? .citationUnresolved : nil)+                 let row = RecentPresentationRow(                     id: entry.id,                     entry: entry,@@ -139,7 +157,7 @@ extension LibraryRepository {                     workDisplayTitle: workDisplayTitle,                     // Sequence-only chapters present their sequence (Req 8.12).                     chapterTitle: entry.chapterTitle ?? entry.chapterSequence,-                    unresolvedCandidateTitle: unresolvedCandidateTitle,+                    unresolvedCandidateTitle: replay.candidateTitle,                     siteMode: mode,                     isActionable: actionable,                     actionType: actionType,@@ -208,26 +226,6 @@ extension LibraryRepository {         return result     } -    /// Every Site row for each hostname, in fetch order. More than one row for a-    /// hostname is one of the three tolerated states, so this no longer throws.-    ///-    /// The publication asks two different questions of these rows and both are-    /// answered from this one grouping (Decision 9):-    ///-    /// - *Which row wins?* — `SiteResolutionOrder.sorted($0).first`. The winner-    ///   is what the row's mode and presentation are read against.-    /// - *What may a cited id resolve to?* —-    ///   `CitedRuleResolution.retainedPatterns(across:)`, the union across every-    ///   row, since any of them may own a pattern an Entry already cites.-    ///-    /// Collapsing the two onto the winner would make an Entry's candidate replay-    /// depend on which row currently wins.-    private static func recentSiteRowsByHostname(_ sites: [Site]) -> [String: [Site]] {-        var rowsByHostname: [String: [Site]] = [:]-        for site in sites { rowsByHostname[site.hostname, default: []].append(site) }-        return rowsByHostname-    }-     /// The Site's mode when its committed tuple is legal, and **nil when it is     /// not**.     ///@@ -283,56 +281,56 @@ extension LibraryRepository {         )     } -    /// **Still throws, and the throw is not caught locally — it propagates out of-    /// the publication.** That is deliberate and currently safe: for the three-    /// tolerated states of Req 1.1 these branches are unreachable, because the-    /// caller only reaches here once a Site row has resolved, and-    /// `CitedRuleResolution` searches *every* row for the hostname, so a-    /// duplicated Site cannot hide a cited pattern (Decision 9).+    /// Replays the title pattern an Entry already cites, for the unresolved+    /// candidate title Recent and Entry detail both disclose. The search space+    /// is what the Entry's own Site retains — a fixed pointer, so the replay+    /// cannot come and go as unrelated teaching flips the hostname winner+    /// (Req 3.2, 3.5). Id *and* version are tested together (Req 4.2).     ///-    /// It is a sharp edge for whoever widens the tolerated set. Decision 4 closes-    /// that set deliberately, so this holds today — but a fourth incoherent shape-    /// reaching this path would let one bad Entry fail the whole Recent-    /// publication again, which is the failure this milestone existed to remove.-    /// This call site does not look like it needs attention when the set grows.-    /// It does. The same applies to `+EntryDetail.swift`'s citation replay.-    private static func replayRecentCandidate(+    /// **Whether a citation is replayable at all is decided here**, not at the+    /// two call sites. Written twice it drifted: Recent's copy omitted the+    /// nil-Site test, so one Entry whose relationship had not arrived rendered+    /// as a broken citation on Recent and as a healthy one on the detail screen+    /// for the same record. A nil Site yields `.notApplicable` on both — the+    /// consequence Decision 5 states: the evidence is absent, not broken, and+    /// teaching the hostname is the repair.+    ///+    /// **This used to throw `corruptLibrary`, and the throw was not caught+    /// locally — it propagated out of the whole publication and out of the whole+    /// detail screen.** Resolution follows `entry.site`, so a nil relationship+    /// reaches these branches on the first hydration — 2,995 of 3,000 Entries at+    /// the CloudKit probe's peak — and one such Entry would have failed all of+    /// Recent. So the replay reports rather than throws (Q13, Req 3.4).+    ///+    /// `citingSite` is a closure, and the cheap snapshot fields are tested+    /// before it is called, so the relationship is faulted only for the rows+    /// that actually replay a citation and not for every row on screen.+    internal static func replayCitedPattern(         for entry: EntrySnapshot,-        retainedPatterns: [TitlePattern]-    ) throws -> String? {+        citingSite: () -> Site?+    ) -> CitationReplay {         guard entry.workID == nil,               entry.workAssignmentProvenance.kind == .pattern,-              !entry.intentionallyUnattached else {-            return nil+              !entry.intentionallyUnattached,+              let site = citingSite() else {+            return .notApplicable         }         guard let patternID = entry.workAssignmentProvenance.patternID,               let patternVersion = entry.workAssignmentProvenance.patternVersion,-              let pattern = retainedPatterns.first(where: {+              let pattern = site.patternValues.first(where: {                   $0.id == patternID && $0.version == patternVersion-              }) else {-            throw LibraryRepositoryError.corruptLibrary(-                operation: "replaying Recent unresolved assignment",-                reason: "Entry '\(entry.id)' references a missing retained pattern"-            )-        }--        let definition: PatternDefinition-        do {-            definition = try pattern.definition-        } catch {-            throw LibraryRepositoryError.corruptLibrary(-                operation: "replaying Recent unresolved assignment",-                reason: "Entry '\(entry.id)' references an invalid retained pattern: \(error)"-            )+              }),+              let definition = try? pattern.definition else {+            return .unresolvable         }         switch TitlePatternApplicator.apply(definition: definition, to: entry.captureTitle) {         case .success(let result):-            return result.workTitle-        case .failure(let error):-            throw LibraryRepositoryError.corruptLibrary(-                operation: "replaying Recent unresolved assignment",-                reason: "Entry '\(entry.id)' retained pattern cannot reproduce its candidate: \(error)"-            )+            return .replayed(result.workTitle)+        case .failure:+            // A retained pattern that cannot reproduce its own candidate is as+            // unresolvable to the reader as an absent one, and says the same+            // thing: this row's citation no longer explains its title.+            return .unresolvable         }     } 

diff --git a/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+ReparseCapture.swift b/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+ReparseCapture.swiftindex 0fadf04..0f182e0 100644--- a/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+ReparseCapture.swift+++ b/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+ReparseCapture.swift@@ -11,8 +11,12 @@ extension LibraryRepository {             let entry = try Self.fetchEntry(id: entryID, context: context)             let hostname = entry.hostname -            let sites = try Self.fetchSites(hostname: hostname, context: context)-            guard let site = sites.first, site.mode == .taught else {+            // Reached from an existing Entry, so the Site is the Entry's own+            // relationship (Req 3.1, task 16) — the row whose rules produced+            // the Entry's fields, not whichever row currently wins the+            // hostname. A nil relationship reads as an untaught hostname and+            // takes the same refusal it always did.+            guard let site = entry.site, site.mode == .taught else {                 throw LibraryRepositoryError.invalidInput(                     operation: "Re-parse",                     reason: "Site is not in taught mode"@@ -72,8 +76,10 @@ extension LibraryRepository {             let entry = try Self.fetchEntry(id: contract.request.entryID, context: context)             let hostname = entry.hostname -            let sites = try Self.fetchSites(hostname: hostname, context: context)-            guard let site = sites.first, site.mode == .taught else {+            // The Entry's own row again (Req 3.1, task 16), so the commit+            // rebuilds its basis from the same Site the projection read — and+            // the Works it creates land on that row (`work.site = site` below).+            guard let site = entry.site, site.mode == .taught else {                 throw LibraryRepositoryError.invalidInput(                     operation: "Re-parse commit",                     reason: "Site is not in taught mode"@@ -150,6 +156,11 @@ extension LibraryRepository {                     work.lastParsedTitle = title                     work.titleProvenanceRaw = TitleProvenance.parsed.rawValue                     context.insert(work)+                    // Both halves in the same save (Req 1.4). `site` is the+                    // re-parsed Entry's own row, so the Work created for that+                    // Entry cannot land on a different row than the Entry it+                    // serves (the Q44 rule, one path over).+                    work.site = site                     createdWorks[title] = work                 }             }@@ -257,10 +268,15 @@ extension LibraryRepository {             // 5. Equality confirmed — NOW insert Site if absent, then apply.             let timestamp = self.clock.now() -            let existingSites = try Self.fetchSites(hostname: validated.hostname, context: context)-            if existingSites.isEmpty {-                context.insert(Site(hostname: validated.hostname))-            }+            // Hostname lookup, kept deliberately (Req 3.3, task 16): the Entry+            // being captured does not exist yet, so no record identifies a Site+            // — this asks whether the hostname has *any* row before creating+            // one, and takes the winner where it has several. Applying rules to+            // a new capture faces genuine ambiguity when two rows own+            // conflicting current rules, so one winner is the honest answer.+            // The Entry is then *assigned* to that row, so the tuple validation+            // below resolves the ids it was given within the row that owns them.+            let site = try Self.siteForWrite(hostname: validated.hostname, context: context)              let entry = Entry(                 captureTitle: contract.request.captureTitle,@@ -283,18 +299,14 @@ extension LibraryRepository {             // taught Site with no active title rule (transitional M3 Work-only)             // skips rule application (Req 9.4): the Entry saves conservatively.             //-            // Both halves of Decision 9 meet here, and they must not be merged.-            // `siteRows.first` is the winner: applying rules to a new capture-            // faces genuine ambiguity when two rows own conflicting current-            // rules, and one winner is the honest answer. The tuple validation-            // below searches the union of `siteRows` instead, because by then-            // the Entry *cites* the ids it was given.-            let siteRows = try Self.fetchSites(hostname: validated.hostname, context: context)-            let site = siteRows.first+            // Assigned here, before the tuple validation below (Req 1.4), to the+            // row resolved above — the pre-existing winner, or the one this+            // transaction inserted for a hostname that had none.+            entry.site = site             let quarantined = self.quarantineReason(hostname: validated.hostname) != nil-            if let site, site.mode == .articles {+            if site.mode == .articles {                 entry.intentionallyUnattached = true-            } else if let site, site.mode == .taught, !quarantined,+            } else if site.mode == .taught, !quarantined,                       let activePattern = site.patternValues.first(where: \.isActive) {                 let urlRecord = site.urlRuleValues.first(where: \.isCurrent)                 let url: (id: UUID, version: Int, definition: URLRuleDefinition)? =@@ -319,24 +331,20 @@ extension LibraryRepository {                 Self.applyCaptureAssignment(                     to: entry, assignment: contract.outcome.composedAssignment, derivation: derivation,                     titleRuleID: activePattern.id, titleVersion: activePattern.version, url: url,-                    allWorks: allWorks, hostname: validated.hostname, context: context, timestamp: timestamp)+                    allWorks: allWorks, hostname: validated.hostname, site: site,+                    context: context, timestamp: timestamp)             }              // Validate the written tuple only (Req 6.5, Q9): no full-graph pass.-            // The cited search space is the union of the hostname's rows, so an-            // Entry reusing a rule id from the row that did not win still-            // replays (Decision 9). Both helpers return the single row's own-            // array untouched, so the ordinary capture faults nothing extra.-            if let site {-                do {-                    try V4LibraryValidator.validateEntryTuple(-                        entry: entry, site: site, works: entry.work.map { [$0] } ?? [],-                        patterns: CitedRuleResolution.retainedPatterns(across: siteRows),-                        rules: CitedRuleResolution.retainedURLRules(across: siteRows))-                } catch {-                    context.rollback()-                    return .invalidated(reason: "capture produced an invalid Entry tuple: \(error)")-                }+            // Cited ids resolve among what `entry.site` owns (Req 3.2) — the+            // row assigned above, which is also where every id the commit just+            // wrote came from, extraction replay included.+            do {+                try V4LibraryValidator.validateEntryTuple(+                    entry: entry, site: site, works: entry.work.map { [$0] } ?? [])+            } catch {+                context.rollback()+                return .invalidated(reason: "capture produced an invalid Entry tuple: \(error)")             }              do { try self.saveStrategy.save(context) }@@ -355,7 +363,7 @@ extension LibraryRepository {     private static func applyCaptureAssignment(         to entry: Entry, assignment: ComposedAssignmentProjection?, derivation: ComposedDerivation,         titleRuleID: UUID, titleVersion: Int, url: (id: UUID, version: Int, definition: URLRuleDefinition)?,-        allWorks: [Work], hostname: String, context: ModelContext, timestamp: Date+        allWorks: [Work], hostname: String, site: Site?, context: ModelContext, timestamp: Date     ) {         switch assignment {         case .none, .protected, .noChange:@@ -384,6 +392,7 @@ extension LibraryRepository {         case .create(let key):             guard let name = derivation.workName, !M2Unicode.isBlank(name) else { break }             let work = Work(id: UUID(), displayTitle: name, siteHostname: hostname, timestamp: timestamp)+            work.site = site             work.lastParsedTitle = name             work.titleProvenanceRaw = TitleProvenance.parsed.rawValue             if case .urlIdentity(let identity) = key, let url {@@ -402,6 +411,9 @@ extension LibraryRepository {     // MARK: - Capture basis builder      private func buildCaptureBasis(hostname: String, context: ModelContext) throws -> CaptureBasis {+        // Hostname lookup, kept deliberately (Req 3.3, task 16): a capture is+        // projected from a raw URL before any Entry exists, so a hostname is+        // all there is to resolve — this is one of the two moments Q8 preserves.         let sites = try Self.fetchSites(hostname: hostname, context: context)         let site = sites.first 

diff --git a/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+V4Bootstrap.swift b/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+V4Bootstrap.swiftindex 9250745..c66dcae 100644--- a/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+V4Bootstrap.swift+++ b/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+V4Bootstrap.swift@@ -5,14 +5,20 @@ import SwiftData /// V4 runtime opening and the in-place migration bootstrap (Req 5.4, Decision 3). /// /// The app owns migration entirely: it writes the durable sidecar, runs the-/// completion pass, validates with `V4LibraryValidator`, and only then publishes-/// the `AsterismV4.ready` marker (containing `"4"`) and deletes the V3 marker and-/// sidecar. The extension never migrates — it requires the V4 marker + store or-/// fails closed. M3's "valid nonempty unmarked ⟹ ready" heuristic is not carried-/// into V4: unverifiable partial-migration states fail loudly.+/// completion pass and the V5 relationship pass, validates with+/// `V4LibraryValidator`, and only then publishes the readiness marker+/// (containing `"5"`, the only version the extension opens — Q14) and deletes+/// the V3 marker and sidecar. The extension never migrates — it requires the+/// marker + store or fails closed. M3's "valid nonempty unmarked ⟹ ready"+/// heuristic is not carried into V4: unverifiable partial-migration states fail+/// loudly. /// /// An *empty* store is marked ready as soon as it exists, so the app either opens /// a ready library or throws — there is no third state for the reader to resolve.+/// It is marked at `"5"`: there is nothing in it to migrate, so it is already in+/// the state the relationship pass produces (Q26). A populated library still+/// marked `"4"` — one a pre-freeze build certified — runs the relationship pass+/// on its next app open and is republished at `"5"` (Q31). public extension LibraryRepository {     /// The result of evaluating fixed-path V4 state under an exclusive lease.     enum V4OpeningResult: Equatable, Sendable {@@ -71,7 +77,8 @@ public extension LibraryRepository {                 reason: "a V3 readiness marker exists but the store is missing; "                     + "restore from a backup rather than starting an empty library")         }-        if v4Marker { try validateV4MarkerContent(at: configuration.v4MarkerURL) }+        var markerVersion: String?+        if v4Marker { markerVersion = try validateMarkerContentForApp(at: configuration.v4MarkerURL) }          // A present sidecar must verify before it can drive anything (Q25).         var validSidecar: MigrationSidecar?@@ -85,14 +92,22 @@ public extension LibraryRepository {             }         } -        // Already certified V4: validate, clean up any stale handoff, open.+        // Already certified: run the relationship pass where the marker says it+        // has not run yet, validate, clean up any stale handoff, open.         if v4Marker {             let container = try openV4Container(at: configuration.v4StoreURL)             let context = ModelContext(container)-            let diagnostics = try validateV4Store(context: context)-            // Both markers → V4 governs; delete the stale V3 marker and sidecar.-            if v3Marker { try? fileManager.removeItem(at: configuration.v3MarkerURL) }-            MigrationSidecarCodec.remove(at: configuration.migrationSidecarURL)+            // A `"4"` marker is a library the relationship pass has not run+            // over — a pre-freeze certification, or a pass an interruption cut+            // short after `ModelContainer.init` had already converted the+            // store (Q28). A `"5"` marker means the pass ran at certification+            // and does not run again (Q29, Q31).+            // A nil `markerVersion` is unreachable here and compares unequal+            // anyway, which runs the idempotent pass — the fail-safe answer.+            let needsRelationshipPass = markerVersion != extensionOpenableMarkerVersion+            let diagnostics = try runPassAndCertify(+                configuration, context: context, saveStrategy: saveStrategy,+                runPass: needsRelationshipPass)             let counts = try v3Counts(context: context)             return (.ready(counts), makeRepository(                 configuration, container, capabilities, clock, saveStrategy,@@ -176,7 +191,14 @@ public extension LibraryRepository {             }             // Marker last: a crash before this leaves an empty unmarked store,             // which this same branch marks on the next launch.-            try publishV4Readiness(at: configuration.v4MarkerURL)+            //+            // Certified at `"5"`, not `"4"`: an empty store has nothing to+            // migrate, so the relationship pass would be a no-op over it and+            // the library is already in the state the pass produces (Q26).+            // Marking it `"4"` would leave the share extension declining a+            // library that will never be migrated — the pass runs only for+            // populated stores.+            try publishV5Readiness(at: configuration.v4MarkerURL)             v4Logger.debug("Marked an empty unmarked V4 store as ready")             return (.ready(.zero), makeRepository(                 configuration, container, capabilities, clock, saveStrategy))@@ -208,7 +230,9 @@ public extension LibraryRepository {                 operation: "opening V4 library from extension",                 reason: "the containing app has not initialized the current library")         }-        try validateV4MarkerContent(at: configuration.v4MarkerURL)+        // Before any container: `ModelContainer.init` is what converts the store,+        // and this process holds only a shared lock (Q14).+        try validateMarkerContentForExtension(at: configuration.v4MarkerURL)          let container: ModelContainer         do {@@ -229,14 +253,15 @@ public extension LibraryRepository { extension LibraryRepository {     static let v4Logger = Logger(subsystem: "me.nore.ig.Asterism", category: "V4Bootstrap") -    /// Opens the fixed-path V4 container with the V4 schema and the `[V3, V4]`-    /// lightweight migration plan (adds M4-additive columns for real pre-M4-    /// stores; lets a V3-recorded store open under the V4 schema).+    /// Opens the fixed-path store with the live V5 schema and the `[V3, V4, V5]`+    /// lightweight migration plan (adds the M4-additive columns for real pre-M4+    /// stores, then the M4a relationships; a V3-recorded store traverses both+    /// stages in one open — Q22).     // `public` so the app target can open a V4 store for the isolated UI-test     // bootstrap of the composed teaching surface (Req 7.3); production opens via     // `openV4ForApp` (task 25's runtime switch).     public static func openV4Container(at storeURL: URL) throws -> ModelContainer {-        let schema = Schema(versionedSchema: AsterismSchemaV4.self)+        let schema = Schema(versionedSchema: AsterismSchemaV5.self)         let storeConfiguration = ModelConfiguration(             "AsterismV3", // same on-disk store name as V3 (Q13)             schema: schema,@@ -245,15 +270,19 @@ extension LibraryRepository {         )         return try ModelContainer(             for: schema,-            migrationPlan: AsterismV4MigrationPlan.self,+            migrationPlan: AsterismV5MigrationPlan.self,             configurations: [storeConfiguration]         )     } -    /// Publishes the V4 readiness marker atomically (schema version 4, Q13).-    public static func publishV4Readiness(at url: URL) throws {+    /// Publishes readiness for a migrated library (schema version 5) — the only+    /// version the share extension opens, and the only version production+    /// publishes (Q32): every certification path runs the relationship pass+    /// first, so a `"4"` marker can now only come from a pre-freeze build's+    /// library, and the app republishes it here after the pass.+    public static func publishV5Readiness(at url: URL) throws {         do {-            try Data("4\n".utf8).write(to: url, options: .atomic)+            try Data("\(extensionOpenableMarkerVersion)\n".utf8).write(to: url, options: .atomic)             try FileManager.default.setAttributes(                 [.posixPermissions: NSNumber(value: Int16(0o600))],                 ofItemAtPath: url.path)@@ -287,9 +316,10 @@ extension LibraryRepository {     }      /// Opens the V4 container (converting the store in place), runs the completion-    /// pass, validates store-level integrity, and certifies readiness — writing-    /// the V4 marker only after validation, then deleting the V3 marker and-    /// sidecar. Per-Site diagnoses do not block certification (Q29).+    /// pass and the V5 relationship pass, validates store-level integrity, and+    /// certifies readiness — writing the `"5"` marker only after validation, then+    /// deleting the V3 marker and sidecar. Per-Site diagnoses do not block+    /// certification (Q29 of the V4 spec).     static func certifyMigration(         _ configuration: LibraryConfiguration,         sidecar: MigrationSidecar,@@ -308,19 +338,19 @@ extension LibraryRepository {          do {             try V4Migration.runCompletionPass(context: context, sidecar: sidecar, now: clock.now())-        } catch let error as V4Migration.Error {-            throw LibraryRepositoryError.libraryUnavailable(-                operation: "running the migration completion pass", reason: String(describing: error))         } catch {+            // `V4Migration.Error` describes itself; anything else is a store+            // fault. Both abort the certification with the same operation.             throw LibraryRepositoryError.libraryUnavailable(                 operation: "running the migration completion pass", reason: String(describing: error))         } -        let diagnostics = try validateV4Store(context: context)--        try publishV4Readiness(at: configuration.v4MarkerURL)-        try? FileManager.default.removeItem(at: configuration.v3MarkerURL)-        MigrationSidecarCodec.remove(at: configuration.migrationSidecarURL)+        // The pass always runs here: without it, `certifyMigration` would stamp+        // `"5"` on a library whose relationships were never populated — an+        // M3-era library upgrading in one launch would certify with every+        // relationship nil.+        let diagnostics = try runPassAndCertify(+            configuration, context: context, saveStrategy: saveStrategy, runPass: true)          let counts = try v3Counts(context: context)         v4Logger.debug("V4 migration certified with \(counts.sites, privacy: .public) Sites")@@ -329,6 +359,49 @@ extension LibraryRepository {             quarantined: diagnostics.quarantineMap(), diagnostics: diagnostics))     } +    /// The certification tail both V4 open paths share, in the order Q36 pins:+    /// the relationship pass, then store validation, then the `"5"` marker, and+    /// only then the handoff evidence the marker replaces.+    ///+    /// The pass runs BEFORE `validateV4Store`: diagnostics feed the session's+    /// quarantine map, and computed first they would describe the pre-pass graph+    /// — every relationship still nil — leaving the library open under+    /// quarantines the pass had just made obsolete.+    ///+    /// The marker goes after the work and the cleanup after the marker (Q36).+    /// `"5"` is published only once the pass's one save has committed and the+    /// store validated — the "marker last" Q15 asks for, where "last" means+    /// after the migration, not after housekeeping. The stale V3 marker and the+    /// sidecar are the recovery evidence for the state this call is leaving, so+    /// they go *after* the marker that replaces them, never before.+    ///+    /// `runPass` is false only for a library the marker already reports as+    /// migrated: the pass ran at its certification and does not run again (Q29,+    /// Q31), and there is no new marker to publish for it either.+    static func runPassAndCertify(+        _ configuration: LibraryConfiguration,+        context: ModelContext,+        saveStrategy: any RepositorySaveStrategy,+        runPass: Bool+    ) throws -> LibraryDiagnostics {+        if runPass {+            do {+                try V5RelationshipPass.run(context: context, saveStrategy: saveStrategy)+            } catch {+                throw LibraryRepositoryError.libraryUnavailable(+                    operation: "running the relationship migration pass",+                    reason: String(describing: error))+            }+        }+        let diagnostics = try validateV4Store(context: context)+        if runPass { try publishV5Readiness(at: configuration.v4MarkerURL) }+        // V4 governs, so a V3 marker is stale wherever one is left. Absent on+        // most calls, which `try?` covers along with a removal that fails.+        try? FileManager.default.removeItem(at: configuration.v3MarkerURL)+        MigrationSidecarCodec.remove(at: configuration.migrationSidecarURL)+        return diagnostics+    }+     /// Store-level validation for the V4 open path. States outside Req 1.1 still     /// fail closed; the three tolerated states and every illegal Site tuple come     /// back as diagnoses, so the library opens and quarantines what it must@@ -358,20 +431,72 @@ extension LibraryRepository {         }     } -    /// Confirms the readiness marker declares schema version 4; a future or-    /// unreadable marker fails closed.-    static func validateV4MarkerContent(at url: URL) throws {+    /// Schema versions the app opens: `"4"` is a library the relationship+    /// migration has not run over yet, `"5"` one it has.+    static let appOpenableMarkerVersions: Set<String> = ["4", "5"]++    /// The only version the share extension opens (Q14).+    static let extensionOpenableMarkerVersion = "5"++    /// App side: the marker must declare a version the app opens. The migration+    /// exists precisely for libraries still at `"4"`, so demanding `"5"` here+    /// would throw on every library it exists for. A version outside the set,+    /// or an unreadable marker, fails closed. Returns the validated version so+    /// the bootstrap can tell a `"4"` library — one the relationship pass must+    /// still run over — from a migrated one (Q31).+    @discardableResult+    static func validateMarkerContentForApp(at url: URL) throws -> String {+        let version = try readMarkerVersion(at: url)+        guard appOpenableMarkerVersions.contains(version) else {+            throw LibraryRepositoryError.libraryUnavailable(+                operation: "validating V4 readiness",+                reason: "marker declares an unsupported schema version")+        }+        return version+    }++    /// Extension side: only a migrated library opens (Q14, Req 2.3).+    ///+    /// `openV4Container` is shared with the app, so `ModelContainer.init`+    /// performs the lightweight conversion in whichever process opens first.+    /// The `flock`-based lease *does* serialise the extension against a+    /// migration in progress — the app holds `LOCK_EX` while `openV4ForApp`+    /// runs — but only for as long as it is held. Once the app returns, two+    /// extension invocations can hold `LOCK_SH` concurrently and both attempt+    /// the conversion, and the extension can be invoked when the app is not+    /// running at all. Refusing here, before any container is constructed, is+    /// what keeps the conversion in the app. Accepting `"4"` as the app-side+    /// check does would defeat that entirely.+    static func validateMarkerContentForExtension(at url: URL) throws {+        let version = try readMarkerVersion(at: url)+        if version == extensionOpenableMarkerVersion { return }+        // A version the app still opens is a library awaiting migration, which+        // launching the app resolves — the shipped message says so. Anything+        // else is a marker no build understands.+        throw LibraryRepositoryError.libraryUnavailable(+            operation: "opening V4 library from extension",+            reason: appOpenableMarkerVersions.contains(version)+                ? "the containing app has not initialized the current library"+                : "marker declares an unsupported schema version")+    }++    /// Reads the schema version the readiness marker declares. An unreadable+    /// marker fails closed with a reason that says so; unrecognisable *text*+    /// comes back as itself, for the caller's accepted-set test to reject —+    /// "not text at all" and "a version no build understands" are different+    /// faults and a reader is told which one it has.+    private static func readMarkerVersion(at url: URL) throws -> String {         let data: Data         do { data = try Data(contentsOf: url) } catch {             throw LibraryRepositoryError.libraryUnavailable(                 operation: "reading V4 readiness marker", reason: String(describing: error))         }-        guard let text = String(data: data, encoding: .utf8),-              text.trimmingCharacters(in: .whitespacesAndNewlines) == "4" else {+        guard let text = String(data: data, encoding: .utf8) else {             throw LibraryRepositoryError.libraryUnavailable(-                operation: "validating V4 readiness",-                reason: "marker declares an unsupported schema version")+                operation: "reading V4 readiness marker",+                reason: "readiness marker is not readable text")         }+        return text.trimmingCharacters(in: .whitespacesAndNewlines)     }      public static func makeRepository(

diff --git a/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+WorkMerge.swift b/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+WorkMerge.swiftindex 37abdb7..bd193e7 100644--- a/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+WorkMerge.swift+++ b/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+WorkMerge.swift@@ -316,6 +316,19 @@ extension LibraryRepository {         // what a merge would do. The winner supplies the rule when a row exists;         // a hostname with no row has no current rule to derive identities from,         // which is what an untaught hostname looks like anyway (Q12).+        //+        // This stays a hostname lookup deliberately, and **not** because no Work+        // model is in hand — `buildMergeWorkBasis` fetched both, two lines above.+        // A merge spans *two* Works, which may point at different rows of the+        // same hostname; neither relationship is privileged over the other, so+        // there is no record-shaped answer to take. The question is+        // hostname-shaped — which teaching currently governs the merge — and the+        // winner is that answer (Q54). On a duplicated hostname the merge surface+        // is refused upstream anyway: `commitMerge` sees the `.duplicateSiteRows`+        // quarantine and returns `.invalidated`, so the winner only ever governs+        // a basis the reader is being shown rather than one that commits.+        // `buildWorkURLBasis` has one Work in hand and reads `work.site`+        // (Req 3.1).         let hostname = sourceBasis.snapshot.siteHostname         let sites = try fetchSites(hostname: hostname, context: context)         let currentRules = sites.first?.urlRuleValues.filter(\.isCurrent) ?? []@@ -440,10 +453,11 @@ extension LibraryRepository {             ruleReference: reference         ) -        // Same demotion as the Merge basis: the winning row supplies the current-        // rule, and a hostname with no row simply has none.-        let sites = try Self.fetchSites(hostname: work.siteHostname, context: context)-        let currentRules = sites.first?.urlRuleValues.filter(\.isCurrent) ?? []+        // A Work is in hand, so its Site is its own relationship (Req 3.1) — no+        // winner is selected among rows sharing the hostname. A Work with a nil+        // relationship simply has no current rule, the same answer a hostname+        // with no row gives.+        let currentRules = work.site?.urlRuleValues.filter(\.isCurrent) ?? []         guard currentRules.count <= 1 else {             throw LibraryRepositoryError.corruptLibrary(                 operation: "building Work URL basis",

diff --git a/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository.swift b/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository.swiftindex c432002..8fb4aa4 100644--- a/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository.swift+++ b/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository.swift@@ -414,13 +414,7 @@ public actor LibraryRepository {         let validated = try Self.validateCapture(draft)         Self.logger.debug("Capturing Entry for a validated Site boundary")         return try await withLockedContext(mode: .exclusive, operation: "saving capture") { context in-            let sites = try Self.fetchSites(hostname: validated.hostname, context: context)-            if sites.isEmpty {-                context.insert(Site(hostname: validated.hostname))-                Self.logger.debug("Capture creates the first Site for its hostname")-            } else {-                Self.logger.debug("Capture reuses an existing Site")-            }+            let site = try Self.siteForWrite(hostname: validated.hostname, context: context)              let timestamp = clock.now()             let entry = Entry(@@ -435,6 +429,10 @@ public actor LibraryRepository {                 rating: draft.rating             )             context.insert(entry)+            // Both halves of the Site reference in one save (Req 1.4): the+            // hostname string above is the capture-time evidence, the+            // relationship is what the app resolves through.+            entry.site = site             // Conservative capture (this convenience applies no rules): the v1 key             // and its alias are both the immutable raw URL (Q21), so the Entry is             // V4-conservative and same-URL re-shares match forever.@@ -516,11 +514,14 @@ public actor LibraryRepository {         catch { throw LibraryRepositoryError.invalidInput(operation: "validating Work hostname", reason: String(describing: error)) }          return try await withLockedContext(mode: .exclusive, operation: "creating Work") { context in-            let sites = try Self.fetchSites(hostname: hostname, context: context)-            if sites.isEmpty { context.insert(Site(hostname: hostname)) }+            let site = try Self.siteForWrite(hostname: hostname, context: context)             let timestamp = MillisecondInstant.quantize(clock.now())             let work = Work(displayTitle: draft.displayTitle, siteHostname: hostname, timestamp: timestamp)             context.insert(work)+            // The Work points at the row the lookup returned — or at the one this+            // call inserted, never at whichever row a later fetch would order+            // first (Req 1.4).+            work.site = site             do { try saveStrategy.save(context) }             catch {                 throw LibraryRepositoryError.libraryUnavailable(@@ -628,6 +629,15 @@ public actor LibraryRepository {             case .newWork(let displayTitle):                 let work = Work(displayTitle: displayTitle, siteHostname: entry.hostname, timestamp: timestamp)                 context.insert(work)+                // The Entry's *own* row, not whichever row currently wins the+                // hostname (Req 1.4, Q44). `entry.site` is already pinned; a+                // winner that has since flipped would otherwise land the new+                // Work on a different row than the Entry it was created for,+                // and this path would pay for a fetch it never needed. The+                // lookup remains only as the fallback for an Entry whose own+                // relationship never arrived — Req 2.1's tolerated state.+                work.site = try entry.site+                    ?? Self.fetchSites(hostname: entry.hostname, context: context).first                 priorWork?.modifiedAt = timestamp                 entry.work = work                 entry.intentionallyUnattached = false@@ -656,33 +666,6 @@ public actor LibraryRepository {   -    /// Fetch a title pattern by ID.-    ///-    /// This is cited-id resolution: the caller holds an id some Entry recorded.-    /// The predicate is on the application id alone, with no Site scoping, which-    /// is the union of every Site row by construction (Decision 9). **Do not-    /// narrow it to the winning row's patterns** — a pattern owned by a losing-    /// duplicate row must still resolve, and must keep resolving when a teaching-    /// commit flips which row wins. `RecordResolutionOrder` below resolves the-    /// unrelated case of two patterns sharing one application UUID.-    public func titlePattern(id: UUID) async throws -> TitlePatternSnapshot {-        try await withLockedContext(mode: .shared, operation: "reading TitlePattern") { context in-            let descriptor = FetchDescriptor<TitlePattern>(predicate: #Predicate { $0.id == id })-            let patterns = RecordResolutionOrder.sortedPatterns(try context.fetch(descriptor))-            guard let pattern = patterns.first else {-                throw LibraryRepositoryError.recordNotFound(type: "TitlePattern", id: id)-            }-            return TitlePatternSnapshot(-                id: pattern.id,-                version: pattern.version,-                isActive: pattern.isActive,-                createdAt: pattern.createdAt,-                definition: try pattern.definition,-                siteHostname: pattern.site?.hostname ?? ""-            )-        }-    }-     // MARK: - Private Teaching Helpers      internal static func applyProjection(@@ -959,6 +942,24 @@ public actor LibraryRepository {         return SiteResolutionOrder.sorted(try context.fetch(descriptor))     } +    /// The Site row a write should attach its new record to: the hostname's+    /// winner, or a freshly inserted row where the hostname has none.+    ///+    /// One helper for all three write sites (Req 1.4, Q16). `fetchSites` is+    /// `SiteResolutionOrder`, so the row returned here is the one the+    /// relationship pass would pick for the same hostname — a second selection+    /// rule at any one write site would pin a captured record to one row and a+    /// migrated one to another. The inserted row is returned directly rather+    /// than re-fetched: it is by construction the hostname's only row.+    internal static func siteForWrite(hostname: String, context: ModelContext) throws -> Site {+        if let existing = try fetchSites(hostname: hostname, context: context).first {+            return existing+        }+        let site = Site(hostname: hostname)+        context.insert(site)+        return site+    }+     internal static func fetchEntry(id: UUID, context: ModelContext) throws -> Entry {         let descriptor = FetchDescriptor<Entry>(predicate: #Predicate { $0.id == id })         let entries = RecordResolutionOrder.sortedEntries(try context.fetch(descriptor))

diff --git a/Packages/AsterismCore/Sources/AsterismCore/M2PerformanceFixture.swift b/Packages/AsterismCore/Sources/AsterismCore/M2PerformanceFixture.swiftindex cd5abde..8d6d915 100644--- a/Packages/AsterismCore/Sources/AsterismCore/M2PerformanceFixture.swift+++ b/Packages/AsterismCore/Sources/AsterismCore/M2PerformanceFixture.swift@@ -134,6 +134,10 @@ extension LibraryRepository {                     work.titleProvenance = localIndex.isMultiple(of: 3) ? .manual : .parsed                     work.lastParsedTitle = localIndex.isMultiple(of: 2) ? title : nil                     context.insert(work)+                    // Both halves, as every write path sets them (Req 1.4). The+                    // fixture is guarded on an empty store, so this map holds+                    // exactly one row per hostname.+                    work.site = sitesByHostname[hostname]                     siteWorks.append(work)                     globalWorkIndex += 1                 }@@ -196,6 +200,7 @@ extension LibraryRepository {                         }                     }                     context.insert(entry)+                    entry.site = sitesByHostname[hostname]                     globalEntryIndex += 1                 }             }

diff --git a/Packages/AsterismCore/Sources/AsterismCore/M3PerformanceFixture.swift b/Packages/AsterismCore/Sources/AsterismCore/M3PerformanceFixture.swiftindex 9f6e7ef..bc5a592 100644--- a/Packages/AsterismCore/Sources/AsterismCore/M3PerformanceFixture.swift+++ b/Packages/AsterismCore/Sources/AsterismCore/M3PerformanceFixture.swift@@ -44,6 +44,12 @@ extension LibraryRepository {              // Create an ordinary taught Site with an active title pattern and a             // current URL rule.+            //+            // This is the fixture's only Site row, and every Work and Entry the+            // phases below build carries `site` in the same save the hostname+            // string is written in (Req 1.4). Without those assignments the+            // scale suites would measure a graph with no relationships at all —+            // one the app cannot produce.             let site = Site(hostname: hostname)             site.mode = .taught             context.insert(site)@@ -108,6 +114,7 @@ extension LibraryRepository {                 work.urlIdentityRuleID = ruleID                 work.urlIdentityRuleVersion = ruleVersion                 context.insert(work)+                work.site = site                  for seqIndex in 0..<5 {                     let entryIndex = workIndex * 5 + seqIndex@@ -164,6 +171,7 @@ extension LibraryRepository {                     entry.workURLAssignmentKind = .identity                     entry.workAssignmentProvenance = .urlRule                     context.insert(entry)+                    entry.site = site                 }             } @@ -187,6 +195,7 @@ extension LibraryRepository {                 work.urlIdentity = nil                 work.urlIdentityState = .none                 context.insert(work)+                work.site = site                  for seqIndex in 0..<5 {                     let entryIndex = workIndex * 5 + seqIndex@@ -206,6 +215,7 @@ extension LibraryRepository {                     entry.identityBasis = .conservative                     entry.workAssignmentProvenance = .pattern                     context.insert(entry)+                    entry.site = site                 }             } @@ -236,6 +246,7 @@ extension LibraryRepository {                 )                 entry.identityBasis = .conservative                 context.insert(entry)+                entry.site = site             }              // --- 4. Collision entries (300 entries, 30 groups × 2 Works × 5 Entries) ---@@ -256,6 +267,7 @@ extension LibraryRepository {                     work.urlIdentityRuleID = ruleID                     work.urlIdentityRuleVersion = ruleVersion                     context.insert(work)+                    work.site = site                      for entryOffset in 0..<5 {                         let entryIndex = groupIndex * 10 + workOffset * 5 + entryOffset@@ -293,6 +305,7 @@ extension LibraryRepository {                         entry.workURLAssignmentKind = .identity                         entry.workAssignmentProvenance = .urlRule                         context.insert(entry)+                        entry.site = site                     }                 }             }@@ -312,6 +325,7 @@ extension LibraryRepository {                 work.urlIdentity = nil                 work.urlIdentityState = .none                 context.insert(work)+                work.site = site                  for entryOffset in 0..<10 {                     let entryIndex = groupIndex * 10 + entryOffset@@ -351,6 +365,7 @@ extension LibraryRepository {                     entry.workURLAssignmentKind = .identity                     entry.workAssignmentProvenance = .urlRule                     context.insert(entry)+                    entry.site = site                 }             } 

diff --git a/Packages/AsterismCore/Sources/AsterismCore/M4PerformanceFixture.swift b/Packages/AsterismCore/Sources/AsterismCore/M4PerformanceFixture.swiftindex 8c876c9..7b34359 100644--- a/Packages/AsterismCore/Sources/AsterismCore/M4PerformanceFixture.swift+++ b/Packages/AsterismCore/Sources/AsterismCore/M4PerformanceFixture.swift@@ -98,6 +98,12 @@ extension LibraryRepository {                 )                 entry.conservativeIdentityKey = rawURL                 context.insert(entry)+                // Both halves in the same save, as `capture` does (Req 1.4).+                // Phase 2's composed commit creates the 1,000 Works and points+                // each at this same row, so the finished fixture is the graph+                // the app actually produces — which is what the scale budgets+                // are measured against.+                entry.site = site             }              let finalEntries = try context.fetchCount(FetchDescriptor<Entry>())@@ -170,6 +176,9 @@ extension LibraryRepository {                 context.insert(second)              case .siteMissing:+                // `Site.entries` and `Site.works` are `.nullify`, so deleting+                // the row leaves all 5,000 relationships nil — which is exactly+                // the state this case models and the one Req 2.1 permits.                 // Here the cascade is the point: "no Site row for this hostname"                 // means its rules are gone too, which is what an Entry that                 // arrives before its Site actually looks like. The validator@@ -203,6 +212,7 @@ extension LibraryRepository {                 )                 twin.conservativeIdentityKey = twinURL                 context.insert(twin)+                twin.site = taught             }              try saveStrategy.save(context)

diff --git a/Packages/AsterismCore/Sources/AsterismCore/Models.swift b/Packages/AsterismCore/Sources/AsterismCore/Models.swiftindex f0ca8f9..fdf77d1 100644--- a/Packages/AsterismCore/Sources/AsterismCore/Models.swift+++ b/Packages/AsterismCore/Sources/AsterismCore/Models.swift@@ -1,19 +1,20 @@ import Foundation import SwiftData -// The live model classes are V4's, nested inside `AsterismSchemaV4` (Decision 6).-// Top-level typealiases keep every call site (`Entry`, `Site`, …) unchanged while-// the frozen pre-M4 snapshot `AsterismSchemaV3` carries nested classes with the-// same SwiftData entity names — legal only because there is exactly one *top-level*-// `@Model` per entity name (all model classes are nested, the top-level names are-// typealiases). Two top-level `@Model`s sharing an entity name crash `ModelContext`.-public typealias Entry = AsterismSchemaV4.Entry-public typealias Work = AsterismSchemaV4.Work-public typealias Site = AsterismSchemaV4.Site-public typealias TitlePattern = AsterismSchemaV4.TitlePattern-public typealias URLRulePattern = AsterismSchemaV4.URLRulePattern--extension AsterismSchemaV4 {+// The live model classes are V5's, nested inside `AsterismSchemaV5` (Decision 6,+// Q20). Top-level typealiases keep every call site (`Entry`, `Site`, …) unchanged+// while the frozen snapshots `AsterismSchemaV3` and `AsterismSchemaV4` carry+// nested classes with the same SwiftData entity names — legal only because there+// is exactly one *top-level* `@Model` per entity name (all model classes are+// nested, the top-level names are typealiases). Two top-level `@Model`s sharing+// an entity name crash `ModelContext`.+public typealias Entry = AsterismSchemaV5.Entry+public typealias Work = AsterismSchemaV5.Work+public typealias Site = AsterismSchemaV5.Site+public typealias TitlePattern = AsterismSchemaV5.TitlePattern+public typealias URLRulePattern = AsterismSchemaV5.URLRulePattern++extension AsterismSchemaV5 {  @Model public final class Entry {@@ -23,6 +24,12 @@ public final class Entry {     public var rawURLString: String = ""     public var canonicalURLString: String?     public var hostname: String = ""+    /// M4a: the Site this Entry was captured on, as a modelled reference (Req+    /// 1.1). `hostname` stays beside it as capture-time evidence (Q3). Nil while+    /// the Site has not arrived, or where no Site row matches — a tolerated+    /// state, not an error (Req 2.1). Written in the same save as `hostname`+    /// (Req 1.4).+    public var site: Site?     public var entryIdentityKey: String = ""     public var identityKeyVersion: Int = 1     /// M4 secondary lookup index: the conservative (v1) key for this Entry's raw@@ -126,6 +133,10 @@ public final class Work {     public var displayTitle: String = ""     public var lastParsedTitle: String?     public var siteHostname: String = ""+    /// M4a: the Site this Work belongs to, as a modelled reference (Req 1.1).+    /// `siteHostname` stays beside it as capture-time evidence (Q3). Same+    /// nil-tolerance and same-save rule as `Entry.site`.+    public var site: Site?     public var urlIdentity: String?     public var urlIdentityStateRaw: String = WorkURLIdentityState.none.rawValue     public var urlIdentityRuleID: UUID?@@ -175,6 +186,18 @@ public final class Site {     public var patterns: [TitlePattern]?     @Relationship(deleteRule: .cascade, inverse: \URLRulePattern.site)     public var urlRules: [URLRulePattern]?+    /// Inverse of `Entry.site`, present only because CloudKit requires every+    /// relationship to have one (Req 1.3). **Deliberately `internal`** while+    /// `Site` is `public`, so the app target cannot reach it: traversing this+    /// faults every Entry for a hostname — roughly 125× the fan-out of+    /// `Work.entries` — which the Req 5.1 budgets would pay for (Q17). No+    /// `entryValues` accessor exists, for the same reason.+    @Relationship(deleteRule: .nullify, inverse: \Entry.site)+    var entries: [Entry]?+    /// Inverse of `Work.site`. Same reasoning as `entries` — internal, no+    /// convenience accessor (Q17).+    @Relationship(deleteRule: .nullify, inverse: \Work.site)+    var works: [Work]?     /// Frozen V2 field retained only until strict legacy mapping moves it into     /// historical URLRulePattern records.     public var urlIdentityRule: URLIdentityRule?@@ -429,4 +452,4 @@ public final class URLRulePattern {     } } -} // extension AsterismSchemaV4+} // extension AsterismSchemaV5

diff --git a/Packages/AsterismCore/Sources/AsterismCore/RecentPresentation.swift b/Packages/AsterismCore/Sources/AsterismCore/RecentPresentation.swiftindex 025b973..5181495 100644--- a/Packages/AsterismCore/Sources/AsterismCore/RecentPresentation.swift+++ b/Packages/AsterismCore/Sources/AsterismCore/RecentPresentation.swift@@ -111,10 +111,12 @@ public enum RecentRowActionType: String, Equatable, Sendable { /// closed set: the row still appears, identified by its capture title, and says /// what the app cannot resolve rather than vanishing or failing the screen. ///-/// Two of these are Req 2.2's unresolvable causes; the other two are states in-/// which the row resolves but the hostname's teaching cannot be trusted, so the-/// row carries no action. Marking them is what keeps a row whose action was-/// withdrawn from reading as a settled one.+/// Two of these are Req 2.2's unresolvable causes; two more are states in which+/// the row resolves but the hostname's teaching cannot be trusted, so the row+/// carries no action. Marking them is what keeps a row whose action was+/// withdrawn from reading as a settled one. The fifth, `citationUnresolved`, is+/// the one case that keeps its action, because re-teaching is the repair rather+/// than a dead end. public enum RecentRowAttention: String, Equatable, Sendable {     /// No Site row exists for the Entry's hostname.     case siteMissing@@ -130,6 +132,36 @@ public enum RecentRowAttention: String, Equatable, Sendable {     /// re-teaching cannot clear a second row (Req 3.4). The route is the     /// diagnostics screen (Req 4.1).     case siteDuplicated+    /// The Entry cites a title pattern that resolves nowhere, so its unresolved+    /// candidate title cannot be replayed. The Site resolved, so unlike the four+    /// above this row keeps its mode and its Teach/Re-teach action: re-teaching+    /// this hostname is not refused, and it is the repair (relational-references+    /// Req 3.4, Q13).+    case citationUnresolved+}++/// The outcome of replaying a title pattern a record already cites (Req 3.4,+/// Q13). Every arm is a rendering; none is an error, which is the whole point.+///+/// Shared vocabulary: Recent turns `.unresolvable` into `.citationUnresolved`+/// and Entry detail turns it into an unsettled assignment, from one replay+/// helper, so the two surfaces cannot disagree about the same Entry.+internal enum CitationReplay: Equatable {+    /// The record cites no pattern to replay — it is settled, manually assigned,+    /// intentionally unattached, or its own Site never arrived.+    case notApplicable+    /// The citation resolved. The replayed candidate Work title, which the+    /// pattern may legitimately leave nil.+    case replayed(String?)+    /// The cited `(id, version)` pair matches no pattern in the search space, or+    /// the pattern it matches cannot reproduce the candidate. Rendered as needing+    /// attention; never thrown.+    case unresolvable++    /// The replayed candidate title, and nil for every arm that produced none.+    var candidateTitle: String? {+        if case .replayed(let title) = self { title } else { nil }+    } }  // MARK: - EntryTeachingDetail DTO (Audit §3)

diff --git a/Packages/AsterismCore/Sources/AsterismCore/Snapshots.swift b/Packages/AsterismCore/Sources/AsterismCore/Snapshots.swiftindex 1cb932e..5e15cd1 100644--- a/Packages/AsterismCore/Sources/AsterismCore/Snapshots.swift+++ b/Packages/AsterismCore/Sources/AsterismCore/Snapshots.swift@@ -100,16 +100,6 @@ public struct SiteSnapshot: Equatable, Sendable {     public let junkSuffixRule: JunkSuffixRule? } -public struct TitlePatternSnapshot: Equatable, Sendable {-    public let id: UUID-    public let version: Int-    public let isActive: Bool-    public let createdAt: Date-    public let definition: PatternDefinition-    public let siteHostname: String-}--  public struct DatedEntryGroup: Equatable, Sendable {     public let day: Date

diff --git a/Packages/AsterismCore/Sources/AsterismCore/ToleratedStateFixture.swift b/Packages/AsterismCore/Sources/AsterismCore/ToleratedStateFixture.swiftindex b6269b4..d18186a 100644--- a/Packages/AsterismCore/Sources/AsterismCore/ToleratedStateFixture.swift+++ b/Packages/AsterismCore/Sources/AsterismCore/ToleratedStateFixture.swift@@ -105,6 +105,21 @@ extension LibraryRepository {             // path would refuse every one of these shapes, which is why the             // fixture writes underneath it.             try saveStrategy.save(context)++            // Then link both relationships, exactly as certification does+            // (Req 1.4, task 19). Running the pass rather than assigning inline+            // is what makes the fixture's graph the one the app produces: it+            // resolves each hostname through `SiteResolutionOrder`, so+            // `.duplicateSiteRows` pins its Entry to the same winner a capture+            // would have, and it must run *after* the save above because a+            // temporary `PersistentIdentifier` has no defined order.+            //+            // `.siteMissing` needs no exception and is given none: its Entries+            // are on a hostname carrying no Site row, so the pass leaves their+            // relationship nil. That nil is the point of the kind — an Entry+            // whose Site is absent — and it is the one state Req 2.1 permits a+            // certified library to hold.+            try V5RelationshipPass.run(context: context, saveStrategy: saveStrategy)         }     } 

diff --git a/Packages/AsterismCore/Sources/AsterismCore/V2MigrationStore.swift b/Packages/AsterismCore/Sources/AsterismCore/V2MigrationStore.swiftindex 25d2561..c407961 100644--- a/Packages/AsterismCore/Sources/AsterismCore/V2MigrationStore.swift+++ b/Packages/AsterismCore/Sources/AsterismCore/V2MigrationStore.swift@@ -3,6 +3,17 @@ import SwiftData  /// Raw V2 store operations used only by the explicit developer migration path. /// They intentionally do not write runtime readiness; the app owns that step.+///+/// **The one write site that deliberately does not set `Entry.site` /+/// `Work.site`** (Req 1.4, Q45). Everything here happens inside a container+/// built from `Schema(versionedSchema: AsterismSchemaV2.self)` — a 2.0.0 stamp+/// over the *live* model classes — and `create` refuses to run unless the+/// destination does not exist, so the only store this type ever touches is one+/// it has just written itself and immediately reads back through+/// `readSnapshot`. That snapshot is hostname-keyed, the V2 store is a separate+/// file from the V4/V5 store, and nothing carries a V2-written relationship+/// forward. Setting the relationships here would write a V5-only column into a+/// store recorded at 2.0.0 that no reader will ever look at. public enum V2MigrationStore {     public static func artifactURLs(for storeURL: URL) -> [URL] {         [

diff --git a/Packages/AsterismCore/Sources/AsterismCore/V4LibraryValidator.swift b/Packages/AsterismCore/Sources/AsterismCore/V4LibraryValidator.swiftindex 43eb80a..152f9d2 100644--- a/Packages/AsterismCore/Sources/AsterismCore/V4LibraryValidator.swift+++ b/Packages/AsterismCore/Sources/AsterismCore/V4LibraryValidator.swift@@ -157,8 +157,6 @@ public enum V4LibraryValidator {         // application UUID does not also register as a broken Work/Entry inverse.         let entries = index(entryRows, RecordResolutionOrder.sortedEntries)         let works = index(workRows, RecordResolutionOrder.sortedWorks)-        let patterns = winners(patternRows, RecordResolutionOrder.sortedPatterns)-        let rules = winners(ruleRows, RecordResolutionOrder.sortedURLRules)          tolerated += duplicateIdentities(             entryRows, type: "Entry", id: \.id, hostname: \.hostname)@@ -195,7 +193,7 @@ public enum V4LibraryValidator {          for group in workRows {             guard let work = works[group.key]?.first else { continue }-            guard let site = sites[work.siteHostname] else {+            guard sites[work.siteHostname] != nil else {                 guard strictness == .tolerant else {                     throw unresolved("Work", work.id.uuidString, "Site \(work.siteHostname)")                 }@@ -203,7 +201,9 @@ public enum V4LibraryValidator {                 continue             }             do {-                try validate(work: work, site: site, entries: entries, rules: rules)+                try validate(+                    work: work, entries: entries,+                    tolerateUnlinkedCitations: strictness == .tolerant)             } catch let error as V4ValidationError {                 record(work.siteHostname, error)             }@@ -227,7 +227,9 @@ public enum V4LibraryValidator {                 continue             }             do {-                try validate(entry: entry, site: site, works: works, patterns: patterns, rules: rules)+                try validate(+                    entry: entry, site: site, works: works,+                    tolerateUnlinkedCitations: strictness == .tolerant)             } catch let error as V4ValidationError {                 record(entry.hostname, error)             }@@ -248,19 +250,102 @@ public enum V4LibraryValidator {     /// a full-graph pass (Req 6.5, Q9): capture commits validate only the tuple     /// they wrote. Throws a typed `V4ValidationError` on an illegal tuple.     ///-    /// `patterns` and `rules` are the *cited* search space, so a caller on a-    /// hostname that may carry more than one Site row passes the union of every-    /// row's rules — `CitedRuleResolution.retainedPatterns(across:)` — not the-    /// winning row's own arrays (Decision 9). `site` is still the winner: it is-    /// what the tuple's mode and ownership are read against.+    /// Every cited pattern and rule — the extraction replay included — resolves+    /// among what `entry.site` owns (Req 3.2), so there is no cited search space+    /// to pass. `site` is what the tuple's mode and ownership are read against —+    /// the same row the write site assigned (Req 1.4).     public static func validateEntryTuple(-        entry: Entry, site: Site, works: [Work], patterns: [TitlePattern], rules: [URLRulePattern]+        entry: Entry, site: Site, works: [Work]     ) throws {         var worksByID: [String: [Work]] = [:]         for work in works { worksByID[work.id.uuidString, default: []].append(work) }-        let patternsByID = Dictionary(patterns.map { ($0.id.uuidString, $0) }, uniquingKeysWith: { a, _ in a })-        let rulesByID = Dictionary(rules.map { ($0.id.uuidString, $0) }, uniquingKeysWith: { a, _ in a })-        try validate(entry: entry, site: site, works: worksByID, patterns: patternsByID, rules: rulesByID)+        // `tolerateUnlinkedCitations: false`. Req 3.4's tolerance is a property+        // of the two *open* paths: a library already on disk may hold records+        // whose Site relationship never arrived. A commit validates the tuple it+        // is about to write, and a write site sets both halves in the same save+        // (Req 1.4), so an unlinked citation here is a bug in the writer, not a+        // state to survive.+        try validate(+            entry: entry, site: site, works: worksByID,+            tolerateUnlinkedCitations: false)+    }++    // MARK: - Citation tolerance (Req 3.4, Q27) and resolution (Req 3.2)++    /// What a cited-rule site needs to know beyond the citation itself: the Site+    /// the citing record points at — the **search space** (Req 3.2) — and+    /// whether a citation that fails to resolve is tolerated because there is+    /// no such Site.+    ///+    /// The four cited-rule sites — `validate(work:…)`'s `.rule` identity,+    /// `validateV3`'s name contributor, `validateChapter`'s pattern provenance+    /// and `requiredReference` — resolve among the rules the citing record's own+    /// Site owns. A nil relationship is a state Req 2.1 explicitly permits, and+    /// after task 14 it makes every citation unresolvable by construction, so+    /// only the **resolution clause** is demoted for it, never the whole guard:+    /// a nonblank identity, a complete `(id, version)` reference and every arm+    /// of the closed tuple table keep failing exactly as they did. A record with+    /// no Site has nothing to replay its citation against; a record with one is+    /// diagnosed as before.+    private struct CitationContext {+        /// The citing record's own Site relationship: the cited search space,+        /// and — when nil — the reason a failure is tolerated.+        let citingSite: Site?+        /// Only the two open paths tolerate. The import gates run `.strict` and+        /// must keep refusing an archive that cannot resolve its own citations+        /// (Decision 3), and a commit validating what it just wrote is stricter+        /// still — see `validateEntryTuple`.+        let tolerant: Bool++        /// Whether an unresolvable citation is demoted from a tuple failure to a+        /// tolerated state.+        var toleratesUnresolved: Bool { tolerant && citingSite == nil }+    }++    /// Whether a cited URL rule resolves — id and version together (Req 4.2),+    /// among the rules the citing record's own Site owns (Req 3.2) — or is+    /// tolerated because the citing record has no Site.+    private static func resolves(+        citedRule reference: URLRuleReference, _ citation: CitationContext+    ) -> Bool {+        citedRule(reference, citation) != nil || citation.toleratesUnresolved+    }++    /// The cited URL rule among the citing record's own Site's rules — id and+    /// version together (Req 4.2) — or nil when it does not resolve, including+    /// when there is no Site to search. The single source for every cited-rule+    /// read, `validateExtractionReplay` included: a replay that resolved its+    /// rule anywhere else would enforce a rule the citing record's Site does not+    /// own, and would re-throw one call after `requiredReference` tolerated the+    /// same reference (Req 3.4, Q40).+    private static func citedRule(+        _ reference: URLRuleReference, _ citation: CitationContext+    ) -> URLRulePattern? {+        citation.citingSite?.urlRuleValues.first {+            $0.id == reference.id && $0.version == reference.version+        }+    }++    /// Whether a cited title pattern resolves — id and version together+    /// (Req 4.2), among the patterns the citing record's own Site owns (Req 3.2)+    /// — or is tolerated because the citing record has no Site. The sibling of+    /// `resolves(citedRule:)`, for the call sites that need the answer and not+    /// the pattern; `validateV3` keeps the raw `citedPattern` call because it+    /// replays the pattern it resolves.+    private static func resolves(+        citedPattern id: UUID, version: Int, _ citation: CitationContext+    ) -> Bool {+        citedPattern(id: id, version: version, citation) != nil || citation.toleratesUnresolved+    }++    /// The cited title pattern among the citing record's own Site's rules, or+    /// nil when it does not resolve — including when there is no Site to search.+    /// Callers pair a nil with `citation.toleratesUnresolved` to decide between+    /// a diagnosis and a tolerated state.+    private static func citedPattern(+        id: UUID, version: Int, _ citation: CitationContext+    ) -> TitlePattern? {+        citation.citingSite?.patternValues.first { $0.id == id && $0.version == version }     }      // MARK: - Site (closed tuple table, supersedes M3 8.1)@@ -282,10 +367,11 @@ public enum V4LibraryValidator {         }          // `=== site` throughout this routine is deliberate and is *not* the-        // cited-id lookup Decision 9 widened. This asks whether this Site row's-        // own tuple is internally consistent; a second row's records belong to-        // that row's tuple, not to this one. Widening it to the hostname would-        // report every duplicated hostname's membership set as incomplete.+        // cited-id lookup (Req 3.2, Decision 4). This asks whether this Site+        // row's own tuple is internally consistent; a second row's records+        // belong to that row's tuple, not to this one. Widening it to the+        // hostname would report every duplicated hostname's membership set as+        // incomplete.         let patterns = site.patternValues         let rules = site.urlRuleValues         guard Set(patterns.map(\.id)) == Set(allPatterns.filter { $0.site === site }.map(\.id)),@@ -363,11 +449,12 @@ public enum V4LibraryValidator {      private static func validate(         work: Work,-        site: Site,         entries: [String: [Entry]],-        rules: [String: URLRulePattern]+        tolerateUnlinkedCitations: Bool     ) throws {         let id = work.id.uuidString+        let citation = CitationContext(+            citingSite: work.site, tolerant: tolerateUnlinkedCitations)         guard !M2Unicode.isBlank(work.displayTitle) else { throw invalid("Work", id, "display title is blank") }         guard let state = WorkURLIdentityState(rawValue: work.urlIdentityStateRaw) else {             throw invalid("Work", id, "unknown URL identity state")@@ -379,14 +466,15 @@ public enum V4LibraryValidator {                 throw invalid("Work", id, "none identity cannot carry a value or rule")             }         case .rule:-            // Cited id, so ownership spans every Site row for the hostname-            // (Decision 9) — not `=== site`, which is the winning row and would-            // make this Work's identity resolve or fail by whichever row-            // currently wins.+            // Cited id, resolved among the rules this Work's own Site owns+            // (Req 3.2) — a fixed pointer, not the hostname winner, so the+            // identity cannot resolve or fail by whichever row currently wins.+            // A Work with no Site relationship tolerates the failure instead of+            // quarantining its hostname (Req 3.4, Q27); the identity value and+            // the reference's completeness are not part of that demotion.             guard let identity = work.urlIdentity, !M2Unicode.isBlank(identity),                   let reference = completeReference(id: work.urlIdentityRuleID, version: work.urlIdentityRuleVersion),-                  let rule = rules[reference.id.uuidString], rule.version == reference.version,-                  CitedRuleResolution.resolves(rule, forRecordsOn: site.hostname) else {+                  resolves(citedRule: reference, citation) else {                 throw invalid("Work", id, "rule identity requires a resolving rule on its own site")             }         case .legacyUnverified:@@ -412,10 +500,11 @@ public enum V4LibraryValidator {         entry: Entry,         site: Site,         works: [String: [Work]],-        patterns: [String: TitlePattern],-        rules: [String: URLRulePattern]+        tolerateUnlinkedCitations: Bool     ) throws {         let id = entry.id.uuidString+        let citation = CitationContext(+            citingSite: entry.site, tolerant: tolerateUnlinkedCitations)         if let work = entry.work {             guard works[work.id.uuidString]?.contains(where: { $0 === work }) == true,                   work.siteHostname == site.hostname,@@ -431,11 +520,11 @@ public enum V4LibraryValidator {          let workReference = try validatedOptionalReference(             owner: "Entry", id: id, field: "Work extraction",-            referenceID: entry.urlWorkRuleID, version: entry.urlWorkRuleVersion, site: site, rules: rules)+            referenceID: entry.urlWorkRuleID, version: entry.urlWorkRuleVersion, citation)         let sequenceReference = try validatedOptionalReference(             owner: "Entry", id: id, field: "chapter sequence",             referenceID: entry.chapterSequenceRuleID, version: entry.chapterSequenceRuleVersion,-            site: site, rules: rules)+            citation)          switch (entry.urlWorkIdentity, workReference, entry.chapterSequence, sequenceReference) {         case (nil, nil, nil, nil):@@ -451,7 +540,9 @@ public enum V4LibraryValidator {         default:             throw invalid("Entry", id, "invalid extraction/provenance tuple")         }-        try validateExtractionReplay(entry, workReference: workReference, sequenceReference: sequenceReference, rules: rules)+        try validateExtractionReplay(+            entry, workReference: workReference, sequenceReference: sequenceReference,+            citation)          guard let basis = EntryIdentityBasis(rawValue: entry.identityBasisRaw) else {             throw invalid("Entry", id, "unknown identity basis")@@ -470,21 +561,22 @@ public enum V4LibraryValidator {             let identityReference = try requiredReference(                 owner: "Entry", id: id, field: "identity",                 referenceID: entry.identityURLRuleID, version: entry.identityURLRuleVersion,-                site: site, rules: rules)+                citation)             switch entry.identityKeyVersion {             case 2:                 try validateV2(entry, id: id, identityReference: identityReference,                     workReference: workReference, sequenceReference: sequenceReference)             case 3:-                try validateV3(entry, id: id, site: site, identityReference: identityReference,-                    workReference: workReference, sequenceReference: sequenceReference, patterns: patterns)+                try validateV3(entry, id: id, identityReference: identityReference,+                    workReference: workReference, sequenceReference: sequenceReference,+                    citation)             default:                 throw invalid("Entry", id, "URL-rule basis requires key version 2 or 3")             }         } -        try validateChapter(entry, site: site, patterns: patterns)-        try validateAssignment(entry, site: site, work: entry.work, rules: rules)+        try validateChapter(entry, site: site, citation)+        try validateAssignment(entry, site: site, work: entry.work, citation)     }      private static func validateV2(@@ -514,19 +606,28 @@ public enum V4LibraryValidator {     private static func validateV3(         _ entry: Entry,         id: String,-        site: Site,         identityReference: URLRuleReference,         workReference: URLRuleReference?,         sequenceReference: URLRuleReference?,-        patterns: [String: TitlePattern]+        _ citation: CitationContext     ) throws {+        // Cited id, resolved among the patterns this Entry's own Site owns+        // (Req 3.2). An Entry with no Site relationship tolerates a contributor+        // that does not resolve (Req 3.4, Q27) — the rest of the v3 arm is+        // unchanged.+        let v3IdentityReason =+            "v3 identity requires a sequence rule and a resolving name contributor on its own site, with no Work identity"         guard entry.urlWorkIdentity == nil, workReference == nil,               let sequence = entry.chapterSequence, sequenceReference == identityReference,-              let nameRef = completeReference(id: entry.identityNameTitleRuleID, version: entry.identityNameTitleRuleVersion),-              let namePattern = patterns[nameRef.id.uuidString], namePattern.version == nameRef.version,-              // Cited id: any Site row for the hostname may own it (Decision 9).-              CitedRuleResolution.resolves(namePattern, forRecordsOn: site.hostname) else {-            throw invalid("Entry", id, "v3 identity requires a sequence rule and a resolving name contributor on its own site, with no Work identity")+              let nameRef = completeReference(id: entry.identityNameTitleRuleID, version: entry.identityNameTitleRuleVersion)+        else {+            throw invalid("Entry", id, v3IdentityReason)+        }+        // The pattern itself, not `resolves(citedPattern:)`: the replay below+        // needs the pattern this resolves.+        let namePattern = citedPattern(id: nameRef.id, version: nameRef.version, citation)+        guard namePattern != nil || citation.toleratesUnresolved else {+            throw invalid("Entry", id, v3IdentityReason)         }         let decoded: URLSequenceNameIdentity         do {@@ -536,7 +637,10 @@ public enum V4LibraryValidator {               decoded.chapterSequence == ExactScalarString(sequence) else {             throw invalid("Entry", id, "v3 key does not match its host or sequence")         }-        // Replay the embedded name from the cited title rule (Req 4.2).+        // Replay the embedded name from the cited title rule (Req 4.2). A+        // tolerated contributor leaves nothing to replay from, so the key's+        // host and sequence are all that can be checked.+        guard let namePattern else { return }         let definition: PatternDefinition         do { definition = try namePattern.definition }         catch { throw invalid("Entry", id, "v3 name contributor has an invalid definition") }@@ -552,24 +656,43 @@ public enum V4LibraryValidator {         _ entry: Entry,         workReference: URLRuleReference?,         sequenceReference: URLRuleReference?,-        rules: [String: URLRulePattern]+        _ citation: CitationContext     ) throws {         let id = entry.id.uuidString+        // The retained rule is resolved among the rules the Entry's own Site+        // owns (Req 3.2), exactly as `resolves(citedRule:)` one call up did. A+        // library-global index would leave one residual path open: an Entry with+        // a nil relationship whose cited rule id happens to exist elsewhere in+        // the store would replay against a rule it does not own, fail the replay+        // and quarantine its hostname — the state Req 3.4 forbids and the rest+        // of Decision 3 closed (Q56). A reference `requiredReference` has+        // already tolerated therefore tolerates here on the same terms, rather+        // than being re-thrown one call later (Q40).         if let workReference {-            guard let rule = rules[workReference.id.uuidString], rule.version == workReference.version,-                  let storedWork = entry.urlWorkIdentity else {+            guard let rule = citedRule(workReference, citation) else {+                if citation.toleratesUnresolved { return }                 throw invalid("Entry", id, "Work extraction replay cannot resolve its retained rule")             }+            guard let storedWork = entry.urlWorkIdentity else {+                // The rule resolved; what is missing is the extraction to+                // compare it against.+                throw invalid("Entry", id, "Work extraction replay has no stored URL extraction to replay against")+            }             let replayed = try? URLRuleApplicator.apply(rule.definition, to: ExactScalarString(entry.rawURLString))             guard let replayed, replayed.workIdentity == ExactScalarString(storedWork),                   replayed.chapterSequence == entry.chapterSequence.map(ExactScalarString.init) else {                 throw invalid("Entry", id, "stored URL extraction does not equal retained-rule replay")             }         } else if let sequenceReference {-            guard let rule = rules[sequenceReference.id.uuidString], rule.version == sequenceReference.version,-                  let storedSequence = entry.chapterSequence else {+            guard let rule = citedRule(sequenceReference, citation) else {+                if citation.toleratesUnresolved { return }                 throw invalid("Entry", id, "sequence extraction replay cannot resolve its retained rule")             }+            guard let storedSequence = entry.chapterSequence else {+                // As above: the retained rule resolved, the stored sequence it+                // would be replayed against is the part that is absent.+                throw invalid("Entry", id, "sequence extraction replay has no stored sequence")+            }             // `definition` decodes JSON on every access; read it once per Entry.             let definition = rule.definition             let replayed: ExactScalarString?@@ -587,7 +710,7 @@ public enum V4LibraryValidator {     private static func validateChapter(         _ entry: Entry,         site: Site,-        patterns: [String: TitlePattern]+        _ citation: CitationContext     ) throws {         let id = entry.id.uuidString         guard let provenance = FieldProvenanceKind(rawValue: entry.chapterTitleProvenanceRaw) else {@@ -604,11 +727,12 @@ public enum V4LibraryValidator {                 throw invalid("Entry", id, "manual chapter requires a nonblank value and no pattern")             }         case .pattern:+            // Cited id, resolved among the patterns this Entry's own Site owns+            // (Req 3.2); an Entry with no Site relationship tolerates a pattern+            // that does not resolve (Req 3.4, Q27).             guard site.mode != .articles, let title = entry.chapterTitle, !M2Unicode.isBlank(title),                   let patternID = entry.chapterPatternID, let patternVersion = entry.chapterPatternVersion,-                  let pattern = patterns[patternID.uuidString], pattern.version == patternVersion,-                  // Cited id: any Site row for the hostname may own it (Decision 9).-                  CitedRuleResolution.resolves(pattern, forRecordsOn: site.hostname) else {+                  resolves(citedPattern: patternID, version: patternVersion, citation) else {                 throw invalid("Entry", id, "pattern chapter provenance does not resolve")             }         case .urlRule:@@ -620,7 +744,7 @@ public enum V4LibraryValidator {         _ entry: Entry,         site: Site,         work: Work?,-        rules: [String: URLRulePattern]+        _ citation: CitationContext     ) throws {         let id = entry.id.uuidString         guard let provenance = FieldProvenanceKind(rawValue: entry.workAssignmentProvenanceRaw) else {@@ -654,7 +778,7 @@ public enum V4LibraryValidator {             }             _ = try requiredReference(                 owner: "Entry", id: id, field: "assignment",-                referenceID: entry.workURLRuleID, version: entry.workURLRuleVersion, site: site, rules: rules)+                referenceID: entry.workURLRuleID, version: entry.workURLRuleVersion, citation)             switch kind {             case .identity:                 guard let value = entry.urlWorkIdentity, !M2Unicode.isBlank(value) else {@@ -674,27 +798,27 @@ public enum V4LibraryValidator {      private static func validatedOptionalReference(         owner: String, id: String, field: String,-        referenceID: UUID?, version: Int?, site: Site, rules: [String: URLRulePattern]+        referenceID: UUID?, version: Int?,+        _ citation: CitationContext     ) throws -> URLRuleReference? {         if referenceID == nil, version == nil { return nil }         return try requiredReference(             owner: owner, id: id, field: field, referenceID: referenceID, version: version,-            site: site, rules: rules)+            citation)     } -    /// Every reference resolved here is one the record **already cites**, so-    /// ownership is tested against the union of the hostname's Site rows rather-    /// than against the row that won `SiteResolutionOrder` (Decision 9). A-    /// winner-only test here is what made an Entry's provenance replay come and-    /// go as unrelated teaching flipped the winner.+    /// Every reference resolved here is one the record **already cites**, so it+    /// resolves among the rules the citing record's own Site owns (Req 3.2) — a+    /// fixed pointer rather than the `SiteResolutionOrder` winner, whose+    /// content-dependence is what made an Entry's provenance replay come and go+    /// as unrelated teaching flipped it.     private static func requiredReference(         owner: String, id: String, field: String,-        referenceID: UUID?, version: Int?, site: Site, rules: [String: URLRulePattern]+        referenceID: UUID?, version: Int?,+        _ citation: CitationContext     ) throws -> URLRuleReference {         guard let reference = completeReference(id: referenceID, version: version),-              let rule = rules[reference.id.uuidString],-              rule.version == reference.version,-              CitedRuleResolution.resolves(rule, forRecordsOn: site.hostname) else {+              resolves(citedRule: reference, citation) else {             throw unresolved(owner, id, "\(field) URL rule")         }         return reference@@ -748,17 +872,6 @@ public enum V4LibraryValidator {         Dictionary(uniqueKeysWithValues: groups.map { ($0.key, order($0.rows)) })     } -    /// The winner per key, for the reference lookups that resolve a cited id.-    private static func winners<T>(-        _ groups: [(key: String, rows: [T])], _ order: ([T]) -> [T]-    ) -> [String: T] {-        // `grouped` never emits an empty group, so `compactMap` drops nothing.-        Dictionary(-            uniqueKeysWithValues: groups.compactMap { group in-                order(group.rows).first.map { (group.key, $0) }-            })-    }-     /// One diagnosis per key held by more than one row. The hostname is the one     /// the rows agree on, so every diagnosis can name a site (Req 1.3); rows that     /// disagree resolve to none rather than to an arbitrary one of them.

diff --git a/Packages/AsterismCore/Sources/AsterismCore/V4Migration.swift b/Packages/AsterismCore/Sources/AsterismCore/V4Migration.swiftindex 7180fef..82828e2 100644--- a/Packages/AsterismCore/Sources/AsterismCore/V4Migration.swift+++ b/Packages/AsterismCore/Sources/AsterismCore/V4Migration.swift@@ -68,10 +68,15 @@ public enum V4Migration {         sidecar: MigrationSidecar,         now: Date     ) throws {-        var sitesByHost: [String: Site] = [:]-        for site in try context.fetch(FetchDescriptor<Site>()) {-            sitesByHost[site.hostname] = site-        }+        // Resolve each hostname through `SiteResolutionOrder`, the same+        // deterministic winner the rest of the app picks — not the+        // `sitesByHost[hostname] = site` last-write-wins map this pass used to+        // build over an unsorted fetch (Q16, Q37). Duplicate rows cannot exist+        // when this runs for real, so the behaviour is unchanged; what changes+        // is that the anti-pattern no longer sits two statements upstream of+        // the V5 pass that exists to avoid it.+        let sitesByHost = SiteResolutionOrder.winnersByHostname(+            try context.fetch(FetchDescriptor<Site>()))          for taughtSite in sidecar.taughtSites {             guard case .createWholeTitle(let patternID, let trimPrefix, let trimSuffix) = taughtSite.plan else {

diff --git a/Packages/AsterismCore/Sources/AsterismCore/V5RelationshipPass.swift b/Packages/AsterismCore/Sources/AsterismCore/V5RelationshipPass.swiftnew file mode 100644index 0000000..fdc1397--- /dev/null+++ b/Packages/AsterismCore/Sources/AsterismCore/V5RelationshipPass.swift@@ -0,0 +1,57 @@+import Foundation+import SwiftData++/// The V4 → V5 relationship pass (Req 2.1, 2.2): populates `Entry.site` and+/// `Work.site` from their hostname strings, after the lightweight conversion+/// has added the columns and left every relationship nil.+///+/// Runs in `openV4ForApp` under the exclusive lock, app-only — never as a+/// SwiftData custom stage, which would also run inside the share extension,+/// and the extension must never migrate (Q10, Q14).+///+/// Row selection resolves each hostname through `SiteResolutionOrder` — the+/// same deterministic rule the rest of the app uses — not a last-write-wins+/// map over an unsorted fetch as the V4 completion pass built (Q16). Duplicate+/// Site rows cannot exist when this runs for real (they arise only from+/// mirroring, which ships after), so the determinism is about tests, fixtures,+/// and re-runs — but "arbitrary" would falsify the determinism the milestone+/// claims.+///+/// One save at the end, nothing batched: Req 2.4 rests on the atomicity of+/// this save, with the readiness marker published by the caller only after it+/// returns (Q15). An interruption leaves either no progress or all of it, and+/// the next launch runs the pass again — idempotent by construction (Q12).+enum V5RelationshipPass {+    /// Populates both relationships and saves once. A hostname matching no+    /// Site row leaves the relationship nil: that is the tolerated state this+    /// milestone exists to make survivable, not an error (Req 2.1). The caller+    /// publishes the `"5"` marker only after this returns.+    ///+    /// The save goes through the bootstrap's own `RepositorySaveStrategy` — the+    /// default is a plain `context.save()` — so the failure branch the callers+    /// wrap in `libraryUnavailable("running the relationship migration pass")`+    /// is reachable from a test rather than only from a real disk fault.+    static func run(+        context: ModelContext,+        saveStrategy: any RepositorySaveStrategy = ModelContextSaveStrategy()+    ) throws {+        let winners = SiteResolutionOrder.winnersByHostname(+            try context.fetch(FetchDescriptor<Site>()))++        // Assign the winner even where a relationship is already set (Q33): a+        // record pinned to a row that is no longer the winner would otherwise+        // never converge, and skip-if-set would make the outcome depend on+        // prior state rather than store content. The identity check keeps the+        // already-converged case a true no-op — nothing dirtied, no+        // inverse-array churn.+        for entry in try context.fetch(FetchDescriptor<Entry>()) {+            let winner = winners[entry.hostname]+            if entry.site !== winner { entry.site = winner }+        }+        for work in try context.fetch(FetchDescriptor<Work>()) {+            let winner = winners[work.siteHostname]+            if work.site !== winner { work.site = winner }+        }+        try saveStrategy.save(context)+    }+}

diff --git a/Packages/AsterismCore/Tests/AsterismCoreTests/BackupImportTransactionTests.swift b/Packages/AsterismCore/Tests/AsterismCoreTests/BackupImportTransactionTests.swiftindex 9b7f600..5f87bab 100644--- a/Packages/AsterismCore/Tests/AsterismCoreTests/BackupImportTransactionTests.swift+++ b/Packages/AsterismCore/Tests/AsterismCoreTests/BackupImportTransactionTests.swift@@ -168,7 +168,7 @@ struct BackupImportTransactionTests {         // Library remains ready and empty (Req 1.17): the failed import wrote         // nothing, and readiness was already published when the store was created.         #expect(FileManager.default.fileExists(atPath: env.configuration.v4MarkerURL.path))-        let schema = Schema(versionedSchema: AsterismSchemaV4.self)+        let schema = Schema(versionedSchema: AsterismSchemaV5.self)         let storeConfig = ModelConfiguration(             "AsterismV3",             schema: schema,@@ -177,7 +177,7 @@ struct BackupImportTransactionTests {         )         let container = try ModelContainer(             for: schema,-            migrationPlan: AsterismV4MigrationPlan.self,+            migrationPlan: AsterismV5MigrationPlan.self,             configurations: [storeConfig]         )         let context = ModelContext(container)@@ -514,7 +514,7 @@ private func createReadyEmptyV3Store(at configuration: LibraryConfiguration) thr         at: configuration.v4StoreURL.deletingLastPathComponent(),         withIntermediateDirectories: true     )-    let schema = Schema(versionedSchema: AsterismSchemaV4.self)+    let schema = Schema(versionedSchema: AsterismSchemaV5.self)     let storeConfig = ModelConfiguration(         "AsterismV3",         schema: schema,@@ -523,7 +523,7 @@ private func createReadyEmptyV3Store(at configuration: LibraryConfiguration) thr     )     let container = try ModelContainer(         for: schema,-        migrationPlan: AsterismV4MigrationPlan.self,+        migrationPlan: AsterismV5MigrationPlan.self,         configurations: [storeConfig]     )     let context = ModelContext(container)@@ -537,7 +537,7 @@ private func createReadyPopulatedV3Store(at configuration: LibraryConfiguration)         at: configuration.v4StoreURL.deletingLastPathComponent(),         withIntermediateDirectories: true     )-    let schema = Schema(versionedSchema: AsterismSchemaV4.self)+    let schema = Schema(versionedSchema: AsterismSchemaV5.self)     let storeConfig = ModelConfiguration(         "AsterismV3",         schema: schema,@@ -546,7 +546,7 @@ private func createReadyPopulatedV3Store(at configuration: LibraryConfiguration)     )     let container = try ModelContainer(         for: schema,-        migrationPlan: AsterismV4MigrationPlan.self,+        migrationPlan: AsterismV5MigrationPlan.self,         configurations: [storeConfig]     )     let context = ModelContext(container)

diff --git a/Packages/AsterismCore/Tests/AsterismCoreTests/BackupV4ExportTests.swift b/Packages/AsterismCore/Tests/AsterismCoreTests/BackupV4ExportTests.swiftindex 52f07fb..1ae476d 100644--- a/Packages/AsterismCore/Tests/AsterismCoreTests/BackupV4ExportTests.swift+++ b/Packages/AsterismCore/Tests/AsterismCoreTests/BackupV4ExportTests.swift@@ -108,10 +108,17 @@ struct BackupV4ExportTests {             context.insert(good)              try context.save()+            // Task 19: the marker published below says the relationship pass has+            // run, so the seeded graph must look as though it did — every record+            // pinned to the row `SiteResolutionOrder` picks, and nil only where the+            // hostname carries no Site row at all.+            try V5RelationshipPass.run(context: context)             withExtendedLifetime(container) {}         } -        try LibraryRepository.publishV4Readiness(at: configuration.v4MarkerURL)+        // Seeded at the current schema, so it is marked migrated (Q14, Q26);+        // nothing here simulates a library awaiting the relationship pass.+        try LibraryRepository.publishV5Readiness(at: configuration.v4MarkerURL)          let (_, repository) = try await LibraryRepository.openV4ForApp(             configuration, capabilities: .m4, saveStrategy: ModelContextSaveStrategy())

diff --git a/Packages/AsterismCore/Tests/AsterismCoreTests/CitationResolutionParityTests.swift b/Packages/AsterismCore/Tests/AsterismCoreTests/CitationResolutionParityTests.swiftnew file mode 100644index 0000000..41d1f9b--- /dev/null+++ b/Packages/AsterismCore/Tests/AsterismCoreTests/CitationResolutionParityTests.swift@@ -0,0 +1,518 @@+import Foundation+import SwiftData+import Testing++@testable import AsterismCore++/// Task 12, Req 1.2, 3.2, 4.1–4.3: resolution parity for the eight cited-rule+/// call sites. For each one, the relationship form — a lookup among the citing+/// record's own Site's rules — must resolve the same record the union form did.+/// These tests are written against the union implementation and must stay green+/// through task 14's conversion, so every case here is one on which the two+/// forms agree by construction: the graphs are linked the way the relationship+/// pass and the write sites link them.+///+/// The eight sites, and where each is asserted:+///+/// - `V4LibraryValidator` ×4, reached through two helpers —+///   `resolves(citedRule:…)` (Work rule identity, `requiredReference`) and+///   `citedPattern(id:version:…)` (v3 name contributor, chapter provenance).+///   The superseded and version-mismatch cases live in this file; the nil-site+///   arm — a tolerated diagnosis, no quarantine — is `V4ValidatorNilSiteToleranceTests`,+///   and the duplicate-row arm is `CitedPatternResolutionTests` (Decision 4).+/// - `+RecentPresentation` and `+EntryDetail`, which share `replayCitedPattern`:+///   superseded, version-mismatch and nil-relationship cases here; the+///   pinned-to-a-losing-row case is in their own tolerance suites.+/// - `+ReparseCapture`'s two (the tuple-validation search space in+///   `commitCapture`): the committed capture's citations resolve within the+///   Site row the Entry was assigned.+@Suite("Cited-rule resolution parity across the eight call sites", .serialized)+struct CitationResolutionParityTests {++    private static let epoch = Date(timeIntervalSince1970: 1_800_000_000)++    // MARK: - Validator: the superseded-rule cases (Req 4.1)++    /// Chapter provenance cites the title pattern that produced it, not the+    /// site's active one. Retaining v1 and activating v2 must leave the v1+    /// citation resolving — under the union because the site's rows own it,+    /// under the relationship because `entry.site` owns it.+    @Test("A superseded title pattern keeps resolving at chapter provenance")+    func supersededPatternResolvesAtChapterProvenance() throws {+        let fixture = try V4Fixtures.wcSegmentIdentitySequence()+        fixture.titlePattern.isActive = false+        let v2 = try TitlePattern(+            version: 2, isActive: true, createdAt: Self.epoch,+            definition: .phrase(prefix: "", separator: " — ", suffix: "", order: .chapterThenWork),+            site: fixture.site)+        fixture.site.patterns = fixture.site.patternValues + [v2]+        // The Entry still cites (v1 id, version 1) for its chapter.+        #expect(fixture.entry.chapterPatternID == fixture.titlePattern.id)+        #expect(fixture.entry.chapterPatternVersion == 1)++        let diagnostics = try V4LibraryValidator.validate(graph: fixture.graph)+        #expect(diagnostics.quarantineMap().isEmpty)+        #expect(diagnostics.tupleDiagnoses.isEmpty)+    }++    /// The v3 identity's name contributor is replayed from the *cited* pattern+    /// (Req 4.2), so superseding it must not break the replay.+    @Test("A superseded name contributor keeps resolving at the v3 identity")+    func supersededNameContributorResolvesAtV3Identity() throws {+        let fixture = try V4Fixtures.wholeTitleSequence()+        fixture.titlePattern.isActive = false+        let v2 = try TitlePattern(+            version: 2, isActive: true, createdAt: Self.epoch,+            definition: .wholeTitle, site: fixture.site)+        fixture.site.patterns = fixture.site.patternValues + [v2]+        #expect(fixture.entry.identityNameTitleRuleVersion == 1)++        let diagnostics = try V4LibraryValidator.validate(graph: fixture.graph)+        #expect(diagnostics.quarantineMap().isEmpty)+        #expect(diagnostics.tupleDiagnoses.isEmpty)+    }++    /// The Work's `.rule` identity and the Entry's identity/extraction+    /// references all cite the superseded URL rule; a new current rule must not+    /// unresolve any of them. Covers both `resolves(citedRule:…)` sites — the+    /// Work rule identity and `requiredReference`.+    @Test("A superseded URL rule keeps resolving at the Work identity and requiredReference")+    func supersededURLRuleResolvesAtBothRuleSites() throws {+        let fixture = try V4Fixtures.wcSegmentIdentitySequence()+        fixture.rule.isCurrent = false+        let v3 = try URLRulePattern(+            version: 3, isCurrent: true, createdAt: Self.epoch, origin: .readerTaught,+            definition: .workAndSequence(+                work: URLFieldSelector(locator: .query(name: ExactScalarString("series"))),+                sequence: URLFieldSelector(locator: .query(name: ExactScalarString("chapter")))),+            site: fixture.site)+        fixture.site.urlRules = fixture.site.urlRuleValues + [v3]+        #expect(fixture.work.urlIdentityRuleVersion == 2)+        #expect(fixture.entry.identityURLRuleVersion == 2)++        let diagnostics = try V4LibraryValidator.validate(graph: fixture.graph)+        #expect(diagnostics.quarantineMap().isEmpty)+        #expect(diagnostics.tupleDiagnoses.isEmpty)+    }++    // MARK: - Validator: the version-mismatch cases (Req 4.2)++    /// Id and version are tested together, as every site has always done. A+    /// right id at a version the site never retained fails to resolve under+    /// both forms — and with the relationship populated it is a diagnosis, not+    /// a tolerated state. The pattern-helper equivalents are pinned in+    /// `V4ValidatorNilSiteToleranceTests` (the "populated site still diagnoses"+    /// pair); these cover the rule helper's two sites.+    @Test("A version mismatch on the Work rule identity is diagnosed, not resolved")+    func ruleVersionMismatchDiagnosesAtWorkIdentity() throws {+        let fixture = try V4Fixtures.wcSegmentIdentitySequence()+        fixture.work.urlIdentityRuleVersion = 99++        let diagnostics = try V4LibraryValidator.validate(graph: fixture.graph)+        #expect(diagnostics.quarantineMap()[fixture.site.hostname] != nil)+    }++    @Test("A version mismatch on the assignment reference is diagnosed, not resolved")+    func ruleVersionMismatchDiagnosesAtRequiredReference() throws {+        let fixture = try V4Fixtures.wcSegmentIdentitySequence()+        fixture.entry.workURLRuleVersion = 99++        let diagnostics = try V4LibraryValidator.validate(graph: fixture.graph)+        #expect(diagnostics.quarantineMap()[fixture.site.hostname] != nil)+    }++    // MARK: - Recent's candidate replay (Req 4.1, 4.2)++    /// The replay resolves the cited `(id, version)`, never the active pattern.+    /// The superseded v1 is a segment rule producing "A Cited Work"; the active+    /// v2 is whole-title, which would produce the entire capture title — so a+    /// resolution that reached for the active pattern is distinguishable from+    /// one that resolved the citation.+    @Test("Recent replays the superseded cited pattern, not the site's active one")+    func recentReplaysTheSupersededPattern() async throws {+        let library = try ParityFixture()+        let citedID = UUID()+        try library.seed { store in+            let site = store.insertSite(hostname: "cited.example")+            site.mode = .taught+            try store.insertTitlePattern(+                id: citedID, site: site, isActive: false, version: 1,+                definition: .segmented)+            try store.insertTitlePattern(site: site, isActive: true, version: 2)+            let entry = store.insertEntry(+                hostname: "cited.example", title: "A Cited Work - Chapter 3")+            entry.workAssignmentProvenance = .pattern+            entry.workPatternID = citedID+            entry.workPatternVersion = 1+        }+        let repository = try await library.openForApp()++        let presentation = try await repository.recentPresentation(calendar: .current)++        let row = try #require(presentation.allRows.first)+        #expect(row.unresolvedCandidateTitle == "A Cited Work")+        #expect(row.attention == nil)+    }++    @Test("Recent renders a right-id wrong-version citation as unresolvable")+    func recentVersionMismatchRendersUnresolvable() async throws {+        let library = try ParityFixture()+        let citedID = UUID()+        try library.seed { store in+            let site = store.insertSite(hostname: "cited.example")+            site.mode = .taught+            try store.insertTitlePattern(+                id: citedID, site: site, isActive: true, version: 1,+                definition: .segmented)+            let entry = store.insertEntry(+                hostname: "cited.example", title: "A Cited Work - Chapter 3")+            entry.workAssignmentProvenance = .pattern+            entry.workPatternID = citedID+            entry.workPatternVersion = 99+        }+        let repository = try await library.openForApp()++        let presentation = try await repository.recentPresentation(calendar: .current)++        let row = try #require(presentation.allRows.first)+        #expect(row.attention == .citationUnresolved)+        #expect(row.unresolvedCandidateTitle == nil)+    }++    /// A record whose Site never arrived: resolution yields nothing, and the+    /// caller renders instead of throwing (Req 3.4). The citation's evidence is+    /// not lost — the row is emitted, identified by its capture title.+    @Test("Recent renders an Entry with no Site whose provenance cites a pattern")+    func recentRendersACitingEntryWithNoSite() async throws {+        let library = try ParityFixture()+        try library.seed { store in+            store.insertSite(hostname: "present.example")+            store.insertEntry(hostname: "present.example", title: "resolvable", offset: 10)+            let orphan = store.insertEntry(+                hostname: "orphan.example", title: "orphaned citer")+            orphan.workAssignmentProvenance = .pattern+            orphan.workPatternID = UUID()+            orphan.workPatternVersion = 1+        }+        let repository = try await library.openForApp()++        let presentation = try await repository.recentPresentation(calendar: .current)++        let rows = presentation.allRows+        #expect(rows.count == 2)+        let orphan = try #require(rows.first { $0.captureTitle == "orphaned citer" })+        #expect(orphan.attention == .siteMissing)+        #expect(orphan.unresolvedCandidateTitle == nil)+        let resolvable = try #require(rows.first { $0.captureTitle == "resolvable" })+        #expect(resolvable.attention == nil)+    }++    // MARK: - Entry detail's provenance disclosure (Req 4.1, 4.3)++    @Test("Entry detail replays the superseded cited pattern, not the site's active one")+    func entryDetailReplaysTheSupersededPattern() async throws {+        let library = try ParityFixture()+        let entryID = UUID()+        let citedID = UUID()+        try library.seed { store in+            let site = store.insertSite(hostname: "cited.example")+            site.mode = .taught+            try store.insertTitlePattern(+                id: citedID, site: site, isActive: false, version: 1,+                definition: .segmented)+            try store.insertTitlePattern(site: site, isActive: true, version: 2)+            let entry = store.insertEntry(+                id: entryID, hostname: "cited.example", title: "A Cited Work - Chapter 3")+            entry.workAssignmentProvenance = .pattern+            entry.workPatternID = citedID+            entry.workPatternVersion = 1+        }+        let repository = try await library.openForApp()++        let detail = try await repository.entryTeachingDetail(id: entryID)++        #expect(detail.unresolvedCandidateTitle == "A Cited Work")+    }++    /// Same state through the detail screen: no Site, a citation on record, no+    /// throw. The cited identity stays disclosed as evidence (Req 4.2).+    @Test("Entry detail renders an Entry with no Site whose provenance cites a pattern")+    func entryDetailRendersACitingEntryWithNoSite() async throws {+        let library = try ParityFixture()+        let entryID = UUID()+        let citedID = UUID()+        try library.seed { store in+            store.insertSite(hostname: "present.example")+            let orphan = store.insertEntry(+                id: entryID, hostname: "orphan.example", title: "Orphaned Citer")+            orphan.workAssignmentProvenance = .pattern+            orphan.workPatternID = citedID+            orphan.workPatternVersion = 1+        }+        let repository = try await library.openForApp()++        let detail = try await repository.entryTeachingDetail(id: entryID)++        #expect(detail.siteMode == .untaught)+        #expect(detail.unresolvedCandidateTitle == nil)+        #expect(detail.displayTitle == "Orphaned Citer")+        // The citation is retained as evidence, whatever settlement wording the+        // screen chooses for it.+        if case .patternUnsettled(let patternID, let version, _) = detail.assignmentSettlement {+            #expect(patternID == citedID)+            #expect(version == 1)+        } else {+            Issue.record("expected a pattern settlement carrying the cited identity, got \(detail.assignmentSettlement)")+        }+    }++    // MARK: - The capture commit's tuple-validation search space++    /// `commitCapture` validates the tuple it just wrote against a cited search+    /// space. The parity claim: every citation the committed Entry carries+    /// resolves within the Site row the Entry was assigned — which is what the+    /// relationship form searches, and a subset of what the union searched.+    @Test("A committed capture's citations resolve within the Site it was assigned")+    func captureCitationsResolveWithinTheAssignedRow() async throws {+        let library = try ParityFixture()+        try library.seed { store in+            let site = store.insertSite(hostname: "taught.example")+            site.mode = .untaught+            store.insertEntry(+                hostname: "taught.example", title: "Chapter 7 - Real Work",+                url: "https://taught.example/read?id=42&chapter=7")+        }+        let repository = try await library.openForApp()+        let teaching = try await repository.projectComposedTeaching(+            hostname: "taught.example",+            request: ComposedTeachingRequest(+                titleDefinition: .segment(+                    work: try SegmentRangeSpec(origin: .end, offset: 0, length: 1), ignored: []),+                urlDefinition: .workAndSequence(+                    work: URLFieldSelector(locator: .query(name: ExactScalarString("id"))),+                    sequence: URLFieldSelector(locator: .query(name: ExactScalarString("chapter"))))))+        guard case .committed = try await repository.commitComposedTeaching(teaching) else {+            Issue.record("the teaching did not commit")+            return+        }++        let contract = try await repository.projectCapture(+            hostname: "taught.example", captureTitle: "Chapter 9 - Real Work",+            captureTitleSource: .safariDocument,+            rawURLString: "https://taught.example/read?id=42&chapter=9",+            canonicalURLString: nil, note: "", rating: nil)+        guard case .committed(let snapshot) = try await repository.commitCapture(contract) else {+            Issue.record("the capture did not commit")+            return+        }++        let context = try library.readContext()+        let entry = try #require(try context.fetch(FetchDescriptor<Entry>())+            .first { $0.id == snapshot.id })+        let assigned = try #require(entry.site, "the capture left its Entry unassigned")+        if let patternID = entry.chapterPatternID, let patternVersion = entry.chapterPatternVersion {+            #expect(assigned.patternValues.contains {+                $0.id == patternID && $0.version == patternVersion+            }, "the cited chapter pattern is not owned by the assigned Site row")+        } else {+            Issue.record("the capture cited no chapter pattern; the search-space assertion proves nothing")+        }+        let ruleID = try #require(entry.identityURLRuleID)+        let ruleVersion = try #require(entry.identityURLRuleVersion)+        #expect(assigned.urlRuleValues.contains {+            $0.id == ruleID && $0.version == ruleVersion+        }, "the cited URL rule is not owned by the assigned Site row")+    }+}++// MARK: - Re-parse follows the Entry's own row (task 16)++/// The two re-parse entry points are reached from an existing Entry, so task 16+/// converted their Site resolution to `entry.site` (Req 3.1). The three+/// capture-shaped `fetchSites` calls in the same file keep the hostname lookup+/// (Req 3.3); their behaviour is pinned by the capture suites.+@Suite("Re-parse resolves the Entry's own Site row", .serialized)+struct ReparseSiteResolutionTests {++    /// On a duplicated hostname, the re-parse basis is built from the row the+    /// Entry points at — here the row that *loses* `SiteResolutionOrder` — not+    /// from the current winner, whose teaching says nothing about this Entry.+    @Test("Re-parse projects from the Entry's own non-winner row")+    func reparseProjectsFromTheEntrysOwnRow() async throws {+        let library = try ParityFixture()+        let entryID = UUID()+        let ids = [UUID(), UUID()].sorted()+        let winnerPatternID = ids[0]+        let loserPatternID = ids[1]+        try library.seed { store in+            let winner = store.insertSite(hostname: "dup.example", displayName: "win-row")+            winner.mode = .taught+            try store.insertTitlePattern(+                id: winnerPatternID, site: winner, isActive: true, version: 1,+                definition: .segmented)+            let loser = store.insertSite(hostname: "dup.example", displayName: "lose-row")+            loser.mode = .taught+            try store.insertTitlePattern(+                id: loserPatternID, site: loser, isActive: true, version: 1)+            store.insertEntry(id: entryID, hostname: "dup.example", title: "A Work - Chapter 1")+        }+        // Pin the Entry to the losing row — the sync-shaped graph (Decision 4);+        // the seed's pass pinned it to the winner.+        try library.mutate { context in+            let sites = try context.fetch(FetchDescriptor<Site>())+            let loser = try #require(sites.first { $0.displayName == "lose-row" })+            let entry = try #require(try context.fetch(FetchDescriptor<Entry>())+                .first { $0.id == entryID })+            entry.site = loser+        }+        let repository = try await library.openForApp()++        let contract = try await repository.projectReparse(entryID: entryID)++        #expect(contract.basis.activePattern?.id == loserPatternID,+                "the re-parse basis came from the hostname winner, not the Entry's own row")+    }++    /// An Entry with no Site relationship takes the refusal an untaught+    /// hostname always took — an action is legitimately refused; only+    /// rendering, quarantine and export must survive a nil relationship+    /// (Req 3.4).+    @Test("Re-parse refuses an Entry with no Site relationship, as it refuses an untaught hostname")+    func reparseRefusesANilRelationship() async throws {+        let library = try ParityFixture()+        let entryID = UUID()+        try library.seed { store in+            store.insertEntry(id: entryID, hostname: "orphan.example", title: "Orphaned")+        }+        let repository = try await library.openForApp()++        do {+            _ = try await repository.projectReparse(entryID: entryID)+            Issue.record("expected the projection to refuse")+        } catch let error as LibraryRepositoryError {+            guard case .invalidInput = error else {+                Issue.record("expected invalidInput, got \(error)")+                return+            }+        }+    }+}++// MARK: - Fixture++/// A fixed-path V4 library seeded through plain `insert`/`save`, linked by+/// `V5RelationshipPass` (Q42) and opened the way the app opens it.+private final class ParityFixture {+    static let epoch = Date(timeIntervalSince1970: 1_800_000_000)++    let directory: URL+    let configuration: LibraryConfiguration++    init() throws {+        directory = FileManager.default.temporaryDirectory+            .appending(path: "AsterismCitationParity-\(UUID())", directoryHint: .isDirectory)+        try FileManager.default.createDirectory(at: directory, withIntermediateDirectories: true)+        configuration = LibraryConfiguration(rootDirectory: directory, environment: .development)+        try FileManager.default.createDirectory(+            at: configuration.v4StoreURL.deletingLastPathComponent(),+            withIntermediateDirectories: true)+    }++    func seed(_ body: (ParitySeedStore) throws -> Void) throws {+        let container = try LibraryRepository.openV4Container(at: configuration.v4StoreURL)+        let store = ParitySeedStore(context: ModelContext(container))+        try body(store)+        try store.context.save()+        try V5RelationshipPass.run(context: store.context)+        withExtendedLifetime(container) {}+        try LibraryRepository.publishV5Readiness(at: configuration.v4MarkerURL)+    }++    func readContext() throws -> ModelContext {+        let container = try LibraryRepository.openV4Container(at: configuration.v4StoreURL)+        containers.append(container)+        return ModelContext(container)+    }++    /// Mutates the seeded store *without* re-running the relationship pass —+    /// for the one shape the pass cannot express (Decision 4): a record pinned+    /// to a duplicate row other than the hostname winner.+    func mutate(_ body: (ModelContext) throws -> Void) throws {+        let container = try LibraryRepository.openV4Container(at: configuration.v4StoreURL)+        let context = ModelContext(container)+        try body(context)+        try context.save()+        withExtendedLifetime(container) {}+    }++    func openForApp() async throws -> LibraryRepository {+        let (_, repository) = try await LibraryRepository.openV4ForApp(+            configuration, capabilities: .m4,+            clock: FixedRepositoryClock(Self.epoch),+            saveStrategy: ModelContextSaveStrategy())+        return repository+    }++    /// A `ModelContext` does not retain its container, so every container this+    /// fixture hands out has to outlive the test using it.+    private var containers: [ModelContainer] = []++    deinit {+        try? FileManager.default.removeItem(at: directory)+    }+}++private extension PatternDefinition {+    /// Names the Work from the first separator-delimited segment, so a replay of+    /// "A Cited Work - Chapter 3" produces "A Cited Work" — distinguishable from+    /// the whole-title form used as the active pattern in the superseded tests.+    static var segmented: PatternDefinition {+        get throws {+            .segment(work: try SegmentRangeSpec(origin: .start, offset: 0, length: 1), ignored: [])+        }+    }+}++private final class ParitySeedStore {+    let context: ModelContext++    init(context: ModelContext) {+        self.context = context+    }++    @discardableResult+    func insertSite(hostname: String, displayName: String? = nil) -> Site {+        let site = Site(hostname: hostname, displayName: displayName)+        context.insert(site)+        return site+    }++    @discardableResult+    func insertEntry(+        id: UUID = UUID(), hostname: String, title: String, offset: TimeInterval = 0,+        url: String? = nil+    ) -> Entry {+        let rawURL = url ?? "https://\(hostname)/read/\(UUID().uuidString)"+        let entry = Entry(+            id: id, captureTitle: title, captureTitleSource: .host, rawURLString: rawURL,+            hostname: hostname, entryIdentityKey: rawURL,+            timestamp: ParityFixture.epoch.addingTimeInterval(offset))+        entry.conservativeIdentityKey = rawURL+        context.insert(entry)+        return entry+    }++    @discardableResult+    func insertTitlePattern(+        id: UUID = UUID(), site: Site, isActive: Bool = false, version: Int = 1,+        offset: TimeInterval = 0, definition: PatternDefinition = .wholeTitle+    ) throws -> TitlePattern {+        let pattern = try TitlePattern(+            id: id, version: version, isActive: isActive,+            createdAt: ParityFixture.epoch.addingTimeInterval(offset),+            definition: definition, site: site)+        context.insert(pattern)+        site.patterns = site.patternValues + [pattern]+        return pattern+    }+}

diff --git a/Packages/AsterismCore/Tests/AsterismCoreTests/ComposedCaptureTests.swift b/Packages/AsterismCore/Tests/AsterismCoreTests/ComposedCaptureTests.swiftindex 0e4c806..f64b199 100644--- a/Packages/AsterismCore/Tests/AsterismCoreTests/ComposedCaptureTests.swift+++ b/Packages/AsterismCore/Tests/AsterismCoreTests/ComposedCaptureTests.swift@@ -37,8 +37,7 @@ struct ComposedCaptureTests {         let context = fixture.freshContext()         let entry = try #require(try context.fetch(FetchDescriptor<Entry>()).first { $0.id == snapshot.id })         try V4LibraryValidator.validateEntryTuple(-            entry: entry, site: fixture.site(context), works: entry.work.map { [$0] } ?? [],-            patterns: fixture.site(context).patternValues, rules: fixture.site(context).urlRuleValues)+            entry: entry, site: fixture.site(context), works: entry.work.map { [$0] } ?? [])         #expect(entry.identityKeyVersion == 2)         #expect(entry.conservativeIdentityKey == entry.rawURLString)         #expect(entry.chapterTitle == "Chapter 9")

diff --git a/Packages/AsterismCore/Tests/AsterismCoreTests/EntryDetailAndMergeToleranceTests.swift b/Packages/AsterismCore/Tests/AsterismCoreTests/EntryDetailAndMergeToleranceTests.swiftindex 4721643..31391b0 100644--- a/Packages/AsterismCore/Tests/AsterismCoreTests/EntryDetailAndMergeToleranceTests.swift+++ b/Packages/AsterismCore/Tests/AsterismCoreTests/EntryDetailAndMergeToleranceTests.swift@@ -100,12 +100,16 @@ struct EntryDetailAndMergeToleranceTests {         #expect(!detail.hasCurrentURLRule)     } -    /// Decision 9 end to end through the detail screen. The Entry cites a pattern-    /// owned by the Site row that *lost* the tiebreak; the disclosure replays it.-    /// This code has been in place since task 13 and unreachable until now, because-    /// the `sites.count == 1` guard threw two lines above it.-    @Test("Entry detail replays a cited pattern owned by the losing Site row")-    func entryDetailReplaysAcrossTheUnionOfRows() async throws {+    /// The provenance half of Decision 5 through the detail screen, in the shape+    /// Decision 4 preserves — what Decision 9 of+    /// `specs/library-integrity-tolerance` used the hostname-wide union for. The+    /// Entry cites a pattern owned by the Site row that *lost* the tiebreak, and it is pinned to that row — the sync-shaped graph, since only+    /// mirroring can produce two rows with split citation ownership. The+    /// disclosure replays the citation; a winner-only lookup would find nothing,+    /// which is the failure the union removed and the record's own relationship+    /// must keep removed (task 14).+    @Test("Entry detail replays a cited pattern owned by the Entry's own non-winner row")+    func entryDetailReplayFollowsTheEntrysOwnRow() async throws {         let library = try ToleranceFixture()         let entryID = UUID()         let ids = [UUID(), UUID()].sorted()@@ -126,6 +130,17 @@ struct EntryDetailAndMergeToleranceTests {             entry.workPatternID = losingPatternID             entry.workPatternVersion = 1         }+        // Pin the Entry to the row that owns its citation, undoing the seed's+        // winner-pinning pass for this one record (Decision 4): a synced+        // relationship arrives as a pointer to its originating row, never+        // through hostname resolution.+        try library.mutate { context in+            let sites = try context.fetch(FetchDescriptor<Site>())+            let loser = try #require(sites.first { $0.displayName == "lose-row" })+            let entry = try #require(try context.fetch(FetchDescriptor<Entry>())+                .first { $0.id == entryID })+            entry.site = loser+        }         let repository = try await library.openForApp()          let detail = try await repository.entryTeachingDetail(id: entryID)@@ -133,6 +148,96 @@ struct EntryDetailAndMergeToleranceTests {         #expect(detail.unresolvedCandidateTitle == "A Cited Work")     } +    /// The other half of Q13 (relational-references Req 3.4). This replay threw+    /// `corruptLibrary` uncaught as well, so an Entry citing a pattern version its+    /// Site never retained lost the whole detail screen. The version test is not+    /// optional — Req 4.2 requires it — so the citation must fail to resolve here+    /// and still be disclosed rather than thrown.+    @Test("Entry detail renders when the cited pattern version resolves nowhere")+    func entryDetailRendersAnUnresolvableCitation() async throws {+        let library = try ToleranceFixture()+        let entryID = UUID()+        let patternID = UUID()+        try library.seed { store in+            let site = store.insertSite(hostname: "taught.example")+            site.mode = .taught+            try store.insertTitlePattern(+                id: patternID, site: site, isActive: true, version: 1, definition: .segmented)+            let entry = store.insertEntry(+                id: entryID, hostname: "taught.example", title: "A Cited Work - Chapter 3")+            entry.workAssignmentProvenance = .pattern+            // The right id at a version the Site never retained.+            entry.workPatternID = patternID+            entry.workPatternVersion = 2+        }+        let repository = try await library.openForApp()++        let detail = try await repository.entryTeachingDetail(id: entryID)++        #expect(detail.unresolvedCandidateTitle == nil)+        // Everything the screen *could* resolve is still disclosed.+        #expect(detail.siteMode == .taught)+        #expect(detail.activePatternSummary?.id == patternID)+        // Marked as needing attention in the vocabulary this screen already uses+        // for a degraded field, with the cited identity kept as evidence (Req 4.2).+        #expect(+            detail.assignmentSettlement+                == .patternUnsettled(+                    patternID: patternID, version: 2,+                    reason: "Cited title pattern does not resolve"))+    }++    /// The split itself, on one screen (Decision 5). The Entry is pinned to the+    /// row that lost the tiebreak, and the two rows teach *different* active+    /// patterns — so a screen reading everything from one row would be visibly+    /// wrong whichever row it picked. Presentation is the hostname's current+    /// teaching (the winner's active pattern); provenance is the Entry's own+    /// row's pattern, replayed to produce the candidate title. Both halves are+    /// asserted, because either one alone passes for the wrong reason.+    @Test("Entry detail presents the winner's teaching and replays its own row's citation")+    func entryDetailSplitsPresentationFromProvenance() async throws {+        let library = try ToleranceFixture()+        let entryID = UUID()+        let ids = [UUID(), UUID()].sorted()+        let winningPatternID = ids[0]+        let losingPatternID = ids[1]+        try library.seed { store in+            let winner = store.insertSite(hostname: "dup.example", displayName: "win-row")+            winner.mode = .taught+            // Names the Work from the *first* segment: "A Cited Work".+            try store.insertTitlePattern(+                id: winningPatternID, site: winner, isActive: true, definition: .segmented)+            let loser = store.insertSite(hostname: "dup.example", displayName: "lose-row")+            loser.mode = .taught+            // Names it from the *last* segment: "Chapter 3". Same title, other answer.+            try store.insertTitlePattern(+                id: losingPatternID, site: loser, isActive: true,+                definition: .segmentedFromTheEnd)++            let entry = store.insertEntry(+                id: entryID, hostname: "dup.example", title: "A Cited Work - Chapter 3")+            entry.workAssignmentProvenance = .pattern+            entry.workPatternID = losingPatternID+            entry.workPatternVersion = 1+        }+        try library.mutate { context in+            let sites = try context.fetch(FetchDescriptor<Site>())+            let loser = try #require(sites.first { $0.displayName == "lose-row" })+            let entry = try #require(try context.fetch(FetchDescriptor<Entry>())+                .first { $0.id == entryID })+            entry.site = loser+        }+        let repository = try await library.openForApp()++        let detail = try await repository.entryTeachingDetail(id: entryID)++        // Presentation: the hostname's winner, the same row Recent presents.+        #expect(detail.siteMode == .taught)+        #expect(detail.activePatternSummary?.id == winningPatternID)+        // Provenance: the Entry's own row, whose pattern names the last segment.+        #expect(detail.unresolvedCandidateTitle == "Chapter 3")+    }+     @Test("Entry detail resolves the earliest of two Entries sharing an application UUID")     func entryDetailResolvesADuplicateEntryUUID() async throws {         let library = try ToleranceFixture()@@ -291,6 +396,80 @@ struct EntryDetailAndMergeToleranceTests {         #expect(reason.lowercased().contains("resolve"))     } +    /// The Work URL basis derives its current rule from the Work's Site. A Work+    /// on a hostname with no Site row simply has no current rule — the same+    /// answer the Merge basis gives — and the projection still renders.+    @Test("Work URL projects when the hostname has no Site row")+    func workURLBasisResolvesWithNoSiteRow() async throws {+        let library = try ToleranceFixture()+        let orphanWorkID = UUID()+        try library.seed { store in+            store.insertSite(hostname: "present.example")+            let work = store.insertWork(+                id: orphanWorkID, hostname: "orphan.example", title: "Orphaned Work")+            let entry = store.insertEntry(+                hostname: "orphan.example", title: "chapter",+                url: "https://orphan.example/read/1")+            entry.work = work+            entry.workAssignmentProvenance = .manual+        }+        let repository = try await library.openForApp()++        let contract = try await repository.projectWorkURL(+            workID: orphanWorkID, request: WorkURLRequest.clear)++        #expect(contract.basis.workID == orphanWorkID)+        #expect(contract.basis.currentRule == nil)+    }++    /// The Work URL basis is the other half of Decision 5: a Work is in hand, so+    /// its current rule comes from the row it points at. Both rows here own a+    /// current URL rule and they differ, so the winner's rule and the Work's own+    /// row's rule are distinguishable — which is what makes this a test rather+    /// than a restatement of the code.+    @Test("Work URL projects the rule of the Work's own row, not the winner's")+    func workURLBasisFollowsTheWorksOwnRow() async throws {+        let library = try ToleranceFixture()+        let workID = UUID()+        let patternIDs = [UUID(), UUID()].sorted()+        let losingRuleID = UUID()+        try library.seed { store in+            // Step 3 of `SiteResolutionOrder` decides: lowest owned pattern id.+            let winner = store.insertSite(hostname: "dup.example", displayName: "win-row")+            winner.mode = .taught+            try store.insertTitlePattern(id: patternIDs[0], site: winner, isActive: true)+            try store.insertURLRule(site: winner, work: "s", sequence: "c")++            let loser = store.insertSite(hostname: "dup.example", displayName: "lose-row")+            loser.mode = .taught+            try store.insertTitlePattern(id: patternIDs[1], site: loser, isActive: true)+            try store.insertURLRule(+                id: losingRuleID, site: loser, work: "series", sequence: "chapter")++            let work = store.insertWork(+                id: workID, hostname: "dup.example", title: "On The Losing Row")+            let entry = store.insertEntry(+                hostname: "dup.example", title: "chapter", url: "https://dup.example/read/1")+            entry.work = work+            entry.workAssignmentProvenance = .manual+        }+        // The pass pins every record on a hostname to the winner; this Work+        // arrived from the other row, which only mirroring can produce (Decision 4).+        try library.mutate { context in+            let sites = try context.fetch(FetchDescriptor<Site>())+            let loser = try #require(sites.first { $0.displayName == "lose-row" })+            let work = try #require(try context.fetch(FetchDescriptor<Work>())+                .first { $0.id == workID })+            work.site = loser+        }+        let repository = try await library.openForApp()++        let contract = try await repository.projectWorkURL(+            workID: workID, request: WorkURLRequest.clear)++        #expect(contract.basis.currentRule?.id == losingRuleID)+    }+     // MARK: - Merge destinations      /// Not named in the throw-demotion inventory, but it carries the same@@ -325,6 +504,14 @@ private extension PatternDefinition {             .segment(work: try SegmentRangeSpec(origin: .start, offset: 0, length: 1), ignored: [])         }     }++    /// The same form reading from the other end, so two rows teaching the same+    /// hostname produce different Work names from one capture title.+    static var segmentedFromTheEnd: PatternDefinition {+        get throws {+            .segment(work: try SegmentRangeSpec(origin: .end, offset: 0, length: 1), ignored: [])+        }+    } }  /// A fixed-path V4 library seeded through plain `insert`/`save` and then opened@@ -351,8 +538,15 @@ private final class ToleranceFixture {         let store = ToleranceSeedStore(context: ModelContext(container))         try body(store)         try store.context.save()+        // Task 19: the marker published below says the relationship pass has+        // run, so the seeded graph must look as though it did — every record+        // pinned to the row `SiteResolutionOrder` picks, and nil only where the+        // hostname carries no Site row at all.+        try V5RelationshipPass.run(context: store.context)         withExtendedLifetime(container) {}-        try LibraryRepository.publishV4Readiness(at: configuration.v4MarkerURL)+        // Seeded at the current schema, so it is marked migrated (Q14, Q26);+        // nothing here simulates a library awaiting the relationship pass.+        try LibraryRepository.publishV5Readiness(at: configuration.v4MarkerURL)     }      func readContext() throws -> ModelContext {@@ -361,6 +555,17 @@ private final class ToleranceFixture {         return ModelContext(container)     } +    /// Mutates the seeded store *without* re-running the relationship pass —+    /// for the one shape the pass cannot express (Decision 4): a record pinned+    /// to the duplicate row that owns its citations rather than to the winner.+    func mutate(_ body: (ModelContext) throws -> Void) throws {+        let container = try LibraryRepository.openV4Container(at: configuration.v4StoreURL)+        let context = ModelContext(container)+        try body(context)+        try context.save()+        withExtendedLifetime(container) {}+    }+     func openForApp() async throws -> LibraryRepository {         let (_, repository) = try await LibraryRepository.openV4ForApp(             configuration, capabilities: .m4,@@ -445,6 +650,25 @@ private final class ToleranceSeedStore {         }     } +    /// A current `.workAndSequence` URL rule owned by `site`. The query names+    /// are the caller's, so two rows can own rules that are distinguishable in a+    /// basis.+    @discardableResult+    func insertURLRule(+        id: UUID = UUID(), site: Site, work: String, sequence: String, version: Int = 1+    ) throws -> URLRulePattern {+        let rule = try URLRulePattern(+            id: id, version: version, isCurrent: true, createdAt: ToleranceFixture.epoch,+            origin: .readerTaught,+            definition: .workAndSequence(+                work: URLFieldSelector(locator: .query(name: ExactScalarString(work))),+                sequence: URLFieldSelector(locator: .query(name: ExactScalarString(sequence)))),+            site: site)+        context.insert(rule)+        site.urlRules = site.urlRuleValues + [rule]+        return rule+    }+     @discardableResult     func insertTitlePattern(         id: UUID = UUID(), site: Site, isActive: Bool = false, version: Int = 1,

diff --git a/Packages/AsterismCore/Tests/AsterismCoreTests/FailClosedRegressionTests.swift b/Packages/AsterismCore/Tests/AsterismCoreTests/FailClosedRegressionTests.swiftindex 864e405..b5ffb6a 100644--- a/Packages/AsterismCore/Tests/AsterismCoreTests/FailClosedRegressionTests.swift+++ b/Packages/AsterismCore/Tests/AsterismCoreTests/FailClosedRegressionTests.swift@@ -175,8 +175,15 @@ private final class FailClosedFixture {         let store = FailClosedSeedStore(context: ModelContext(container))         try body(store)         try store.context.save()+        // Task 19: the marker published below says the relationship pass has+        // run, so the seeded graph must look as though it did — every record+        // pinned to the row `SiteResolutionOrder` picks, and nil only where the+        // hostname carries no Site row at all.+        try V5RelationshipPass.run(context: store.context)         withExtendedLifetime(container) {}-        try LibraryRepository.publishV4Readiness(at: configuration.v4MarkerURL)+        // Marked migrated, or the extension would decline on the marker alone+        // and never reach the state under test (Q14).+        try LibraryRepository.publishV5Readiness(at: configuration.v4MarkerURL)     }      /// A store file that is not a store, plus a readiness marker claiming it is.@@ -184,7 +191,7 @@ private final class FailClosedFixture {     func writeUnreadableStore() throws -> Data {         let evidence = Data("this is not a sqlite store".utf8)         try evidence.write(to: configuration.v4StoreURL)-        try LibraryRepository.publishV4Readiness(at: configuration.v4MarkerURL)+        try LibraryRepository.publishV5Readiness(at: configuration.v4MarkerURL)         return evidence     } 

(binary file — no textual diff)

(binary file — no textual diff)

diff --git a/Packages/AsterismCore/Tests/AsterismCoreTests/IdentityLookupToleranceTests.swift b/Packages/AsterismCore/Tests/AsterismCoreTests/IdentityLookupToleranceTests.swiftindex 7ade51b..c7a6c1a 100644--- a/Packages/AsterismCore/Tests/AsterismCoreTests/IdentityLookupToleranceTests.swift+++ b/Packages/AsterismCore/Tests/AsterismCoreTests/IdentityLookupToleranceTests.swift@@ -91,8 +91,13 @@ struct IdentityLookupToleranceTests {         #expect(work.displayTitle == "earliest")     } -    @Test("titlePattern(id:) resolves the earliest of three rows sharing an application UUID")-    func titlePatternResolvesAWinner() async throws {+    /// The pattern half of the same ordering, read where it is actually used.+    /// `RecordResolutionOrder.sortedPatterns` is what `validate(graph:)` indexes+    /// duplicate patterns through; the `titlePattern(id:)` accessor that used to+    /// stand in for it here was a global id-only fetch with no production caller+    /// and was deleted (Q55).+    @Test("Pattern ordering resolves the earliest of three rows sharing an application UUID")+    func titlePatternResolvesAWinner() throws {         let library = try LibraryFixture()         let shared = UUID()         try library.seed { store in@@ -101,11 +106,13 @@ struct IdentityLookupToleranceTests {             try store.insertTitlePattern(id: shared, site: site, version: 1, offset: 0)             try store.insertTitlePattern(id: shared, site: site, version: 9, offset: 40)         }-        let repository = try await library.openForApp() -        let snapshot = try await repository.titlePattern(id: shared)+        let rows = try library.readContext().fetch(FetchDescriptor<TitlePattern>())+            .filter { $0.id == shared }+        let winner = RecordResolutionOrder.sortedPatterns(rows).first -        #expect(snapshot.version == 1)+        #expect(rows.count == 3)+        #expect(winner?.version == 1)     }      // MARK: - entriesByID and worksByID@@ -312,14 +319,20 @@ private final class LibraryFixture {     }      /// Seeds the store in a scoped container, releases it, and publishes-    /// readiness so both bootstrap paths accept the library.+    /// migrated readiness so both bootstrap paths accept the library — the+    /// extension accepts no other version (Q14).     func seed(_ body: (SeedStore) throws -> Void) throws {         let container = try LibraryRepository.openV4Container(at: configuration.v4StoreURL)         let store = SeedStore(context: ModelContext(container))         try body(store)         try store.context.save()+        // Task 19: the marker published below says the relationship pass has+        // run, so the seeded graph must look as though it did — every record+        // pinned to the row `SiteResolutionOrder` picks, and nil only where the+        // hostname carries no Site row at all.+        try V5RelationshipPass.run(context: store.context)         withExtendedLifetime(container) {}-        try LibraryRepository.publishV4Readiness(at: configuration.v4MarkerURL)+        try LibraryRepository.publishV5Readiness(at: configuration.v4MarkerURL)     }      /// A fresh container and context over the seeded file — the offline stand-in

diff --git a/Packages/AsterismCore/Tests/AsterismCoreTests/IdentityResolutionTests.swift b/Packages/AsterismCore/Tests/AsterismCoreTests/IdentityResolutionTests.swiftindex 39957d5..25896c7 100644--- a/Packages/AsterismCore/Tests/AsterismCoreTests/IdentityResolutionTests.swift+++ b/Packages/AsterismCore/Tests/AsterismCoreTests/IdentityResolutionTests.swift@@ -429,12 +429,12 @@ private final class ResolutionStore {     }      private static func makeContainer(at directory: URL) throws -> ModelContainer {-        let schema = Schema(versionedSchema: AsterismSchemaV4.self)+        let schema = Schema(versionedSchema: AsterismSchemaV5.self)         let configuration = ModelConfiguration(             "AsterismV3", schema: schema,             url: directory.appending(path: "library.store"), cloudKitDatabase: .none)         return try ModelContainer(-            for: schema, migrationPlan: AsterismV4MigrationPlan.self,+            for: schema, migrationPlan: AsterismV5MigrationPlan.self,             configurations: [configuration])     } 

diff --git a/Packages/AsterismCore/Tests/AsterismCoreTests/LibraryToleranceScanTests.swift b/Packages/AsterismCore/Tests/AsterismCoreTests/LibraryToleranceScanTests.swiftindex 09f3ce5..2788a93 100644--- a/Packages/AsterismCore/Tests/AsterismCoreTests/LibraryToleranceScanTests.swift+++ b/Packages/AsterismCore/Tests/AsterismCoreTests/LibraryToleranceScanTests.swift@@ -349,12 +349,12 @@ private final class ToleranceScanStore {     }      private static func makeContainer(at directory: URL) throws -> ModelContainer {-        let schema = Schema(versionedSchema: AsterismSchemaV4.self)+        let schema = Schema(versionedSchema: AsterismSchemaV5.self)         let configuration = ModelConfiguration(             "AsterismV3", schema: schema,             url: directory.appending(path: "library.store"), cloudKitDatabase: .none)         return try ModelContainer(-            for: schema, migrationPlan: AsterismV4MigrationPlan.self,+            for: schema, migrationPlan: AsterismV5MigrationPlan.self,             configurations: [configuration])     } 

diff --git a/Packages/AsterismCore/Tests/AsterismCoreTests/M4MigrationScalePerformanceTests.swift b/Packages/AsterismCore/Tests/AsterismCoreTests/M4MigrationScalePerformanceTests.swiftnew file mode 100644index 0000000..fb9808e--- /dev/null+++ b/Packages/AsterismCore/Tests/AsterismCoreTests/M4MigrationScalePerformanceTests.swift@@ -0,0 +1,404 @@+import Foundation+import SwiftData+import Testing++@testable import AsterismCore++// MARK: - Req 2.6 — the relationship pass at scale++/// The V4 → V5 relationship migration against its 10 s budget+/// (relational-references Req 2.6), over the same 5,000-Entry composed fixture+/// the rest of the M4 budgets use.+///+/// **What is being bounded is inverse-array maintenance.** Setting `entry.site`+/// 5,000 times populates one `Site.entries` array, because the M4 fixture is a+/// *single* Site (`LibraryRepository.m4FixtureHostname`, 1,000 Works × 5+/// chapters on one hostname) rather than the ~40 the design first assumed. That+/// is the most expensive shape available for this pass, which is why it is the+/// right one to budget against — do not spread the Entries across hostnames to+/// meet the number.+///+/// **Four ways this measurement can silently measure nothing**, all guarded+/// below rather than trusted:+///+/// 1. *The pass is skipped when the marker reads `"5"`.* `openV4ForApp` runs it+///    only on a `"4"` marker (Q31), and every seeded fixture publishes `"5"`.+///    `passOverTheScaleFixture` therefore calls `V5RelationshipPass.run`+///    directly, and `certificationOverTheScaleFixture` writes a `"4"` marker+///    before every timed open.+/// 2. *Nulling the relationships must be committed and the store reopened.*+///    `M4PerformanceFixture` sets both halves inline (Q43) and the pass skips an+///    assignment whose winner is already identical (Q33), so run straight over+///    the seeded fixture it dirties nothing, maintains no inverse array, and+///    clears 10 s by doing no work. `strip()` nulls both relationships in its+///    own container, saves, and releases it — nulling in the timing context+///    would leave the inverse arrays warm and the objects registered, which is+///    not the state certification runs in.+/// 3. *`.siteMissing` is not a pre-pass graph.* That tolerated state deletes the+///    Site row, so the pass correctly assigns nothing: a fast, meaningless+///    number. The coherent fixture is used, stripped.+/// 4. *A pre-count alone cannot tell a pass that did the work from one that+///    iterated 5,000 records and assigned none.* Both the pre-timing nil count+///    and the post-pass non-nil count are asserted, the latter from a fresh+///    container so it is the persisted state.+///+/// Same statistical protocol as the suites next door (Decision 10 of+/// `library-integrity-tolerance`): median asserted every run, p95 asserted only+/// under `CONTROLLED=1`, whole distribution reported either way. Opt-in through+/// `ASTERISM_RUN_PHYSICAL_PERFORMANCE=1`, so `make test-core` never runs it;+/// drive it with `make test-performance-m4`.+@Suite(+    "M4 migration scale budget", .serialized,+    .enabled(if: ProcessInfo.processInfo.environment["ASTERISM_RUN_PHYSICAL_PERFORMANCE"] == "1"))+struct M4MigrationScalePerformanceTests {+    /// Req 2.6. The same budget bounds both measurements below: the pass is what+    /// the requirement names, and the certification open is the interval a+    /// reader actually waits through, which contains it.+    private let migrationBudget = Duration.seconds(10)+    /// Fewer samples than the 20 the read paths use. Every sample here needs a+    /// full strip-and-reopen cycle of its own — the setup costs about as much as+    /// the measurement — and each sample is ~17 s, so 10 is what a run can carry.+    /// The measurement's within-run spread is ≤ 1.03×, so it is not the sample+    /// count that limits what can be claimed here.+    private let iterations = 10+    /// Half that again for the diagnostic, which is recorded rather than+    /// asserted and whose Entry half repeats the same 17 s as the test above.+    private let diagnosticIterations = 5++    // MARK: - Req 2.6 does not hold on this host++    /// **The 10 s budget is breached, by 1.75×, and these tests record that+    /// rather than hide it or move the budget.**+    ///+    /// Measured on an M1 Max in release over the 5,000-Entry fixture: the pass+    /// alone is **17.31 – 17.75 s** (median over five runs, n=10 each, within-run+    /// spread ≤ 1.03×) and the whole certification open **17.94 – 18.40 s**, so+    /// validation contributes ~0.6–0.9 s and the pass is essentially the entire+    /// cost. Five runs agreed to within 2.5%. This is a measurement, not a+    /// hiccup.+    ///+    /// **Where the time goes**, from `passSplitByRecordType` below: 5,000+    /// `entry.site` assignments into one `Site.entries` cost 16.55–17.00 s, while+    /// 1,000 `work.site` assignments into one `Site.works` cost 1.17–1.20 s —+    /// 14.2× the cost for 5× the records, where a linear cost would predict 5×.+    /// The cost is+    /// **superlinear in the size of the inverse array being maintained**, which+    /// is the unknown the design named and the reason the single-Site fixture is+    /// the worst shape available (design.md, "The pass necessarily populates+    /// `Site.entries`").+    ///+    /// **What is deliberately NOT done about it.** Batching the save would+    /// bring the interval down and is refused: Req 2.4's all-or-nothing rests on+    /// the single save, and Q15 rejected batching for exactly that trade. A+    /// breach reopens that decision as a decision — it does not authorise the+    /// change from inside a measurement task.+    ///+    /// **Host, not device.** Req 2.6's protocol is the physical-device protocol,+    /// and the `AsterismCore` package test target is in no scheme's test action,+    /// so it cannot run there at all (Decision 10 of `library-integrity-+    /// tolerance`). The one calibration point that exists — `recentPresentation`+    /// at 0.713 s host against 0.305 s device — says the device runs *read*+    /// workloads ~2.3× faster, which would put this near 7.5 s. That is an+    /// inference about a write-and-save workload from a read measurement, and it+    /// is not evidence. The device number is listed as pending in+    /// `specs/relational-references/implementation.md`.+    private static let requirement26KnownIssue: Comment = """+        Req 2.6 (10 s) is exceeded on the host: the relationship pass measures \+        ~17.3 s and the whole certification open ~17.9 s over the 5,000-Entry \+        single-Site fixture. Host-only measurement of a write workload; the \+        breach is recorded rather than fixed, because the only fix on the table \+        is batching, which Q15 rejected and Req 2.4 rests on. See the comment \+        above these tests and implementation.md, task 21.+        """+    /// The regression floor under a known breach, asserted *outside* the+    /// `withKnownIssue` block — the same construction Decision 11 of+    /// `library-integrity-tolerance` arrived at for Req 5.5. `withKnownIssue`+    /// swallows a failure at 17 s and at 170 s alike, so on its own it would+    /// give the test back the property it exists to remove. These sit ~1.3×+    /// above the measured medians: clear of the ≤ 1.03× within-run spread and the+    /// 2.5% run-to-run band, well under a doubling. Raising them to make a run+    /// pass would be the mistake.+    private let passRegressionCeiling = Duration.seconds(22)+    private let certificationRegressionCeiling = Duration.seconds(23)++    // MARK: - The pass alone (Req 2.6)++    @Test("Relationship pass ≤ 10 s over the 5,000-Entry fixture (Req 2.6)")+    func passOverTheScaleFixture() async throws {+        let store = try await M4MigrationStore()+        var samples: [Duration] = []+        let clock = ContinuousClock()++        // One warm-up cycle before the first recorded sample, as the read-path+        // suites do: the first open of a freshly written store pays page-cache+        // costs the later ones do not.+        for iteration in 0..<(iterations + 1) {+            try store.strip()+            try store.expectUnlinked()++            let container = try LibraryRepository.openV4Container(at: store.storeURL)+            let context = ModelContext(container)+            let start = clock.now+            try V5RelationshipPass.run(context: context)+            let elapsed = clock.now - start+            withExtendedLifetime(container) {}++            try store.expectLinked()+            if iteration > 0 { samples.append(elapsed) }+        }+        let measured = PerformanceDistribution(samples)+        withKnownIssue(Self.requirement26KnownIssue) {+            expectWithinBudget("v5-relationship-pass", measured, migrationBudget)+        }+        expectWithinCeiling("v5-relationship-pass", measured, passRegressionCeiling)+    }++    // MARK: - The whole certification open++    @Test("Certification open ≤ 10 s over the 5,000-Entry fixture (Req 2.6)")+    func certificationOverTheScaleFixture() async throws {+        // What Req 2.6's "migration completes" actually costs a reader: the+        // V4-marker branch of `openV4ForApp` runs the pass, then+        // `validateV4Store` over the now-linked graph, then publishes `"5"`.+        // Recorded beside the pass so the split between the two is visible+        // rather than inferred.+        let store = try await M4MigrationStore()+        var samples: [Duration] = []+        let clock = ContinuousClock()++        for iteration in 0..<(iterations + 1) {+            try store.strip()+            try store.markUnmigrated()+            try store.expectUnlinked()++            let start = clock.now+            let (result, repository) = try await LibraryRepository.openV4ForApp(+                store.configuration, capabilities: .m4)+            let elapsed = clock.now - start+            withExtendedLifetime(repository) {}++            guard case .ready = result else {+                Issue.record("the certification open must return a ready library, got \(result)")+                return+            }+            try store.expectLinked()+            try store.expectMigrated()+            if iteration > 0 { samples.append(elapsed) }+        }+        let measured = PerformanceDistribution(samples)+        withKnownIssue(Self.requirement26KnownIssue) {+            expectWithinBudget("v5-certification-open", measured, migrationBudget)+        }+        expectWithinCeiling(+            "v5-certification-open", measured, certificationRegressionCeiling)+    }++    // MARK: - Where the pass spends its time (recorded, not asserted)++    /// The same pass, run once with only the Entry half to do and once with only+    /// the Work half, so the breach above has a cause rather than a hypothesis.+    ///+    /// Q33's identity check is what makes this expressible: the pass assigns the+    /// winner to every record but skips the write where the relationship already+    /// holds it, dirtying nothing. Leaving one half linked therefore leaves that+    /// half a true no-op, and what is timed is the other half alone — 5,000+    /// appends into one `Site.entries`, or 1,000 into one `Site.works`.+    ///+    /// Neither number is asserted against a budget. Req 2.6 bounds the whole+    /// pass, and half of it is not a requirement; these exist so the ratio+    /// between them is on the record.+    @Test("Where the pass spends its time: Entries against Works (recorded)")+    func passSplitByRecordType() async throws {+        let store = try await M4MigrationStore()+        let entriesOnly = try measurePass(+            store, stripping: (entries: true, works: false),+            iterations: diagnosticIterations)+        reportPerformance("v5-relationship-pass-entries-only", entriesOnly)++        let worksOnly = try measurePass(+            store, stripping: (entries: false, works: true),+            iterations: diagnosticIterations)+        reportPerformance("v5-relationship-pass-works-only", worksOnly)++        let ratio = PerformanceDistribution.seconds(entriesOnly.median)+            / PerformanceDistribution.seconds(worksOnly.median)+        FileHandle.standardError.write(+            Data(+                """+                ASTERISM-PERF v5-relationship-pass entries/works ratio=\+                \(String(format: "%.2f", ratio))x over a 5.00x record-count ratio++                """.utf8))+    }++    // MARK: - Helpers++    /// Times `V5RelationshipPass.run` over a store stripped in one half or both,+    /// with the strip, the reopen and the verification all outside the timer.+    private func measurePass(+        _ store: M4MigrationStore,+        stripping halves: (entries: Bool, works: Bool),+        iterations: Int,+        sourceLocation: SourceLocation = #_sourceLocation+    ) throws -> PerformanceDistribution {+        var samples: [Duration] = []+        let clock = ContinuousClock()+        for iteration in 0..<(iterations + 1) {+            try store.relink()+            try store.strip(entries: halves.entries, works: halves.works)+            try store.expectUnlinked(+                entries: halves.entries, works: halves.works, sourceLocation: sourceLocation)++            let container = try LibraryRepository.openV4Container(at: store.storeURL)+            let context = ModelContext(container)+            let start = clock.now+            try V5RelationshipPass.run(context: context)+            let elapsed = clock.now - start+            withExtendedLifetime(container) {}++            try store.expectLinked(sourceLocation: sourceLocation)+            if iteration > 0 { samples.append(elapsed) }+        }+        return PerformanceDistribution(samples)+    }++    /// The regression floor under a known breach; see `passRegressionCeiling`.+    private func expectWithinCeiling(+        _ label: String,+        _ measured: PerformanceDistribution,+        _ ceiling: Duration,+        sourceLocation: SourceLocation = #_sourceLocation+    ) {+        #expect(+            measured.median <= ceiling,+            """+            \(label) median \(measured.median) exceeded the \(ceiling) regression \+            ceiling (p95 \(measured.p95)) — this is not Req 2.6's 10 s budget, \+            which is separately asserted and known to be breached on the host; \+            something has made the migration materially slower+            """,+            sourceLocation: sourceLocation)+    }+}++// MARK: - Fixture++/// The coherent 5,000-Entry composed fixture on disk, with the two operations a+/// migration measurement needs: put it back into the pre-pass state, and check+/// which state it is actually in.+///+/// Every check opens a container of its own and releases it, so what it reports+/// is the persisted store rather than objects some other context has registered.+private final class M4MigrationStore {+    let root: URL+    let configuration: LibraryConfiguration+    var storeURL: URL { configuration.v4StoreURL }++    /// 1,000 Works — the fixture's 5,000 Entries at 5 chapters each.+    private let workCount =+        LibraryRepository.m4FixtureEntryCount / LibraryRepository.m4FixtureEntriesPerWork++    init() async throws {+        root = FileManager.default.temporaryDirectory+            .appending(+                path: "asterism-m4-migration-perf-\(UUID().uuidString)", directoryHint: .isDirectory)+        configuration = LibraryConfiguration(rootDirectory: root, environment: .development)+        try FileManager.default.createDirectory(+            at: configuration.v4StoreURL.deletingLastPathComponent(),+            withIntermediateDirectories: true)++        let container = try LibraryRepository.openV4Container(at: configuration.v4StoreURL)+        let seeder = LibraryRepository.makeRepository(+            configuration, container, .m4, SystemRepositoryClock(), ModelContextSaveStrategy())+        try await seeder.seedM4PerformanceFixture()+        try LibraryRepository.publishV5Readiness(at: configuration.v4MarkerURL)+        withExtendedLifetime(container) {}+    }++    /// Back to the pre-pass graph: the named relationships nil across the whole+    /// store, **saved**, and the container released before anything is timed.+    /// Nulling in the timing context would leave the inverse arrays warm and the+    /// objects registered, which is not the state certification runs in.+    func strip(entries: Bool = true, works: Bool = true) throws {+        let container = try LibraryRepository.openV4Container(at: storeURL)+        let context = ModelContext(container)+        if entries {+            for entry in try context.fetch(FetchDescriptor<Entry>()) { entry.site = nil }+        }+        if works {+            for work in try context.fetch(FetchDescriptor<Work>()) { work.site = nil }+        }+        try context.save()+        withExtendedLifetime(container) {}+    }++    /// Restores the fully linked graph, so a half-strip starts from a known+    /// whole rather than from whatever the previous sample left behind.+    func relink() throws {+        let container = try LibraryRepository.openV4Container(at: storeURL)+        let context = ModelContext(container)+        try V5RelationshipPass.run(context: context)+        withExtendedLifetime(container) {}+    }++    /// Writes the `"4"` marker the V4-marker branch reads as "the pass has not+    /// run over this library" (Q31).+    func markUnmigrated() throws {+        try Data("4\n".utf8).write(to: configuration.v4MarkerURL, options: .atomic)+    }++    /// The pre-timing half of trap (d): a pass that iterated 5,000 records and+    /// assigned none measures a graph that was already linked, and only the+    /// count taken *before* the timer can rule that out.+    func expectUnlinked(+        entries strippedEntries: Bool = true,+        works strippedWorks: Bool = true,+        sourceLocation: SourceLocation = #_sourceLocation+    ) throws {+        let (entries, works) = try linkedCounts()+        let expectedEntries = strippedEntries ? 0 : LibraryRepository.m4FixtureEntryCount+        let expectedWorks = strippedWorks ? 0 : workCount+        #expect(+            entries == expectedEntries && works == expectedWorks,+            """+            the timed pass must start from the intended pre-pass graph: expected \+            \(expectedEntries) linked Entries and \(expectedWorks) linked Works, found \+            \(entries) and \(works) — a pass with nothing to assign clears the budget \+            by doing no work+            """,+            sourceLocation: sourceLocation)+    }++    func expectLinked(sourceLocation: SourceLocation = #_sourceLocation) throws {+        let (entries, works) = try linkedCounts()+        #expect(+            entries == LibraryRepository.m4FixtureEntryCount && works == workCount,+            """+            the pass must have linked the whole graph: expected \+            \(LibraryRepository.m4FixtureEntryCount) Entries and \(workCount) Works, \+            found \(entries) and \(works)+            """,+            sourceLocation: sourceLocation)+    }++    func expectMigrated(sourceLocation: SourceLocation = #_sourceLocation) throws {+        let marker = try String(contentsOf: configuration.v4MarkerURL, encoding: .utf8)+        #expect(+            marker.trimmingCharacters(in: .whitespacesAndNewlines) == "5",+            "the certification open must republish the marker as \"5\", found \(marker)",+            sourceLocation: sourceLocation)+    }++    private func linkedCounts() throws -> (entries: Int, works: Int) {+        let container = try LibraryRepository.openV4Container(at: storeURL)+        defer { withExtendedLifetime(container) {} }+        let context = ModelContext(container)+        let entries = try context.fetch(FetchDescriptor<Entry>()).filter { $0.site != nil }.count+        let works = try context.fetch(FetchDescriptor<Work>()).filter { $0.site != nil }.count+        return (entries, works)+    }++    deinit {+        try? FileManager.default.removeItem(at: root)+    }+}

diff --git a/Packages/AsterismCore/Tests/AsterismCoreTests/M4ScaleFixtureTests.swift b/Packages/AsterismCore/Tests/AsterismCoreTests/M4ScaleFixtureTests.swiftindex 1016eaf..4ed4a27 100644--- a/Packages/AsterismCore/Tests/AsterismCoreTests/M4ScaleFixtureTests.swift+++ b/Packages/AsterismCore/Tests/AsterismCoreTests/M4ScaleFixtureTests.swift@@ -93,8 +93,20 @@ struct M4ScaleFixtureTests {         #expect(counts.sites == 1)         #expect(counts.works == 1_000) -        // The seeded store certifies as a ready V4 library the extension can open.-        try LibraryRepository.publishV4Readiness(at: configuration.v4MarkerURL)+        // Task 19: the fixture builds the graph the app itself produces, so+        // every Entry and Work carries its Site relationship. A fixture with+        // nil relationships would put the scale budgets on a shape no library+        // can reach, and the pass never runs over it — the marker below says it+        // already has.+        let seeded = ModelContext(container)+        let unlinkedEntries = try seeded.fetch(FetchDescriptor<Entry>()).count { $0.site == nil }+        let unlinkedWorks = try seeded.fetch(FetchDescriptor<Work>()).count { $0.site == nil }+        #expect(unlinkedEntries == 0)+        #expect(unlinkedWorks == 0)++        // The seeded store certifies as a ready library the extension can open —+        // which since Q14 means one marked migrated, not one marked "4".+        try LibraryRepository.publishV5Readiness(at: configuration.v4MarkerURL)         let (result, _) = try await LibraryRepository.openV4ForExtension(configuration, capabilities: .m4)         guard case .ready(let readyCounts) = result else {             Issue.record("expected a ready V4 library, got \(result)"); return

diff --git a/Packages/AsterismCore/Tests/AsterismCoreTests/M4ScalePerformanceTests.swift b/Packages/AsterismCore/Tests/AsterismCoreTests/M4ScalePerformanceTests.swiftindex 4306a7f..20b7f56 100644--- a/Packages/AsterismCore/Tests/AsterismCoreTests/M4ScalePerformanceTests.swift+++ b/Packages/AsterismCore/Tests/AsterismCoreTests/M4ScalePerformanceTests.swift@@ -19,6 +19,9 @@ import Testing ///   collapsed measurement here is the title-only preview. /// - Capture rule-application step ≤ 100 ms against the composed fixture. /// - Extension open + validate (with title-derivation replay) ≤ 1 s.+/// - Store-level validation alone ≤ 1 s, reported so relational-references+///   Req 5.3 can state whether following relationships made it faster or slower+///   than resolving strings. /// /// **The statistic is split by purpose (Decision 10, task 36).** Every test /// records a whole `PerformanceDistribution` — min, median, p95 and max over the@@ -132,6 +135,61 @@ struct M4ScalePerformanceTests {             "extension-open-and-validate", PerformanceDistribution(samples), extensionOpenBudget)     } +    // MARK: - Store-level validation (relational-references Req 5.3)++    /// The validator on its own, with the container open kept outside the timer.+    ///+    /// `openV4ForExtension` above is container open + `validateV4Store` ++    /// `v3Counts`, so it bounds this path but cannot say how much of the second+    /// is the validator. Req 5.3 asks for the direction of change after+    /// resolution moved from hostname-keyed string lookup to+    /// `entry.site` / `work.site`, and that question is about+    /// `V4LibraryValidator.validate(context:)` specifically: it now reads+    /// `work.site` (~:445) and `entry.site` (~:495) unconditionally, once per+    /// record, and every cited-rule read scans the citing Site's+    /// `urlRuleValues` / `patternValues` per reference instead of a prebuilt+    /// dictionary.+    ///+    /// **A fresh container and context per sample**, because that is the state+    /// the extension's open is in: reusing one context would leave every+    /// to-one relationship already faulted and every rule array already+    /// materialised, which is precisely the cost being measured.+    @Test("Store-level validation ≤ 1 s, reported for Req 5.3")+    func storeLevelValidation() async throws {+        let (configuration, root) = try await seedReadyStore()+        defer { try? FileManager.default.removeItem(at: root) }++        var samples: [Duration] = []+        let clock = ContinuousClock()+        // One warm-up pass primes the page cache, as the extension test does.+        for iteration in 0..<(iterations + 1) {+            let container = try LibraryRepository.openV4Container(at: configuration.v4StoreURL)+            let context = ModelContext(container)+            let start = clock.now+            let diagnostics = try V4LibraryValidator.validate(context: context)+            let elapsed = clock.now - start+            if iteration > 0 { samples.append(elapsed) }+            if iteration == 0 {+                // The fixture is coherent, so a diagnosis here would mean the+                // number below was measured over a graph in some other state.+                #expect(+                    diagnostics.isEmpty,+                    "the coherent M4 fixture must validate clean: \(diagnostics.diagnoses)")+                // And the work actually happened over the whole graph: 5,000+                // Entries, every one carrying the relationship the validator+                // reads. A fixture regression that left them nil would make this+                // measurement one of the `.siteMissing` path, which skips+                // per-Entry replay entirely and is roughly half the work.+                let linked = try context.fetch(FetchDescriptor<Entry>())+                    .filter { $0.site != nil }.count+                #expect(linked == LibraryRepository.m4FixtureEntryCount)+            }+            withExtendedLifetime(container) {}+        }+        expectWithinBudget(+            "store-level-validation", PerformanceDistribution(samples), extensionOpenBudget)+    }+     // MARK: - Helpers      /// Seeds a fresh V4-valid 5,000-Entry composed store on disk and certifies it@@ -147,7 +205,11 @@ struct M4ScalePerformanceTests {         let repository = LibraryRepository.makeRepository(             configuration, container, .m4, SystemRepositoryClock(), ModelContextSaveStrategy())         try await repository.seedM4PerformanceFixture()-        try LibraryRepository.publishV4Readiness(at: configuration.v4MarkerURL)+        // Task 19: no relationship wiring here — `seedM4PerformanceFixture`+        // assigns both halves itself (Q43), so this store already carries the+        // graph certification leaves behind.+        // Marked migrated: the extension opens no other version (Q14).+        try LibraryRepository.publishV5Readiness(at: configuration.v4MarkerURL)         return (configuration, root)     } }

diff --git a/Packages/AsterismCore/Tests/AsterismCoreTests/M4ToleratedFixtureTests.swift b/Packages/AsterismCore/Tests/AsterismCoreTests/M4ToleratedFixtureTests.swiftindex 828393e..da326cc 100644--- a/Packages/AsterismCore/Tests/AsterismCoreTests/M4ToleratedFixtureTests.swift+++ b/Packages/AsterismCore/Tests/AsterismCoreTests/M4ToleratedFixtureTests.swift@@ -118,7 +118,12 @@ private final class M4ToleratedFixtureLibrary {         let seeder = LibraryRepository.makeRepository(             configuration, container, .m4, SystemRepositoryClock(), ModelContextSaveStrategy())         try await seeder.seedM4PerformanceFixture(toleratedState: state)-        try LibraryRepository.publishV4Readiness(at: configuration.v4MarkerURL)+        // Task 19: the relationships come from the fixture itself (Q43) —+        // populated for every state except `.siteMissing`, whose deletion of the+        // taught row takes all 5,000 to nil through the `.nullify` inverses.+        // Seeded at the current schema, so it is marked migrated (Q14, Q26);+        // nothing here simulates a library awaiting the relationship pass.+        try LibraryRepository.publishV5Readiness(at: configuration.v4MarkerURL)         withExtendedLifetime(container) {}          let (_, opened) = try await LibraryRepository.openV4ForApp(

diff --git a/Packages/AsterismCore/Tests/AsterismCoreTests/M4ToleratedScalePerformanceTests.swift b/Packages/AsterismCore/Tests/AsterismCoreTests/M4ToleratedScalePerformanceTests.swiftindex 77104e7..bdc86fd 100644--- a/Packages/AsterismCore/Tests/AsterismCoreTests/M4ToleratedScalePerformanceTests.swift+++ b/Packages/AsterismCore/Tests/AsterismCoreTests/M4ToleratedScalePerformanceTests.swift@@ -413,7 +413,11 @@ private final class M4PerformanceStore {         let seeder = LibraryRepository.makeRepository(             configuration, container, .m4, SystemRepositoryClock(), ModelContextSaveStrategy())         try await seeder.seedM4PerformanceFixture(toleratedState: state)-        try LibraryRepository.publishV4Readiness(at: configuration.v4MarkerURL)+        // Task 19: the relationships come from the fixture itself (Q43), so the+        // budgets are measured over the graph the app produces rather than one+        // with every relationship nil.+        // Marked migrated: the extension opens no other version (Q14).+        try LibraryRepository.publishV5Readiness(at: configuration.v4MarkerURL)         withExtendedLifetime(container) {}     } 

diff --git a/Packages/AsterismCore/Tests/AsterismCoreTests/MarkerContractTests.swift b/Packages/AsterismCore/Tests/AsterismCoreTests/MarkerContractTests.swiftnew file mode 100644index 0000000..d137151--- /dev/null+++ b/Packages/AsterismCore/Tests/AsterismCoreTests/MarkerContractTests.swift@@ -0,0 +1,175 @@+import Foundation+import SwiftData+import Testing+@testable import AsterismCore++/// Task 4: the two-process marker contract (Q14, Req 2.3).+///+/// `openV4Container` is shared by both processes, so `ModelContainer.init`+/// performs the lightweight conversion in whichever process opens first — and+/// the extension takes only a *shared* lock, so nothing serialises it against+/// the app. The defence is that the two processes read the readiness marker+/// differently: the app opens a library marked `"4"` or `"5"`, the extension+/// only one marked `"5"`, and it decides *before* constructing a container.+@Suite("Marker contract", .serialized)+struct MarkerContractTests {++    // MARK: - Helpers++    private final class TempDir {+        let url: URL+        init() throws {+            url = FileManager.default.temporaryDirectory.appending(+                path: "MarkerContract-\(UUID())", directoryHint: .isDirectory)+            try FileManager.default.createDirectory(at: url, withIntermediateDirectories: true)+        }+        deinit { try? FileManager.default.removeItem(at: url) }+    }++    private func config() throws -> (TempDir, LibraryConfiguration) {+        let dir = try TempDir()+        return (dir, LibraryConfiguration(rootDirectory: dir.url, environment: .development))+    }++    /// A first run: creates an empty store and marks it ready at birth. An+    /// empty store has nothing to migrate, so mark-at-birth certifies it at+    /// `"5"` directly (Q26).+    private func makeReadyLibrary(_ configuration: LibraryConfiguration) async throws {+        _ = try await LibraryRepository.openV4ForApp(configuration)+    }++    /// A library in the state this milestone exists for: a store a pre-freeze+    /// build actually recorded at 4.0.0, with the `"4"` marker beside it. The+    /// store is *convertible* — `ModelContainer.init` would happily migrate it —+    /// which is exactly the hazard the extension-side check has to stop.+    private func makeUnmigratedLibrary(_ configuration: LibraryConfiguration) throws {+        try V4RecordedStoreFixture.install(at: configuration.v4StoreURL)+        try writeMarker(configuration, "4\n")+    }++    private func writeMarker(_ configuration: LibraryConfiguration, _ content: String) throws {+        try Data(content.utf8).write(to: configuration.v4MarkerURL, options: .atomic)+    }++    private func markerContent(_ configuration: LibraryConfiguration) throws -> String {+        try String(contentsOf: configuration.v4MarkerURL, encoding: .utf8)+            .trimmingCharacters(in: .whitespacesAndNewlines)+    }++    /// The extension's shipped refusal (Req 2.3) — the message a reader sees+    /// when the containing app has not brought the library up to date.+    private static let declined = LibraryRepositoryError.libraryUnavailable(+        operation: "opening V4 library from extension",+        reason: "the containing app has not initialized the current library")++    // MARK: - App side accepts both versions++    @Test("The app opens a library marked \"4\" and one marked \"5\"")+    func appAcceptsBothMarkerVersions() async throws {+        let (_, cfg) = try config()+        try await makeReadyLibrary(cfg)+        #expect(try markerContent(cfg) == "5",+                "an empty store has nothing to migrate, so it is certified migrated (Q26)")++        let (atFive, _) = try await LibraryRepository.openV4ForApp(cfg)+        #expect(atFive == .ready(.zero), "a migrated library opens in the app")++        // Deliberate pre-migration state: the marker a pre-freeze build's+        // library still carries. The app opens it, runs the relationship pass+        // over it, and republishes "5" (Q31).+        try writeMarker(cfg, "4\n")+        let (atFour, _) = try await LibraryRepository.openV4ForApp(cfg)+        #expect(atFour == .ready(.zero), "the migration exists for libraries still marked \"4\"")+        #expect(try markerContent(cfg) == "5", "the open republishes readiness at \"5\"")+    }++    @Test("The app fails closed on a marker version it does not open",+          arguments: ["3\n", "6\n", "45\n", "", "four\n"])+    func appRejectsUnknownMarkerVersions(content: String) async throws {+        let (_, cfg) = try config()+        try await makeReadyLibrary(cfg)+        try writeMarker(cfg, content)++        await #expect(throws: LibraryRepositoryError.self) {+            try await LibraryRepository.openV4ForApp(cfg)+        }+    }++    // MARK: - Extension side requires the migrated version++    @Test("The extension opens a library marked \"5\"")+    func extensionAcceptsTheMigratedVersion() async throws {+        let (_, cfg) = try config()+        try await makeReadyLibrary(cfg)+        #expect(try markerContent(cfg) == "5")++        let (result, _) = try await LibraryRepository.openV4ForExtension(cfg)+        #expect(result == .ready(.zero))+    }++    @Test("The extension declines a library still marked \"4\", with the shipped message")+    func extensionDeclinesTheUnmigratedVersion() async throws {+        let (_, cfg) = try config()+        try makeUnmigratedLibrary(cfg)++        await #expect(throws: Self.declined) {+            try await LibraryRepository.openV4ForExtension(cfg)+        }+    }++    @Test("The extension declines a \"4\" marker before it constructs a ModelContainer")+    func extensionDeclinesBeforeOpeningAContainer() async throws {+        let (_, cfg) = try config()+        // A genuinely 4.0.0-recorded store, not a corrupt one: the container+        // *would* open it, converting it to 5.0.0 in a process holding only a+        // shared lock. That is the hazard (Q14) — a store that cannot be opened+        // at all would prove nothing about the ordering.+        try makeUnmigratedLibrary(cfg)++        await #expect(throws: Self.declined) {+            try await LibraryRepository.openV4ForExtension(cfg)+        }+        #expect(try V4RecordedStoreFixture.recordedModelVersions(at: cfg.v4StoreURL) == ["4.0.0"],+                "the marker check must decide before ModelContainer.init converts anything")++        // Control: with a "5" marker the same store is reached, opened, and+        // converted. Without this the assertion above could hold because the+        // store was unopenable rather than because the marker was read first.+        try writeMarker(cfg, "5\n")+        _ = try await LibraryRepository.openV4ForExtension(cfg)+        #expect(try V4RecordedStoreFixture.recordedModelVersions(at: cfg.v4StoreURL) == ["5.0.0"],+                "the same store converts once the marker check passes")+    }++    @Test("The extension fails closed on a marker version no build understands")+    func extensionRejectsUnknownMarkerVersions() async throws {+        let (_, cfg) = try config()+        try await makeReadyLibrary(cfg)+        try writeMarker(cfg, "6\n")++        await #expect(throws: LibraryRepositoryError.self) {+            try await LibraryRepository.openV4ForExtension(cfg)+        }+    }++    @Test("The extension never migrates a library it declined")+    func extensionLeavesTheDeclinedLibraryUntouched() async throws {+        let (_, cfg) = try config()+        try makeUnmigratedLibrary(cfg)+        let before = try Data(contentsOf: cfg.v4StoreURL)++        _ = try? await LibraryRepository.openV4ForExtension(cfg)++        // The marker is the cheap half of the claim. The half that matters is+        // that the *store* is untouched: still recorded at 4.0.0, byte for+        // byte the file the declined library had.+        #expect(try markerContent(cfg) == "4", "the extension may not republish readiness")+        #expect(try Data(contentsOf: cfg.v4StoreURL) == before)+        for suffix in ["-wal", "-shm"] {+            #expect(!FileManager.default.fileExists(atPath: cfg.v4StoreURL.path + suffix),+                    "declining must not have opened the store at all")+        }+        // Last, because reading the metadata opens the file itself.+        #expect(try V4RecordedStoreFixture.recordedModelVersions(at: cfg.v4StoreURL) == ["4.0.0"])+    }+}

diff --git a/Packages/AsterismCore/Tests/AsterismCoreTests/QuarantineScopingTests.swift b/Packages/AsterismCore/Tests/AsterismCoreTests/QuarantineScopingTests.swiftindex 152bc6a..0e87333 100644--- a/Packages/AsterismCore/Tests/AsterismCoreTests/QuarantineScopingTests.swift+++ b/Packages/AsterismCore/Tests/AsterismCoreTests/QuarantineScopingTests.swift@@ -45,10 +45,17 @@ struct QuarantineScopingTests {             context.insert(good)              try context.save()+            // Task 19: the marker published below says the relationship pass has+            // run, so the seeded graph must look as though it did — every record+            // pinned to the row `SiteResolutionOrder` picks, and nil only where the+            // hostname carries no Site row at all.+            try V5RelationshipPass.run(context: context)             withExtendedLifetime(container) {}         } -        try LibraryRepository.publishV4Readiness(at: configuration.v4MarkerURL)+        // Seeded at the current schema, so it is marked migrated (Q14, Q26);+        // nothing here simulates a library awaiting the relationship pass.+        try LibraryRepository.publishV5Readiness(at: configuration.v4MarkerURL)          let clock = QuarantineClock(Date(timeIntervalSince1970: 1_800_000_000))         let (_, repository) = try await LibraryRepository.openV4ForApp(

diff --git a/Packages/AsterismCore/Tests/AsterismCoreTests/RecentPresentationToleranceTests.swift b/Packages/AsterismCore/Tests/AsterismCoreTests/RecentPresentationToleranceTests.swiftindex 2fb4b78..f16449a 100644--- a/Packages/AsterismCore/Tests/AsterismCoreTests/RecentPresentationToleranceTests.swift+++ b/Packages/AsterismCore/Tests/AsterismCoreTests/RecentPresentationToleranceTests.swift@@ -102,14 +102,20 @@ struct RecentPresentationToleranceTests {         #expect(row.attention == .siteDuplicated)     } -    /// Decision 9 end to end. The Entry cites a pattern owned by the Site row that-    /// *lost* the tiebreak; Recent replays that citation to produce the unresolved-    /// candidate title. A winner-only lookup finds nothing and throws, which is the-    /// failure the union exists to remove — and this is the first phase in which-    /// that code is reachable at all.-    @Test("A candidate replay resolves a pattern owned by the losing Site row")-    func candidateReplayResolvesAcrossTheUnionOfRows() async throws {+    /// The provenance half of Decision 5, in the shape Decision 4 preserves —+    /// what Decision 9 of `specs/library-integrity-tolerance` used the+    /// hostname-wide union for. Recent's *presentation* still follows the winner+    /// (the row's mode, title cleaning and pill), which is the other half of the+    /// same decision. The Entry cites a pattern owned by the Site row that+    /// *lost* the tiebreak, and it is pinned to that row — the sync-shaped graph, since only mirroring can produce two+    /// rows with split citation ownership. Recent replays the citation to produce+    /// the unresolved candidate title. A winner-only lookup finds nothing, which+    /// is the failure the union removed and the record's own relationship must+    /// keep removed (task 14).+    @Test("A candidate replay resolves a pattern owned by the Entry's own non-winner row")+    func candidateReplayFollowsTheEntrysOwnRow() async throws {         let library = try RecentToleranceFixture()+        let entryID = UUID()         let ids = [UUID(), UUID()].sorted()         let winningPatternID = ids[0]         let losingPatternID = ids[1]@@ -126,11 +132,22 @@ struct RecentPresentationToleranceTests {                 id: losingPatternID, site: loser, isActive: true, definition: definition)              let entry = store.insertEntry(-                hostname: "dup.example", title: "A Cited Work - Chapter 3", offset: 0)+                id: entryID, hostname: "dup.example", title: "A Cited Work - Chapter 3", offset: 0)             entry.workAssignmentProvenance = .pattern             entry.workPatternID = losingPatternID             entry.workPatternVersion = 1         }+        // Pin the Entry to the row that owns its citation, undoing the seed's+        // winner-pinning pass for this one record (Decision 4): the fixture+        // models a mirrored graph, and a synced relationship arrives as a+        // pointer to its originating row, never through hostname resolution.+        try library.mutate { context in+            let sites = try context.fetch(FetchDescriptor<Site>())+            let loser = try #require(sites.first { $0.displayName == "lose-row" })+            let entry = try #require(try context.fetch(FetchDescriptor<Entry>())+                .first { $0.id == entryID })+            entry.site = loser+        }         let repository = try await library.openForApp()          let presentation = try await repository.recentPresentation(calendar: .current)@@ -140,6 +157,106 @@ struct RecentPresentationToleranceTests {         #expect(row.unresolvedCandidateTitle == "A Cited Work")     } +    // MARK: - A cited pattern that resolves nowhere (relational-references Req 3.4, Q13)++    /// The regression Q13 orders *before* the cited search space narrows to the+    /// Entry's own Site. `replayRecentCandidate` threw `corruptLibrary` and the+    /// throw was not caught locally, so a single Entry citing a pattern no Site+    /// row owns failed the whole publication and took every unrelated row with+    /// it. Once resolution follows `entry.site`, a nil relationship produces+    /// exactly this shape — 2,995 of 3,000 at the CloudKit probe's peak — so the+    /// throw has to be gone first.+    @Test("An Entry citing a pattern that resolves nowhere still gets a row")+    func entryCitingAnUnresolvablePatternIsEmittedWithAttention() async throws {+        let library = try RecentToleranceFixture()+        let definition = PatternDefinition.segment(+            work: try SegmentRangeSpec(origin: .start, offset: 0, length: 1), ignored: [])+        try library.seed { store in+            let site = store.insertSite(hostname: "taught.example")+            site.mode = .taught+            try store.insertTitlePattern(site: site, isActive: true, definition: definition)+            let entry = store.insertEntry(+                hostname: "taught.example", title: "A Cited Work - Chapter 3", offset: 0)+            entry.workAssignmentProvenance = .pattern+            entry.workPatternID = UUID()+            entry.workPatternVersion = 1+            store.insertEntry(+                hostname: "taught.example", title: "Unrelated Capture", offset: 10)+        }+        let repository = try await library.openForApp()++        let presentation = try await repository.recentPresentation(calendar: .current)++        let rows = presentation.allRows+        #expect(rows.count == 2)+        let cited = try #require(rows.first { $0.captureTitle == "A Cited Work - Chapter 3" })+        #expect(cited.attention == .citationUnresolved)+        #expect(cited.unresolvedCandidateTitle == nil)+        // The Site itself resolved, so the row keeps its mode and its evidence.+        #expect(cited.siteMode == .taught)+        // What the throw used to cost: every other row on the screen.+        let unrelated = try #require(rows.first { $0.captureTitle == "Unrelated Capture" })+        #expect(unrelated.attention == nil)+    }++    /// Decision 5's stated consequence, and the disagreement that made it worth+    /// pinning. The applicability guard was written twice and the two copies+    /// differed on exactly this record — pattern provenance, no Work, and its+    /// own Site relationship not yet arrived: Recent marked it+    /// `.citationUnresolved` while Entry detail rendered it as healthy. A nil+    /// Site means the citation's evidence is *absent*, not broken, and teaching+    /// the hostname is the repair, so both surfaces now report the citation as+    /// not applicable. The cited pattern exists and is owned by the hostname's+    /// row, so a replay that searched the hostname instead of the record's own+    /// relationship would resolve it and this test would fail either way.+    @Test("An Entry whose own Site relationship never arrived is not marked for its citation")+    func citingEntryWithNoSiteRelationshipIsNotMarked() async throws {+        let library = try RecentToleranceFixture()+        let entryID = UUID()+        let citedID = UUID()+        let definition = PatternDefinition.segment(+            work: try SegmentRangeSpec(origin: .start, offset: 0, length: 1), ignored: [])+        try library.seed { store in+            let site = store.insertSite(hostname: "taught.example")+            site.mode = .taught+            try store.insertTitlePattern(+                id: citedID, site: site, isActive: true, definition: definition)+            let entry = store.insertEntry(+                id: entryID, hostname: "taught.example",+                title: "A Cited Work - Chapter 3", offset: 0)+            entry.workAssignmentProvenance = .pattern+            entry.workPatternID = citedID+            entry.workPatternVersion = 1+        }+        // Undo the seed's relationship pass for this one record: the shape a+        // first CloudKit hydration produces at scale — 2,995 of 3,000 Entries+        // at the probe's peak.+        try library.mutate { context in+            let entry = try #require(try context.fetch(FetchDescriptor<Entry>())+                .first { $0.id == entryID })+            entry.site = nil+        }+        let repository = try await library.openForApp()++        let presentation = try await repository.recentPresentation(calendar: .current)++        let row = try #require(presentation.allRows.first)+        #expect(row.attention == nil)+        #expect(row.unresolvedCandidateTitle == nil)+        // The hostname's own teaching still resolves, so the row keeps its mode+        // and its repair route.+        #expect(row.siteMode == .taught)++        // Entry detail answers identically for the same record, which is the+        // whole point of resolving it in one place.+        let detail = try await repository.entryTeachingDetail(id: entryID)+        #expect(detail.unresolvedCandidateTitle == nil)+        if case .patternUnsettled(_, _, let reason) = detail.assignmentSettlement {+            #expect(reason != "Cited title pattern does not resolve",+                    "an absent relationship is not an unresolvable citation")+        }+    }+     // MARK: - Two records of one type sharing an application UUID (Req 1.1)      @Test("Duplicate Work UUIDs resolve to the earliest row rather than throwing")@@ -436,8 +553,15 @@ private final class RecentToleranceFixture {         let store = RecentSeedStore(context: ModelContext(container))         try body(store)         try store.context.save()+        // Task 19: the marker published below says the relationship pass has+        // run, so the seeded graph must look as though it did — every record+        // pinned to the row `SiteResolutionOrder` picks, and nil only where the+        // hostname carries no Site row at all.+        try V5RelationshipPass.run(context: store.context)         withExtendedLifetime(container) {}-        try LibraryRepository.publishV4Readiness(at: configuration.v4MarkerURL)+        // Seeded at the current schema, so it is marked migrated (Q14, Q26);+        // nothing here simulates a library awaiting the relationship pass.+        try LibraryRepository.publishV5Readiness(at: configuration.v4MarkerURL)     }      func readContext() throws -> ModelContext {@@ -446,6 +570,17 @@ private final class RecentToleranceFixture {         return ModelContext(container)     } +    /// Mutates the seeded store *without* re-running the relationship pass —+    /// for the one shape the pass cannot express (Decision 4): a record pinned+    /// to the duplicate row that owns its citations rather than to the winner.+    func mutate(_ body: (ModelContext) throws -> Void) throws {+        let container = try LibraryRepository.openV4Container(at: configuration.v4StoreURL)+        let context = ModelContext(container)+        try body(context)+        try context.save()+        withExtendedLifetime(container) {}+    }+     func openForApp() async throws -> LibraryRepository {         let (_, repository) = try await LibraryRepository.openV4ForApp(             configuration, capabilities: .m4,

diff --git a/Packages/AsterismCore/Tests/AsterismCoreTests/RefreshUnionInvariantTests.swift b/Packages/AsterismCore/Tests/AsterismCoreTests/RefreshUnionInvariantTests.swiftindex cb9d374..eae38fd 100644--- a/Packages/AsterismCore/Tests/AsterismCoreTests/RefreshUnionInvariantTests.swift+++ b/Packages/AsterismCore/Tests/AsterismCoreTests/RefreshUnionInvariantTests.swift@@ -373,15 +373,21 @@ private final class RefreshFixture {         }     } -    /// Seeds in a scoped container, releases it, and publishes readiness so both-    /// bootstrap paths accept the library.+    /// Seeds in a scoped container, releases it, and publishes migrated+    /// readiness so both bootstrap paths accept the library — the extension+    /// accepts no other version (Q14).     func seed(_ body: (SeedStore) throws -> Void) throws {         let container = try LibraryRepository.openV4Container(at: configuration.v4StoreURL)         let store = SeedStore(context: ModelContext(container))         try body(store)         try store.context.save()+        // Task 19: the marker published below says the relationship pass has+        // run, so the seeded graph must look as though it did — every record+        // pinned to the row `SiteResolutionOrder` picks, and nil only where the+        // hostname carries no Site row at all.+        try V5RelationshipPass.run(context: store.context)         withExtendedLifetime(container) {}-        try LibraryRepository.publishV4Readiness(at: configuration.v4MarkerURL)+        try LibraryRepository.publishV5Readiness(at: configuration.v4MarkerURL)     }      /// A fresh container and context over the seeded file — the offline stand-in

diff --git a/Packages/AsterismCore/Tests/AsterismCoreTests/RepositoryTeachingTests.swift b/Packages/AsterismCore/Tests/AsterismCoreTests/RepositoryTeachingTests.swiftindex 6f14fdc..29ec12d 100644--- a/Packages/AsterismCore/Tests/AsterismCoreTests/RepositoryTeachingTests.swift+++ b/Packages/AsterismCore/Tests/AsterismCoreTests/RepositoryTeachingTests.swift@@ -731,8 +731,15 @@ struct RepositoryActionableRecentTests {         #expect(row.actionType == .reteach)     } -    @Test("Recent fails closed when retained assignment pattern cannot replay")-    func unparseableHistoricalReplayFails() async throws {+    /// **Q13 (relational-references) reverses this test.** It used to assert that+    /// a retained pattern which cannot reproduce its candidate fails the whole+    /// publication. That was affordable only while a citation could not go+    /// unresolved for any tolerated reason; once cited rules resolve through+    /// `entry.site`, an unarrived relationship reaches this same branch during+    /// ordinary first hydration, and one Entry would blank the screen the reader+    /// lands on. The row is marked instead (Req 3.4).+    @Test("Recent marks the row when a retained assignment pattern cannot replay")+    func unparseableHistoricalReplayIsMarkedNotThrown() async throws {         let fixture = try await TeachingFixture()         _ = try await fixture.capture(title: "Ch1 - Fiction | Site", rawURL: "https://example.com/1")         let definition = PatternDefinition.segment(@@ -758,9 +765,18 @@ struct RepositoryActionableRecentTests {             patternVersion: patternVersion         ) -        await #expect(throws: LibraryRepositoryError.self) {-            try await fixture.repository.recentPresentation(calendar: .current)-        }+        let presentation = try await fixture.repository.recentPresentation(calendar: .current)++        // Both rows are published: losing the unrelated one is what the throw cost.+        #expect(presentation.allRows.count == 2)+        let row = try #require(+            presentation.allRows.first { $0.captureTitle == "NoDelimiterHere" })+        #expect(row.attention == .citationUnresolved)+        #expect(row.unresolvedCandidateTitle == nil)+        // The Site resolved and its hostname is teachable, so the repair the+        // reader needs is still offered on the row that needs it.+        #expect(row.siteMode == .taught)+        #expect(row.actionType == .reteach)     } } @@ -1094,8 +1110,12 @@ struct RepositoryEntryTeachingDetailTests {         #expect(detail.unresolvedCandidateTitle == "Fiction")     } -    @Test("Replay failure on retained producing pattern throws corruptLibrary")-    func replayFailureIntegrity() async throws {+    /// The Entry detail half of the same reversal (Q13). Same reason: this branch+    /// becomes reachable from an unarrived relationship, and failing the screen+    /// for one Entry is what Req 3.4 forbids. The citation is disclosed as+    /// unresolved instead, with its `(id, version)` kept as evidence (Req 4.2).+    @Test("Replay failure on a retained producing pattern is disclosed, not thrown")+    func replayFailureIsDisclosed() async throws {         let fixture = try await TeachingFixture()         let seed = try await fixture.capture(             title: "Ch1 - Fiction | Site",@@ -1125,9 +1145,17 @@ struct RepositoryEntryTeachingDetailTests {             patternVersion: patternVersion         ) -        await #expect(throws: LibraryRepositoryError.self) {-            try await fixture.repository.entryTeachingDetail(id: unparseable.id)-        }+        let detail = try await fixture.repository.entryTeachingDetail(id: unparseable.id)++        #expect(detail.unresolvedCandidateTitle == nil)+        #expect(+            detail.assignmentSettlement+                == .patternUnsettled(+                    patternID: patternID, version: patternVersion,+                    reason: "Cited title pattern does not resolve"))+        // Everything the screen could resolve is still disclosed.+        #expect(detail.siteMode == .taught)+        #expect(detail.activePatternSummary?.id == patternID)         #expect(try await fixture.repository.entry(id: seed.id).captureTitle == "Ch1 - Fiction | Site")     } 

diff --git a/Packages/AsterismCore/Tests/AsterismCoreTests/SchemaV2Tests.swift b/Packages/AsterismCore/Tests/AsterismCoreTests/SchemaV2Tests.swiftindex 2841c89..a514743 100644--- a/Packages/AsterismCore/Tests/AsterismCoreTests/SchemaV2Tests.swift+++ b/Packages/AsterismCore/Tests/AsterismCoreTests/SchemaV2Tests.swift@@ -197,7 +197,6 @@ struct SchemaV2Tests {         requireSendable(EntrySnapshot.self)         requireSendable(WorkSnapshot.self)         requireSendable(SiteSnapshot.self)-        requireSendable(TitlePatternSnapshot.self)         requireSendable(WorksSnapshot.self)         requireSendable(DatedEntryGroup.self)     }

diff --git a/Packages/AsterismCore/Tests/AsterismCoreTests/SiteInverseReachTests.swift b/Packages/AsterismCore/Tests/AsterismCoreTests/SiteInverseReachTests.swiftnew file mode 100644index 0000000..fe18ea9--- /dev/null+++ b/Packages/AsterismCore/Tests/AsterismCoreTests/SiteInverseReachTests.swift@@ -0,0 +1,84 @@+import Foundation+import Testing++/// Q17 keeps `Site.entries` and `Site.works` out of reach. Access control is+/// **not** what does it: both are `internal`, and every traversal Q17 was+/// arguing about — the five `Work.entries` reads, two of them inside the+/// validator's per-Entry loop on the extension's 1 s path — lives *inside*+/// AsterismCore, where `internal` is no barrier at all.+///+/// What actually protects the fan-out is two things: no `entryValues` /+/// `workValues` convenience accessor exists beside `patternValues` /+/// `urlRuleValues`, so the traversal has to be written out longhand; and this+/// test, which fails when someone writes it out longhand.+///+/// It is a **grep with a compiler around it**, and it is shaped like one: it+/// matches member accesses whose receiver chain mentions a site, so+/// `site.entries`, `entry.site?.entries` and `siteRows.first?.works` are caught+/// while `work.entries` — legitimate, and the shape Q17 compares against — is+/// not. A receiver that mentions a site without being one (`compositeX.entries`)+/// would be a false positive; none exists, and renaming out of the way is a+/// cheaper answer than a real parser.+@Suite("The Site inverses stay unreached")+struct SiteInverseReachTests {++    /// Where the relationships are declared. The declaration is the one place+    /// the names may legitimately appear.+    private static let declarationFiles: Set<String> = ["Models.swift"]++    private static var sourcesDirectory: URL {+        URL(fileURLWithPath: #filePath)          // …/Tests/AsterismCoreTests/<this file>+            .deletingLastPathComponent()          // …/Tests/AsterismCoreTests+            .deletingLastPathComponent()          // …/Tests+            .deletingLastPathComponent()          // …/AsterismCore+            .appending(path: "Sources")+    }++    /// `<receiver chain>.entries` / `.works`, capturing the chain.+    private static let access = try! NSRegularExpression(+        pattern: "([A-Za-z_][A-Za-z0-9_?!.\\[\\]]*)\\.(entries|works)\\b")++    @Test("No file outside the schema declaration traverses a Site's inverses")+    func noSiteInverseTraversals() throws {+        let sources = Self.sourcesDirectory+        let enumerator = try #require(+            FileManager.default.enumerator(at: sources, includingPropertiesForKeys: nil))++        var scannedFiles = 0+        var offences: [String] = []+        for case let url as URL in enumerator where url.pathExtension == "swift" {+            guard !Self.declarationFiles.contains(url.lastPathComponent) else { continue }+            scannedFiles += 1+            let text = try String(contentsOf: url, encoding: .utf8)+            for (number, line) in text.split(separator: "\n", omittingEmptySubsequences: false).enumerated() {+                let code = Self.strippingComments(String(line))+                guard !code.isEmpty else { continue }+                let range = NSRange(code.startIndex..<code.endIndex, in: code)+                for match in Self.access.matches(in: code, range: range) {+                    guard let chainRange = Range(match.range(at: 1), in: code) else { continue }+                    let chain = String(code[chainRange])+                    guard chain.lowercased().contains("site") else { continue }+                    offences.append("\(url.lastPathComponent):\(number + 1): \(code.trimmingCharacters(in: .whitespaces))")+                }+            }+        }++        #expect(scannedFiles > 20, "the scan found almost no sources — check the path")+        #expect(offences.isEmpty, """+            A Site inverse is being traversed. `Site.entries` faults every Entry \+            for a hostname — roughly 125× the fan-out of `Work.entries` — which \+            the Req 5.1 budgets would pay for (Q17). Resolve from the record \+            instead: `entry.site`, or a hostname lookup where no record \+            identifies a Site yet (Req 3.3).+            \(offences.joined(separator: "\n"))+            """)+    }++    /// Drops `//` comments so a doc comment naming `Site.entries` — several do,+    /// deliberately — is not read as a traversal. String literals are not+    /// handled; none in this package contains such an access.+    private static func strippingComments(_ line: String) -> String {+        guard let marker = line.range(of: "//") else { return line }+        return String(line[line.startIndex..<marker.lowerBound])+    }+}

diff --git a/Packages/AsterismCore/Tests/AsterismCoreTests/V4Fixtures.swift b/Packages/AsterismCore/Tests/AsterismCoreTests/V4Fixtures.swiftindex dff38a1..24358f5 100644--- a/Packages/AsterismCore/Tests/AsterismCoreTests/V4Fixtures.swift+++ b/Packages/AsterismCore/Tests/AsterismCoreTests/V4Fixtures.swift@@ -2,8 +2,14 @@ import Foundation  @testable import AsterismCore -/// A coherent, valid V4 Site graph for validator tests, mutated per-test to+/// A coherent, valid Site graph for validator tests, mutated per-test to /// exercise the closed tuple table and Entry-state enumeration.+///+/// The builders set `entry.site` and `work.site` (task 19): every write site+/// links both halves in the same save (Req 1.4) and cited-rule resolution+/// follows the relationship (Req 3.2), so an unlinked graph is one the app+/// cannot produce. A test about the nil relationship itself unlinks explicitly+/// — see `V4ValidatorNilSiteToleranceTests`. struct V4Fixture {     let timestamp: Date     let site: Site@@ -12,6 +18,16 @@ struct V4Fixture {     let work: Work     let entry: Entry +    /// Moves the Entry onto a hostname that carries no Site row. Both halves of+    /// the reference move together (Req 1.4): leaving `entry.site` pointed at+    /// the old row would build a graph no write site and no migration can+    /// produce, and the citation resolution that follows the relationship would+    /// then be answering about a row the test says the Entry has left.+    func moveEntryToUnknownHostname(_ hostname: String) {+        entry.hostname = hostname+        entry.site = nil+    }+     var graph: V4LibraryGraph {         V4LibraryGraph(             entries: [entry], works: [work], sites: [site],@@ -77,6 +93,8 @@ enum V4Fixtures {         entry.workURLRuleID = rule.id         entry.workURLRuleVersion = rule.version         work.entries = [entry]+        entry.site = site+        work.site = site          return V4Fixture(             timestamp: timestamp, site: site, titlePattern: titlePattern,@@ -123,6 +141,8 @@ enum V4Fixtures {         entry.workPatternID = titlePattern.id         entry.workPatternVersion = titlePattern.version         work.entries = [entry]+        entry.site = site+        work.site = site          return V4Fixture(             timestamp: timestamp, site: site, titlePattern: titlePattern,@@ -151,6 +171,8 @@ enum V4Fixtures {         entry.workPatternID = titlePattern.id         entry.workPatternVersion = titlePattern.version         work.entries = [entry]+        entry.site = site+        work.site = site          return V4LibraryGraph(             entries: [entry], works: [work], sites: [site],

diff --git a/Packages/AsterismCore/Tests/AsterismCoreTests/V4LibraryValidatorTests.swift b/Packages/AsterismCore/Tests/AsterismCoreTests/V4LibraryValidatorTests.swiftindex ba508c1..12ce0ae 100644--- a/Packages/AsterismCore/Tests/AsterismCoreTests/V4LibraryValidatorTests.swift+++ b/Packages/AsterismCore/Tests/AsterismCoreTests/V4LibraryValidatorTests.swift@@ -146,7 +146,7 @@ struct V4LibraryValidatorTests {     @Test("An Entry referencing a missing Site fails store-level")     func unresolvedSiteThrows() throws {         let fixture = try V4Fixtures.wcSegmentIdentitySequence()-        fixture.entry.hostname = "nowhere.example"+        fixture.moveEntryToUnknownHostname("nowhere.example")         #expect(throws: V4ValidationError.self) {             _ = try V4LibraryValidator.validateStrict(graph: fixture.graph)         }

diff --git a/Packages/AsterismCore/Tests/AsterismCoreTests/V4MigrationBootstrapTests.swift b/Packages/AsterismCore/Tests/AsterismCoreTests/V4MigrationBootstrapTests.swiftindex 0049faf..b12b600 100644--- a/Packages/AsterismCore/Tests/AsterismCoreTests/V4MigrationBootstrapTests.swift+++ b/Packages/AsterismCore/Tests/AsterismCoreTests/V4MigrationBootstrapTests.swift@@ -258,7 +258,9 @@ struct V4MigrationBootstrapTests {     func futureV4MarkerFailsClosed() async throws {         let (_, cfg) = try config()         try makeV3Store(at: cfg) { _ in }-        try writeV4Marker(cfg, content: "5\n")+        // "5" is the migrated library the app also opens (Q14), so the future+        // version this asserts on is the one after it.+        try writeV4Marker(cfg, content: "6\n")         await #expect(throws: LibraryRepositoryError.self) {             try await LibraryRepository.openV4ForApp(cfg)         }@@ -522,6 +524,9 @@ struct V4MigrationBootstrapTests {         let (_, cfg) = try config()         try makeV3Store(at: cfg) { ctx in try self.ordinaryPattern(ctx, host: "ext.example", interpretationRaw: "pattern") }         try writeV3Marker(cfg)+        // Certification runs the relationship pass and publishes "5" itself —+        // the only version the extension opens (Q14) — so the app→extension+        // handoff is proved end-to-end, with no stand-in marker write (Q26).         _ = try await LibraryRepository.openV4ForApp(cfg)          let (result, _) = try await LibraryRepository.openV4ForExtension(cfg)@@ -556,7 +561,20 @@ struct V4MigrationBootstrapTests {         do {             let (_, cfg) = try config()             try makeV3Store(at: cfg) { _ in }-            try writeV4Marker(cfg, content: "5\n")+            try writeV4Marker(cfg, content: "6\n")+            await #expect(throws: LibraryRepositoryError.self) { try await LibraryRepository.openV4ForExtension(cfg) }+        }+        // (e) A certified but unmigrated library: the marker still reads "4",+        // so the extension declines rather than converting under a shared lock+        // (Q14). No production path leaves this state any more — certification+        // runs the relationship pass and publishes "5" — so it is constructed+        // the way it really arises: a store a pre-freeze build recorded, with+        // the "4" marker that build published beside it. MarkerContractTests+        // pins the message and the ordering.+        do {+            let (_, cfg) = try config()+            try V4RecordedStoreFixture.install(at: cfg.v4StoreURL)+            try writeV4Marker(cfg)             await #expect(throws: LibraryRepositoryError.self) { try await LibraryRepository.openV4ForExtension(cfg) }         }     }

diff --git a/Packages/AsterismCore/Tests/AsterismCoreTests/V4RecordedStoreTests.swift b/Packages/AsterismCore/Tests/AsterismCoreTests/V4RecordedStoreTests.swiftnew file mode 100644index 0000000..8e69371--- /dev/null+++ b/Packages/AsterismCore/Tests/AsterismCoreTests/V4RecordedStoreTests.swift@@ -0,0 +1,304 @@+import Foundation+import SQLite3+import SwiftData+import Testing++@testable import AsterismCore++/// The one store in the repository actually **recorded at 4.0.0**.+///+/// Nothing on this branch can write one any more: `AsterismV4MigrationPlan` is+/// gone and the live classes are V5's, so every store a test creates today is+/// recorded at 5.0.0. Without this file the faithfulness of the frozen+/// `AsterismSchemaV4` snapshot — the thing Q20 says a real library's openability+/// depends on — would be verified only by reading the two declarations side by+/// side.+///+/// It was generated in a detached worktree at 8f5695a (the commit before the+/// freeze, where the live classes *are* V4) by seeding one row of each of the+/// five models through the then-live `openV4Container`, running+/// `V4LibraryValidator.validate` over the result, checkpointing the WAL with+/// `PRAGMA wal_checkpoint(TRUNCATE)` and copying the single `.sqlite` here.+enum V4RecordedStoreFixture {+    static let hostname = "frozen.example"+    static let siteDisplayName = "Frozen Example"+    static let patternID = UUID(uuidString: "22222222-2222-2222-2222-222222222222")!+    static let rulePatternID = UUID(uuidString: "33333333-3333-3333-3333-333333333333")!+    static let workID = UUID(uuidString: "44444444-4444-4444-4444-444444444444")!+    static let entryID = UUID(uuidString: "55555555-5555-5555-5555-555555555555")!+    static let captureTitle = "Chapter 7 — A Frozen Work"+    static let note = "Recorded at 4.0.0 ✓"+    static let rawURLString = "https://frozen.example/read?series=42&chapter=7"++    static var sourceURL: URL {+        URL(fileURLWithPath: #filePath)+            .deletingLastPathComponent()+            .appending(path: "Fixtures/v4-recorded-4.0.0.sqlite")+    }++    /// Copies the fixture to `storeURL`. Opening it converts it in place, so+    /// every caller works on its own copy and the resource stays at 4.0.0.+    static func install(at storeURL: URL) throws {+        try FileManager.default.createDirectory(+            at: storeURL.deletingLastPathComponent(), withIntermediateDirectories: true)+        for suffix in ["", "-wal", "-shm"] {+            try? FileManager.default.removeItem(+                at: URL(fileURLWithPath: storeURL.path + suffix))+        }+        try FileManager.default.copyItem(at: sourceURL, to: storeURL)+    }++    /// The schema versions Core Data recorded into the store's own metadata —+    /// `["4.0.0"]` until something converts it, `["5.0.0"]` afterwards. Read+    /// straight out of `Z_METADATA` rather than through SwiftData, so asking+    /// the question cannot itself perform the conversion.+    static func recordedModelVersions(at storeURL: URL) throws -> [String] {+        var handle: OpaquePointer?+        // Read-*write*, despite only ever running a SELECT: a read-only+        // connection cannot create the `-shm` a WAL-mode store needs, and a+        // store Core Data has just converted keeps that conversion in its WAL.+        // SQLite removes both sidecars again when the last connection closes.+        guard sqlite3_open_v2(storeURL.path, &handle, SQLITE_OPEN_READWRITE, nil) == SQLITE_OK,+              let database = handle else {+            throw FixtureError.unreadable("could not open \(storeURL.lastPathComponent)")+        }+        defer { sqlite3_close(database) }++        var statement: OpaquePointer?+        guard sqlite3_prepare_v2(database, "SELECT Z_PLIST FROM Z_METADATA", -1, &statement, nil) == SQLITE_OK,+              let query = statement else {+            throw FixtureError.unreadable(+                "Z_METADATA unreadable: \(String(cString: sqlite3_errmsg(database)))")+        }+        defer { sqlite3_finalize(query) }++        guard sqlite3_step(query) == SQLITE_ROW,+              let bytes = sqlite3_column_blob(query, 0) else {+            throw FixtureError.unreadable("no Z_METADATA row")+        }+        let plist = Data(bytes: bytes, count: Int(sqlite3_column_bytes(query, 0)))+        let decoded = try PropertyListSerialization.propertyList(+            from: plist, options: [], format: nil)+        guard let metadata = decoded as? [String: Any],+              let identifiers = metadata["NSStoreModelVersionIdentifiers"] as? [String] else {+            throw FixtureError.unreadable("no NSStoreModelVersionIdentifiers")+        }+        return identifiers+    }++    enum FixtureError: Error { case unreadable(String) }+}++/// The second genuinely **4.0.0-recorded** store: 432 Entries, 36 Works and 4+/// Site rows across three hostnames, one of which carries a duplicate row.+///+/// `V4RecordedStoreFixture` holds one row of each model, which is enough to+/// prove the frozen snapshot hash-matches but not enough to say the 4.0.0 →+/// 5.0.0 conversion is lossless over a real graph: a single row cannot exercise+/// citation provenance across several Sites, and with one Site row there is no+/// wrong row for the relationship pass to pick.+///+/// Generated the same way as its sibling — a detached worktree at 8f5695a (the+/// commit before the freeze, where the live classes *are* V4), a throwaway test+/// seeding the shape below through the then-live `openV4Container`, `PRAGMA+/// wal_checkpoint(TRUNCATE)`, and the single `.sqlite` copied into `Fixtures/`.+/// Every value is a pure function of its indices, so the expectations below are+/// the seeded values rather than a re-read of the store.+enum V4RecordedScaleStoreFixture {+    static let hostnames = ["alpha.example", "beta.example", "dup.example"]+    /// The hostname carrying two Site rows: a taught row owning both rules and+    /// an untaught duplicate owning none.+    static let duplicatedHostname = "dup.example"+    static let duplicateRowDisplayName = "Duplicate"+    static let worksPerHost = 12+    static let entriesPerWork = 12+    static let ts = Date(timeIntervalSince1970: 1_800_000_000)++    static var entryCount: Int { hostnames.count * worksPerHost * entriesPerWork }+    static var workCount: Int { hostnames.count * worksPerHost }+    static var siteCount: Int { hostnames.count + 1 }++    static func uuid(_ namespace: Int, _ index: Int) -> UUID {+        guard let id = UUID(+            uuidString: String(format: "%08X-0000-4000-8000-%012X", namespace, index)+        ) else { preconditionFailure("deterministic fixture UUID format") }+        return id+    }++    static func siteDisplayName(hostIndex: Int) -> String { "Site \(hostIndex)" }+    static func patternID(hostIndex: Int) -> UUID { uuid(1, hostIndex) }+    static let patternVersion = 3+    static func urlRuleID(hostIndex: Int) -> UUID { uuid(2, hostIndex) }+    static let urlRuleVersion = 2+    static func workID(hostIndex: Int, workIndex: Int) -> UUID {+        uuid(3, hostIndex * 1_000 + workIndex)+    }+    static func workTitle(hostIndex: Int, workIndex: Int) -> String {+        "Story \(hostIndex)-\(workIndex)"+    }+    static func entryID(hostIndex: Int, workIndex: Int, entryIndex: Int) -> UUID {+        uuid(4, hostIndex * 1_000_000 + workIndex * 1_000 + entryIndex)+    }+    static func rawURL(hostname: String, workIndex: Int, entryIndex: Int) -> String {+        "https://\(hostname)/read?chapter=\(entryIndex + 1)&w=\(workIndex)"+    }+    static func captureTitle(hostIndex: Int, workIndex: Int, entryIndex: Int) -> String {+        "[Chapter \(entryIndex + 1) of Story \(hostIndex)-\(workIndex).]"+    }++    static var sourceURL: URL {+        URL(fileURLWithPath: #filePath)+            .deletingLastPathComponent()+            .appending(path: "Fixtures/v4-recorded-4.0.0-scale.sqlite")+    }++    /// Copies the fixture to `storeURL`. Opening it converts it in place, so+    /// every caller works on its own copy and the resource stays at 4.0.0.+    static func install(at storeURL: URL) throws {+        try FileManager.default.createDirectory(+            at: storeURL.deletingLastPathComponent(), withIntermediateDirectories: true)+        for suffix in ["", "-wal", "-shm"] {+            try? FileManager.default.removeItem(+                at: URL(fileURLWithPath: storeURL.path + suffix))+        }+        try FileManager.default.copyItem(at: sourceURL, to: storeURL)+    }+}++/// Proof that the frozen `AsterismSchemaV4` snapshot hash-matches what shipped:+/// a store a *pre-freeze* build wrote still opens under the V5 plan, and every+/// field comes back as it was written.+@Suite("A 4.0.0-recorded store under the V5 plan", .serialized)+struct V4RecordedStoreTests {++    private final class TempDir {+        let url: URL+        init() throws {+            url = FileManager.default.temporaryDirectory.appending(+                path: "V4Recorded-\(UUID())", directoryHint: .isDirectory)+            try FileManager.default.createDirectory(at: url, withIntermediateDirectories: true)+        }+        deinit { try? FileManager.default.removeItem(at: url) }+    }++    @Test("The fixture really is recorded at 4.0.0")+    func fixtureIsRecordedAtFourZeroZero() throws {+        // Read a copy, never the resource: opening a WAL-mode store — even to+        // run one SELECT — creates `-wal` / `-shm` beside it, and the tracked+        // file must stay a single self-contained `.sqlite`.+        let dir = try TempDir()+        let copy = dir.url.appending(path: "fixture.sqlite")+        try V4RecordedStoreFixture.install(at: copy)++        #expect(try V4RecordedStoreFixture.recordedModelVersions(at: copy) == ["4.0.0"],+                "the resource must never be converted in place")+    }++    @Test("openV4Container converts it and reads every seeded row back intact")+    func opensAndReadsBackIntact() throws {+        let dir = try TempDir()+        let storeURL = dir.url.appending(path: "store.sqlite")+        try V4RecordedStoreFixture.install(at: storeURL)++        let container = try LibraryRepository.openV4Container(at: storeURL)+        let context = ModelContext(container)+        defer { withExtendedLifetime(container) {} }++        let sites = try context.fetch(FetchDescriptor<Site>())+        let entries = try context.fetch(FetchDescriptor<Entry>())+        let works = try context.fetch(FetchDescriptor<Work>())+        let patterns = try context.fetch(FetchDescriptor<TitlePattern>())+        let rules = try context.fetch(FetchDescriptor<URLRulePattern>())+        let counts: [Int] = [sites.count, entries.count, works.count, patterns.count, rules.count]+        #expect(counts == [1, 1, 1, 1, 1])++        let site = try #require(sites.first)+        #expect(site.hostname == V4RecordedStoreFixture.hostname)+        #expect(site.displayName == V4RecordedStoreFixture.siteDisplayName)+        #expect(site.mode == .taught)++        let pattern = try #require(patterns.first)+        #expect(pattern.id == V4RecordedStoreFixture.patternID)+        #expect(pattern.version == 3)+        #expect(pattern.isActive)+        #expect(pattern.trimPrefix == "[")+        #expect(pattern.trimSuffix == "]")+        #expect(try pattern.definition+                == .phrase(prefix: "", separator: " — ", suffix: "", order: .chapterThenWork))+        #expect(pattern.site?.hostname == V4RecordedStoreFixture.hostname)++        let rule = try #require(rules.first)+        #expect(rule.id == V4RecordedStoreFixture.rulePatternID)+        #expect(rule.version == 2)+        #expect(rule.isCurrent)+        #expect(rule.origin == .readerTaught)++        let work = try #require(works.first)+        #expect(work.id == V4RecordedStoreFixture.workID)+        #expect(work.displayTitle == "A Frozen Work")+        #expect(work.siteHostname == V4RecordedStoreFixture.hostname)+        #expect(work.urlIdentity == "42")+        #expect(work.urlIdentityState == .rule)+        #expect(work.urlIdentityRuleID == V4RecordedStoreFixture.rulePatternID)+        #expect(work.genreTags == ["frozen", "fixture"])++        let entry = try #require(entries.first)+        #expect(entry.id == V4RecordedStoreFixture.entryID)+        #expect(entry.captureTitle == V4RecordedStoreFixture.captureTitle)+        #expect(entry.note == V4RecordedStoreFixture.note)+        #expect(entry.rating == .up)+        #expect(entry.rawURLString == V4RecordedStoreFixture.rawURLString)+        #expect(entry.hostname == V4RecordedStoreFixture.hostname)+        #expect(entry.identityKeyVersion == 2)+        #expect(entry.identityBasis == .urlRule)+        // Citation provenance: the tuples this milestone resolves through the+        // Site relationship must survive the conversion unchanged (Req 2.2).+        #expect(entry.chapterTitle == "Chapter 7")+        #expect(entry.chapterTitleProvenance == .pattern)+        #expect(entry.chapterPatternID == V4RecordedStoreFixture.patternID)+        #expect(entry.chapterPatternVersion == 3)+        #expect(entry.chapterSequence == "7")+        #expect(entry.chapterSequenceRuleID == V4RecordedStoreFixture.rulePatternID)+        #expect(entry.chapterSequenceRuleVersion == 2)+        #expect(entry.workAssignmentProvenance == .urlRule)+        #expect(entry.workURLRuleID == V4RecordedStoreFixture.rulePatternID)+        #expect(entry.work?.id == V4RecordedStoreFixture.workID)+        #expect(entry.firstCapturedAt == Date(timeIntervalSince1970: 1_800_000_000))++        // The V4 → V5 stage adds the relationships and leaves them nil. That is+        // the state the relationship pass (tasks 8-11) exists to repair, and a+        // 4.0.0 store is the only place it can be observed.+        #expect(entry.site == nil)+        #expect(work.site == nil)+    }++    @Test("The store is left recorded at 5.0.0 once it has been opened")+    func openingRecordsTheNewVersion() throws {+        let dir = try TempDir()+        let storeURL = dir.url.appending(path: "store.sqlite")+        try V4RecordedStoreFixture.install(at: storeURL)+        #expect(try V4RecordedStoreFixture.recordedModelVersions(at: storeURL) == ["4.0.0"])++        let container = try LibraryRepository.openV4Container(at: storeURL)+        _ = ModelContext(container)+        withExtendedLifetime(container) {}++        #expect(try V4RecordedStoreFixture.recordedModelVersions(at: storeURL) == ["5.0.0"],+                "ModelContainer.init is what performs the conversion (Q14)")+    }++    @Test("A validator run over the converted store still finds it legal")+    func convertedStoreValidates() throws {+        let dir = try TempDir()+        let storeURL = dir.url.appending(path: "store.sqlite")+        try V4RecordedStoreFixture.install(at: storeURL)++        let container = try LibraryRepository.openV4Container(at: storeURL)+        let context = ModelContext(container)+        defer { withExtendedLifetime(container) {} }++        let diagnostics = try LibraryRepository.validateV4Store(context: context)+        #expect(diagnostics.quarantineMap().isEmpty,+                "the graph was legal when it was written at 4.0.0 and nothing was dropped")+    }+}

diff --git a/Packages/AsterismCore/Tests/AsterismCoreTests/V4ValidatorNilSiteToleranceTests.swift b/Packages/AsterismCore/Tests/AsterismCoreTests/V4ValidatorNilSiteToleranceTests.swiftnew file mode 100644index 0000000..a8608eb--- /dev/null+++ b/Packages/AsterismCore/Tests/AsterismCoreTests/V4ValidatorNilSiteToleranceTests.swift@@ -0,0 +1,330 @@+import Foundation+import SwiftData+import Testing++@testable import AsterismCore++/// Task 13, Req 3.4, Q27: the four cited-rule sites in `V4LibraryValidator`+/// tolerate a **nil Site relationship**.+///+/// Each of `:389` (Work rule identity), `:528` (v3 identity name contributor),+/// `:611` (pattern chapter provenance) and `:697` (`requiredReference`) throws+/// when the citation does not resolve; the throw becomes a per-Site diagnosis+/// and the diagnosis quarantines the hostname. Task 14 narrows resolution to+/// `entry.site`, at which point every record whose relationship is nil — a+/// state Req 2.1 explicitly permits — would quarantine its hostname. Req 3.4+/// forbids that by name: a nil relationship SHALL NOT quarantine a hostname,+/// fail a screen, or prevent export.+///+/// So the resolution clause is demoted rather than the whole check: a citation+/// that cannot be resolved is a tuple failure **only when the citing record+/// points at a Site**. With no Site to resolve it within, there is nothing to+/// replay and nothing to diagnose. Every other clause of each guard — a+/// nonblank identity, a complete `(id, version)` reference, the tuple table's+/// own arms — is untouched, which is what the second half of each test pins.+@Suite("Validator cited-rule sites tolerate a nil Site relationship", .serialized)+struct V4ValidatorNilSiteToleranceTests {++    /// Unlinks the fixture's records from their Site row. `V4Fixtures` builds+    /// the linked graph — the one every write site and the relationship pass+    /// produce — so the nil-relationship state this suite is about has to be+    /// constructed deliberately. Reversing this is the whole experiment: same+    /// store, same citation, relationship present or absent.+    private func unlink(_ fixture: V4Fixture) {+        fixture.entry.site = nil+        fixture.work.site = nil+    }++    private func diagnostics(_ fixture: V4Fixture) throws -> LibraryDiagnostics {+        try V4LibraryValidator.validate(graph: fixture.graph)+    }++    // MARK: - :389 — Work rule identity++    @Test("Work rule identity: a nil work.site tolerates an unresolvable rule instead of quarantining")+    func workRuleIdentityToleratesNilSite() throws {+        let fixture = try V4Fixtures.wcSegmentIdentitySequence()+        unlink(fixture)+        fixture.work.urlIdentityRuleID = UUID()  // cites a rule no Site owns++        let tolerated = try diagnostics(fixture)+        #expect(tolerated.quarantineMap().isEmpty,+                "a nil relationship must not quarantine the hostname (Req 3.4)")+        #expect(tolerated.tupleDiagnoses.isEmpty)+    }++    @Test("Work rule identity: a populated work.site still diagnoses an unresolvable rule")+    func workRuleIdentityStillFailsWithAPopulatedSite() throws {+        let fixture = try V4Fixtures.wcSegmentIdentitySequence()+        fixture.work.urlIdentityRuleID = UUID()++        let diagnosed = try diagnostics(fixture)+        #expect(diagnosed.quarantineMap()[fixture.site.hostname] != nil,+                "with a Site to resolve within, the closed tuple table is unchanged")+    }++    /// The demotion is of the *resolution* clause only. A `.rule` identity with+    /// a blank value is illegal whatever the relationship holds.+    @Test("Work rule identity: a blank identity still fails closed with a nil work.site")+    func workRuleIdentityBlankValueStillFailsClosed() throws {+        let fixture = try V4Fixtures.wcSegmentIdentitySequence()+        unlink(fixture)+        fixture.work.urlIdentity = "   "++        #expect(try diagnostics(fixture).quarantineMap()[fixture.site.hostname] != nil)+    }++    // MARK: - :528 — v3 identity name contributor++    @Test("v3 name contributor: a nil entry.site tolerates an unresolvable pattern instead of quarantining")+    func v3NameContributorToleratesNilSite() throws {+        let fixture = try V4Fixtures.wholeTitleSequence()+        unlink(fixture)+        fixture.entry.identityNameTitleRuleVersion = 99  // version mismatch++        let tolerated = try diagnostics(fixture)+        #expect(tolerated.quarantineMap().isEmpty)+        #expect(tolerated.tupleDiagnoses.isEmpty)+    }++    @Test("v3 name contributor: a populated entry.site still diagnoses an unresolvable pattern")+    func v3NameContributorStillFailsWithAPopulatedSite() throws {+        let fixture = try V4Fixtures.wholeTitleSequence()+        fixture.entry.identityNameTitleRuleVersion = 99++        #expect(try diagnostics(fixture).quarantineMap()[fixture.site.hostname] != nil)+    }++    /// The v3 arm's non-citation clauses — no Work identity, a sequence rule+    /// equal to the identity rule — are not part of the demotion.+    @Test("v3 identity: a stray Work identity still fails closed with a nil entry.site")+    func v3StrayWorkIdentityStillFailsClosed() throws {+        let fixture = try V4Fixtures.wholeTitleSequence()+        unlink(fixture)+        fixture.entry.urlWorkIdentity = "42"++        #expect(try diagnostics(fixture).quarantineMap()[fixture.site.hostname] != nil)+    }++    /// The name replay (Req 4.2) is what the contributor is cited *for*. A+    /// contributor that resolves — within the Entry's own linked Site — still+    /// has its replay enforced; only an unresolvable one is tolerated, and with+    /// a nil relationship nothing can resolve in the first place.+    @Test("v3 identity: a resolving contributor that replays a different name still fails closed")+    func v3NameReplayStillFailsClosed() throws {+        let fixture = try V4Fixtures.wholeTitleSequence()+        fixture.entry.captureTitle = "A Different Title Entirely"++        #expect(try diagnostics(fixture).quarantineMap()[fixture.site.hostname] != nil)+    }++    // MARK: - :611 — pattern chapter provenance++    @Test("Chapter provenance: a nil entry.site tolerates an unresolvable pattern instead of quarantining")+    func chapterProvenanceToleratesNilSite() throws {+        let fixture = try V4Fixtures.wcSegmentIdentitySequence()+        unlink(fixture)+        fixture.entry.chapterPatternVersion = 99++        let tolerated = try diagnostics(fixture)+        #expect(tolerated.quarantineMap().isEmpty)+        #expect(tolerated.tupleDiagnoses.isEmpty)+    }++    @Test("Chapter provenance: a populated entry.site still diagnoses an unresolvable pattern")+    func chapterProvenanceStillFailsWithAPopulatedSite() throws {+        let fixture = try V4Fixtures.wcSegmentIdentitySequence()+        fixture.entry.chapterPatternVersion = 99++        #expect(try diagnostics(fixture).quarantineMap()[fixture.site.hostname] != nil)+    }++    @Test("Chapter provenance: a blank chapter title still fails closed with a nil entry.site")+    func chapterBlankTitleStillFailsClosed() throws {+        let fixture = try V4Fixtures.wcSegmentIdentitySequence()+        unlink(fixture)+        fixture.entry.chapterTitle = "  "++        #expect(try diagnostics(fixture).quarantineMap()[fixture.site.hostname] != nil)+    }++    // MARK: - :697 — requiredReference++    @Test("Required reference: a nil entry.site tolerates an unresolvable assignment rule")+    func requiredReferenceToleratesNilSite() throws {+        let fixture = try V4Fixtures.wcSegmentIdentitySequence()+        unlink(fixture)+        fixture.entry.workURLRuleID = UUID()  // assignment cites a rule no Site owns++        let tolerated = try diagnostics(fixture)+        #expect(tolerated.quarantineMap().isEmpty)+        #expect(tolerated.tupleDiagnoses.isEmpty)+    }++    @Test("Required reference: a populated entry.site still diagnoses an unresolvable assignment rule")+    func requiredReferenceStillFailsWithAPopulatedSite() throws {+        let fixture = try V4Fixtures.wcSegmentIdentitySequence()+        fixture.entry.workURLRuleID = UUID()++        #expect(try diagnostics(fixture).quarantineMap()[fixture.site.hostname] != nil)+    }++    /// An incomplete reference — an id with no version — is malformed rather+    /// than unresolvable, and stays a diagnosis whatever the relationship holds.+    @Test("Required reference: a half-written reference still fails closed with a nil entry.site")+    func requiredReferenceIncompleteStillFailsClosed() throws {+        let fixture = try V4Fixtures.wcSegmentIdentitySequence()+        unlink(fixture)+        fixture.entry.workURLRuleVersion = nil++        #expect(try diagnostics(fixture).quarantineMap()[fixture.site.hostname] != nil)+    }++    // MARK: - validateExtractionReplay (Q40)++    /// `validateExtractionReplay` is not one of the four sites, but it replays a+    /// reference `requiredReference` has just tolerated. Left alone it would+    /// re-throw one call later and quarantine the hostname anyway, undoing the+    /// demotion for every Entry carrying a URL extraction — which is most of+    /// them.+    ///+    /// Reaching it takes all three references moving together: the tuple table+    /// requires the Work and sequence rules to be the same rule, and the v2 key+    /// requires the identity rule to be that rule too. With one bogus id in all+    /// three, every guard above the replay passes and the replay is the only+    /// thing left that can fail.+    @Test("Work extraction replay: a nil entry.site tolerates a retained rule that does not resolve")+    func extractionReplayToleratesNilSite() throws {+        let fixture = try V4Fixtures.wcSegmentIdentitySequence()+        unlink(fixture)+        let bogus = UUID()+        fixture.entry.urlWorkRuleID = bogus+        fixture.entry.chapterSequenceRuleID = bogus+        fixture.entry.identityURLRuleID = bogus++        let tolerated = try diagnostics(fixture)+        #expect(tolerated.quarantineMap().isEmpty,+                "the replay must tolerate what requiredReference already tolerated")+        #expect(tolerated.tupleDiagnoses.isEmpty)+    }++    @Test("Work extraction replay: a populated entry.site still diagnoses it")+    func extractionReplayStillFailsWithAPopulatedSite() throws {+        let fixture = try V4Fixtures.wcSegmentIdentitySequence()+        let bogus = UUID()+        fixture.entry.urlWorkRuleID = bogus+        fixture.entry.chapterSequenceRuleID = bogus+        fixture.entry.identityURLRuleID = bogus++        #expect(try diagnostics(fixture).quarantineMap()[fixture.site.hostname] != nil)+    }++    /// The sequence-only arm of the same routine, on the v3 fixture: no Work+    /// extraction, so the `else if let sequenceReference` branch is the one that+    /// has to tolerate.+    @Test("Sequence extraction replay: a nil entry.site tolerates a retained rule that does not resolve")+    func sequenceReplayToleratesNilSite() throws {+        let fixture = try V4Fixtures.wholeTitleSequence()+        unlink(fixture)+        let bogus = UUID()+        fixture.entry.chapterSequenceRuleID = bogus+        fixture.entry.identityURLRuleID = bogus++        let tolerated = try diagnostics(fixture)+        #expect(tolerated.quarantineMap().isEmpty)+        #expect(tolerated.tupleDiagnoses.isEmpty)+    }++    @Test("Sequence extraction replay: a populated entry.site still diagnoses it")+    func sequenceReplayStillFailsWithAPopulatedSite() throws {+        let fixture = try V4Fixtures.wholeTitleSequence()+        let bogus = UUID()+        fixture.entry.chapterSequenceRuleID = bogus+        fixture.entry.identityURLRuleID = bogus++        #expect(try diagnostics(fixture).quarantineMap()[fixture.site.hostname] != nil)+    }++    /// The residual path Decision 3 left open, and Decision 5 closes. The replay+    /// used to resolve its retained rule in a **library-global** winners index,+    /// so an Entry with a nil relationship whose cited rule id exists anywhere in+    /// the store still replayed — and quarantined its hostname when the replay+    /// disagreed, which is the outcome Req 3.4 forbids for exactly this state.+    /// The rule here is the fixture's own, still owned by the Site row and still+    /// in the graph; only the Entry's pointer to that row is gone.+    @Test("Work extraction replay: a nil entry.site tolerates a rule that resolves elsewhere in the store")+    func extractionReplayToleratesARuleResolvingOnlyGlobally() throws {+        let fixture = try V4Fixtures.wcSegmentIdentitySequence()+        unlink(fixture)+        // The cited rule still exists and still matches by id and version; what+        // fails is the replay, because the raw URL no longer carries the fields+        // the rule reads.+        fixture.entry.rawURLString = "https://example.com/read?other=1"+        fixture.entry.conservativeIdentityKey = fixture.entry.rawURLString++        let tolerated = try diagnostics(fixture)+        #expect(tolerated.quarantineMap().isEmpty,+                "a rule the Entry's own Site no longer owns is not a rule to replay against")+        #expect(tolerated.tupleDiagnoses.isEmpty)+    }++    /// The other half: the same store shape with the relationship present. The+    /// rule is in the Entry's own Site, so the replay is enforced exactly as it+    /// always was — narrowing the lookup weakens nothing for a linked record.+    @Test("Work extraction replay: a linked entry.site still enforces the replay")+    func extractionReplayStillEnforcedForALinkedEntry() throws {+        let fixture = try V4Fixtures.wcSegmentIdentitySequence()+        fixture.entry.rawURLString = "https://example.com/read?other=1"+        fixture.entry.conservativeIdentityKey = fixture.entry.rawURLString++        #expect(try diagnostics(fixture).quarantineMap()[fixture.site.hostname] != nil)+    }++    // MARK: - The record survives++    /// Req 3.4's other half: the record is left renderable. A tolerated+    /// citation leaves the Entry in the graph, snapshot-able, and its hostname+    /// unquarantined, so no screen and no export gate refuses it.+    @Test("A tolerated citation leaves the record renderable and the hostname open")+    func toleratedRecordStillRenders() throws {+        let fixture = try V4Fixtures.wcSegmentIdentitySequence()+        unlink(fixture)+        fixture.entry.chapterPatternVersion = 99++        let tolerated = try diagnostics(fixture)+        #expect(tolerated.quarantineMap().isEmpty)+        #expect(tolerated.unresolvedRecordCount == 0, "a nil relationship must not block export")+        #expect(try LibraryRepository.snapshot(fixture.entry).id == fixture.entry.id)+    }++    /// The import gates stay strict (Decision 3): tolerance is a property of the+    /// two open paths, and an archive must still be wholly legal.+    @Test("validateStrict is unchanged by the demotion")+    func strictValidationIsUnchanged() throws {+        let fixture = try V4Fixtures.wcSegmentIdentitySequence()+        unlink(fixture)+        fixture.entry.chapterPatternVersion = 99++        let diagnoses = try V4LibraryValidator.validateStrict(graph: fixture.graph)+        #expect(diagnoses[fixture.site.hostname] != nil,+                "strict validation diagnoses the tuple whatever the relationship holds")+    }++    /// The other half of Q39. `validateEntryTuple` validates the tuple a commit+    /// is *about to write*, and Req 1.4 makes every write site set both halves+    /// in the same save — so an unlinked citation reaching this gate is a bug in+    /// the writer, not a state to survive. It throws where the open path+    /// tolerates.+    @Test("validateEntryTuple never tolerates: a nil entry.site still throws")+    func entryTupleGateNeverTolerates() throws {+        let fixture = try V4Fixtures.wcSegmentIdentitySequence()+        unlink(fixture)+        fixture.entry.chapterPatternVersion = 99+        #expect(fixture.entry.site == nil)++        #expect(throws: V4ValidationError.self) {+            try V4LibraryValidator.validateEntryTuple(+                entry: fixture.entry, site: fixture.site, works: [fixture.work])+        }+    }+}

diff --git a/Packages/AsterismCore/Tests/AsterismCoreTests/V4ValidatorToleranceTests.swift b/Packages/AsterismCore/Tests/AsterismCoreTests/V4ValidatorToleranceTests.swiftindex 2027e4a..8f72da5 100644--- a/Packages/AsterismCore/Tests/AsterismCoreTests/V4ValidatorToleranceTests.swift+++ b/Packages/AsterismCore/Tests/AsterismCoreTests/V4ValidatorToleranceTests.swift@@ -301,7 +301,7 @@ struct V4ValidatorToleranceTests {     @Test("The graph entry points carry the same split as the context ones")     func graphEntryPoints() throws {         let fixture = try V4Fixtures.wcSegmentIdentitySequence()-        fixture.entry.hostname = "nowhere.example"+        fixture.moveEntryToUnknownHostname("nowhere.example")          let diagnostics = try V4LibraryValidator.validate(graph: fixture.graph)         #expect(diagnostics.diagnoses == [@@ -329,12 +329,12 @@ private final class ValidatorStore {         directory = FileManager.default.temporaryDirectory             .appending(path: "AsterismValidatorTolerance-\(UUID())", directoryHint: .isDirectory)         try FileManager.default.createDirectory(at: directory, withIntermediateDirectories: true)-        let schema = Schema(versionedSchema: AsterismSchemaV4.self)+        let schema = Schema(versionedSchema: AsterismSchemaV5.self)         let configuration = ModelConfiguration(             "AsterismV3", schema: schema,             url: directory.appending(path: "library.store"), cloudKitDatabase: .none)         container = try ModelContainer(-            for: schema, migrationPlan: AsterismV4MigrationPlan.self,+            for: schema, migrationPlan: AsterismV5MigrationPlan.self,             configurations: [configuration])         context = ModelContext(container)     }

diff --git a/Packages/AsterismCore/Tests/AsterismCoreTests/V5CertificationPathTests.swift b/Packages/AsterismCore/Tests/AsterismCoreTests/V5CertificationPathTests.swiftnew file mode 100644index 0000000..fe29891--- /dev/null+++ b/Packages/AsterismCore/Tests/AsterismCoreTests/V5CertificationPathTests.swift@@ -0,0 +1,365 @@+import Foundation+import SwiftData+import Testing++@testable import AsterismCore++/// Task 10: all three certification paths run the relationship pass before+/// publishing readiness (Req 2.1, 2.3, 2.4) — V4-marker, V3-marker, and+/// sidecar-resume. The latter two reach the marker through `certifyMigration`,+/// which would otherwise stamp `"5"` on a library whose relationships were+/// never populated: an M3-era library upgrading in one launch would certify+/// with every relationship nil. Each test asserts the marker reads `"5"` only+/// once relationships are populated. The fourth readiness-publishing path,+/// mark-at-birth for an empty store, publishes `"5"` directly and runs no pass+/// (Q26) — pinned here so it does not grow one.+@Suite("Certification paths run the relationship pass", .serialized)+struct V5CertificationPathTests {++    // MARK: - Helpers++    private final class TempDir {+        let url: URL+        init() throws {+            url = FileManager.default.temporaryDirectory.appending(+                path: "V5Certify-\(UUID())", directoryHint: .isDirectory)+            try FileManager.default.createDirectory(at: url, withIntermediateDirectories: true)+        }+        deinit { try? FileManager.default.removeItem(at: url) }+    }++    private func config() throws -> (TempDir, LibraryConfiguration) {+        let dir = try TempDir()+        return (dir, LibraryConfiguration(rootDirectory: dir.url, environment: .development))+    }++    private static let ts = Date(timeIntervalSince1970: 1_800_000_000)++    private func markerContent(_ configuration: LibraryConfiguration) throws -> String {+        try String(contentsOf: configuration.v4MarkerURL, encoding: .utf8)+            .trimmingCharacters(in: .whitespacesAndNewlines)+    }++    /// A V3 store carrying one taught Site, one Work, and one Entry citing the+    /// Site's pattern — the graph an M3-era library brings to a one-launch+    /// upgrade. Same shape as `V4MigrationBootstrapTests.ordinaryPattern`.+    private func makeV3Store(at configuration: LibraryConfiguration, host: String) throws {+        try FileManager.default.createDirectory(+            at: configuration.v3StoreURL.deletingLastPathComponent(), withIntermediateDirectories: true)+        let container = try LibraryRepository.openV3Container(at: configuration.v3StoreURL)+        let context = ModelContext(container)++        let site = AsterismSchemaV3.Site()+        site.hostname = host+        site.modeRaw = SiteMode.taught.rawValue+        site.titleInterpretationRaw = "pattern"+        let pattern = AsterismSchemaV3.TitlePattern()+        pattern.id = UUID()+        pattern.version = 1+        pattern.isActive = true+        pattern.createdAt = Self.ts+        pattern.formRaw = PatternForm.segment.rawValue+        pattern.segmentWorkAnchor = try SegmentRangeSpec(origin: .start, offset: 0, length: 1)+        pattern.segmentIgnoredAnchors = []+        pattern.site = site+        site.patterns = [pattern]+        let raw = "https://\(host)/read/1"+        let work = AsterismSchemaV3.Work()+        work.displayTitle = "A Work"+        work.siteHostname = host+        work.createdAt = Self.ts+        work.modifiedAt = Self.ts+        let entry = AsterismSchemaV3.Entry()+        entry.captureTitle = "A Work"+        entry.captureTitleSourceRaw = CaptureTitleSource.host.rawValue+        entry.rawURLString = raw+        entry.hostname = host+        entry.entryIdentityKey = raw+        entry.firstCapturedAt = Self.ts+        entry.lastSharedAt = Self.ts+        entry.modifiedAt = Self.ts+        entry.work = work+        entry.chapterTitle = "Chapter"+        entry.chapterTitleProvenanceRaw = FieldProvenanceKind.pattern.rawValue+        entry.chapterPatternID = pattern.id+        entry.chapterPatternVersion = pattern.version+        entry.workAssignmentProvenanceRaw = FieldProvenanceKind.pattern.rawValue+        entry.workPatternID = pattern.id+        entry.workPatternVersion = pattern.version+        work.entries = [entry]+        context.insert(site)+        context.insert(work)+        context.insert(entry)+        try context.save()+        withExtendedLifetime(container) {}+    }++    /// Every Entry and Work in the store points at the Site row carrying its+    /// hostname — the state certification must produce before it may say "5".+    private func expectRelationshipsPopulated(+        _ configuration: LibraryConfiguration, sourceLocation: SourceLocation = #_sourceLocation+    ) throws {+        let container = try LibraryRepository.openV4Container(at: configuration.v4StoreURL)+        let context = ModelContext(container)+        let entries = try context.fetch(FetchDescriptor<Entry>())+        let works = try context.fetch(FetchDescriptor<Work>())+        #expect(!entries.isEmpty, "a populated graph is the premise of these paths",+                sourceLocation: sourceLocation)+        for entry in entries {+            #expect(entry.site?.hostname == entry.hostname,+                    "\(entry.rawURLString): relationship populated by the pass",+                    sourceLocation: sourceLocation)+        }+        for work in works {+            #expect(work.site?.hostname == work.siteHostname,+                    "\(work.displayTitle): relationship populated by the pass",+                    sourceLocation: sourceLocation)+        }+        withExtendedLifetime(container) {}+    }++    private func stripRelationships(_ configuration: LibraryConfiguration) throws {+        let container = try LibraryRepository.openV4Container(at: configuration.v4StoreURL)+        let context = ModelContext(container)+        for entry in try context.fetch(FetchDescriptor<Entry>()) { entry.site = nil }+        for work in try context.fetch(FetchDescriptor<Work>()) { work.site = nil }+        try context.save()+        withExtendedLifetime(container) {}+    }++    // MARK: - V4-marker path++    @Test("V4-marker: a pre-freeze library marked \"4\" opens with relationships populated and is republished at \"5\"")+    func v4MarkerPathRunsThePass() async throws {+        let (dir, cfg) = try config()+        try V4RecordedStoreFixture.install(at: cfg.v4StoreURL)+        try Data("4\n".utf8).write(to: cfg.v4MarkerURL, options: .atomic)++        let (result, _) = try await LibraryRepository.openV4ForApp(cfg)+        guard case .ready = result else {+            Issue.record("expected ready, got \(result)")+            return+        }++        #expect(try markerContent(cfg) == "5",+                "the app republishes readiness at \"5\" after the pass (Q14)")+        try expectRelationshipsPopulated(cfg)+        withExtendedLifetime(dir) {}+    }++    @Test("Interrupted mid-pass: a store already at 5.0.0 with the marker still \"4\" converges and publishes \"5\" only afterwards")+    func interruptedStateConvergesAndRepublishes() async throws {+        let (dir, cfg) = try config()+        try V4RecordedStoreFixture.install(at: cfg.v4StoreURL)+        try Data("4\n".utf8).write(to: cfg.v4MarkerURL, options: .atomic)++        // Construct the exact state an interruption leaves (Q28): the schema+        // conversion committed by ModelContainer.init on the way in, the pass+        // not yet run, the marker untouched. A test starting from an+        // unconverted store would test a state this path cannot be+        // interrupted in.+        do {+            let container = try LibraryRepository.openV4Container(at: cfg.v4StoreURL)+            _ = ModelContext(container)+            withExtendedLifetime(container) {}+        }+        #expect(try V4RecordedStoreFixture.recordedModelVersions(at: cfg.v4StoreURL) == ["5.0.0"])+        #expect(try markerContent(cfg) == "4",+                "the interrupted attempt must not have certified partway (Req 2.4)")++        let (result, _) = try await LibraryRepository.openV4ForApp(cfg)+        guard case .ready = result else {+            Issue.record("expected the re-run to converge, got \(result)")+            return+        }+        #expect(try markerContent(cfg) == "5", "\"5\" is published only after the pass converges")+        try expectRelationshipsPopulated(cfg)+        withExtendedLifetime(dir) {}+    }++    // MARK: - V3-marker path++    @Test("V3-marker: an M3-era library upgrading in one launch certifies at \"5\" with relationships populated")+    func v3MarkerPathRunsThePass() async throws {+        let (dir, cfg) = try config()+        try makeV3Store(at: cfg, host: "m3era.example")+        try Data("3\n".utf8).write(to: cfg.v3MarkerURL, options: .atomic)++        let (result, _) = try await LibraryRepository.openV4ForApp(cfg)+        guard case .ready = result else {+            Issue.record("expected ready, got \(result)")+            return+        }++        #expect(try markerContent(cfg) == "5",+                "certifyMigration must not stamp \"5\" on a library whose relationships were never populated")+        try expectRelationshipsPopulated(cfg)+        #expect(!FileManager.default.fileExists(atPath: cfg.v3MarkerURL.path))+        #expect(!MigrationSidecarCodec.exists(at: cfg.migrationSidecarURL))+        withExtendedLifetime(dir) {}+    }++    // MARK: - Sidecar-resume path++    @Test("Sidecar-resume: a resumed migration runs the pass before publishing \"5\"")+    func sidecarResumePathRunsThePass() async throws {+        let (dir, cfg) = try config()+        try makeV3Store(at: cfg, host: "resume.example")+        try Data("3\n".utf8).write(to: cfg.v3MarkerURL, options: .atomic)+        _ = try await LibraryRepository.openV4ForApp(cfg)++        // Reconstruct the interrupted handoff: the durable sidecar back beside+        // the store, the marker gone, and the relationships stripped so the+        // resume can only certify by running the pass itself.+        try MigrationSidecarCodec.write(+            MigrationSidecar(taughtSites: [.init(hostname: "resume.example", plan: .retainPattern)]),+            to: cfg.migrationSidecarURL)+        try FileManager.default.removeItem(at: cfg.v4MarkerURL)+        try stripRelationships(cfg)++        let (result, _) = try await LibraryRepository.openV4ForApp(cfg)+        guard case .ready = result else {+            Issue.record("expected ready on resume, got \(result)")+            return+        }+        #expect(try markerContent(cfg) == "5")+        try expectRelationshipsPopulated(cfg)+        #expect(!MigrationSidecarCodec.exists(at: cfg.migrationSidecarURL))+        withExtendedLifetime(dir) {}+    }++    // MARK: - Already-migrated and mark-at-birth paths++    @Test("An ordinary open of a library already marked \"5\" does not re-run the pass")+    func ordinaryOpenDoesNotReRunThePass() async throws {+        // The pass runs once, at certification (Q29, Q31): a "5" marker means+        // it already ran, and the V4-marker branch must not sweep every Entry+        // and Work on every app launch. This pins that cost, nothing more.+        //+        // It is NOT a statement that no repair path exists or should exist.+        // Stripping the relationships here is the only way to make "the pass+        // did not run" observable; the state it constructs is one production+        // reaches only through the import path, and Decision 2 closes that by+        // ordering — task 18 sets the relationship at every write site before+        // task 14 lets any read follow it — not by repairing it here.+        let (dir, cfg) = try config()+        try V4RecordedStoreFixture.install(at: cfg.v4StoreURL)+        try Data("4\n".utf8).write(to: cfg.v4MarkerURL, options: .atomic)+        _ = try await LibraryRepository.openV4ForApp(cfg)+        #expect(try markerContent(cfg) == "5")+        try stripRelationships(cfg)++        let (result, _) = try await LibraryRepository.openV4ForApp(cfg)+        guard case .ready = result else {+            Issue.record("expected ready, got \(result)")+            return+        }+        let container = try LibraryRepository.openV4Container(at: cfg.v4StoreURL)+        let context = ModelContext(container)+        let entry = try #require(try context.fetch(FetchDescriptor<Entry>()).first)+        #expect(entry.site == nil, "a \"5\" library does not re-run the pass on open")+        withExtendedLifetime((dir, container)) {}+    }++    // MARK: - The pass's failure branch++    /// A save strategy that refuses, so the `libraryUnavailable("running the+    /// relationship migration pass")` branch is reachable without a disk fault.+    private struct RefusingSaveStrategy: RepositorySaveStrategy {+        func save(_ context: ModelContext) throws {+            throw LibraryRepositoryError.libraryUnavailable(+                operation: "saving", reason: "refused by the test")+        }+    }++    @Test("A failing save inside the pass surfaces the named error and leaves the marker at \"4\"")+    func failedPassDoesNotPublishTheMarker() async throws {+        let (dir, cfg) = try config()+        try V4RecordedStoreFixture.install(at: cfg.v4StoreURL)+        try Data("4\n".utf8).write(to: cfg.v4MarkerURL, options: .atomic)++        do {+            _ = try await LibraryRepository.openV4ForApp(cfg, saveStrategy: RefusingSaveStrategy())+            Issue.record("expected the failing save to abort the open")+        } catch let error as LibraryRepositoryError {+            guard case .libraryUnavailable(let operation, _) = error else {+                Issue.record("expected libraryUnavailable, got \(error)")+                return+            }+            #expect(operation == "running the relationship migration pass")+        }++        #expect(try markerContent(cfg) == "4",+                "the marker is the commit point: a pass that did not save must not publish \"5\"")+        withExtendedLifetime(dir) {}+    }++    // MARK: - Pass before validate (Q35, task 13)++    /// Task 11 settled that `V5RelationshipPass.run` precedes `validateV4Store`+    /// and could not pin it: with every cited-rule site resolving through the+    /// hostname-union lookup this milestone deleted, no store existed in which+    /// swapping the two produced a different diagnosis. Task 13 made the four+    /// sites read the record's Site relationship, so the test is constructible.+    ///+    /// The store carries one taught Site whose Entry cites a chapter pattern+    /// version that does not exist. Whether that is a tuple diagnosis or a+    /// tolerated state depends entirely on whether the relationship is+    /// populated when the diagnostics are computed:+    ///+    /// - pass first (correct): `entry.site` is the taught row, the citation is+    ///   resolved within it, fails, and the hostname is diagnosed.+    /// - validate first: `entry.site` is still nil, the failure is tolerated+    ///   (Req 3.4), and the session opens on a quarantine map describing the+    ///   pre-pass graph — every relationship nil — which is exactly the state+    ///   the ordering exists to prevent.+    ///+    /// So the assertion is that the diagnostics describe the **post-pass**+    /// graph. Reversing the two calls in the V4-marker branch fails it.+    @Test("The relationship pass runs before validation, so diagnostics describe the post-pass graph")+    func passRunsBeforeValidation() async throws {+        let (dir, cfg) = try config()+        let host = "ordering.example"+        do {+            let container = try LibraryRepository.openV4Container(at: cfg.v4StoreURL)+            let context = ModelContext(container)+            let fixture = try V4Fixtures.wcSegmentIdentitySequence(hostname: host)+            // Cites a version of the Site's own chapter pattern that was never+            // written. Nothing else about the graph is illegal.+            fixture.entry.chapterPatternVersion = 99+            context.insert(fixture.site)+            context.insert(fixture.titlePattern)+            context.insert(fixture.rule)+            context.insert(fixture.work)+            context.insert(fixture.entry)+            // Relationships nil, as a pre-freeze certification leaves them —+            // V4Fixtures links by default, so the pre-pass state is constructed.+            fixture.entry.site = nil+            fixture.work.site = nil+            try context.save()+            withExtendedLifetime(container) {}+        }+        try Data("4\n".utf8).write(to: cfg.v4MarkerURL, options: .atomic)++        let (result, repository) = try await LibraryRepository.openV4ForApp(cfg)+        guard case .ready = result else {+            Issue.record("expected ready, got \(result)")+            return+        }+        try expectRelationshipsPopulated(cfg)+        let diagnostics = await repository.diagnostics+        #expect(diagnostics.quarantineMap()[host] != nil,+                "diagnostics computed before the pass would have tolerated this citation")+        withExtendedLifetime(dir) {}+    }++    @Test("Mark-at-birth still publishes \"5\" directly for an empty store and runs no pass")+    func markAtBirthStillPublishesFiveDirectly() async throws {+        let (dir, cfg) = try config()+        let (result, _) = try await LibraryRepository.openV4ForApp(cfg)+        #expect(result == .ready(.zero))+        #expect(try markerContent(cfg) == "5",+                "an empty store has nothing to migrate and is certified migrated at birth (Q26)")+        withExtendedLifetime(dir) {}+    }+}

diff --git a/Packages/AsterismCore/Tests/AsterismCoreTests/V5RelationshipPassTests.swift b/Packages/AsterismCore/Tests/AsterismCoreTests/V5RelationshipPassTests.swiftnew file mode 100644index 0000000..57ccc03--- /dev/null+++ b/Packages/AsterismCore/Tests/AsterismCoreTests/V5RelationshipPassTests.swift@@ -0,0 +1,769 @@+import Foundation+import SwiftData+import Testing++@testable import AsterismCore++/// Task 8: the V4 → V5 relationship pass in isolation (Req 2.1, 2.2, 2.4).+///+/// Losslessness is asserted over the 5,000-Entry composed fixture, paired with+/// the assertion that every record's cited rules resolve *within the Site it+/// was assigned* — counts and tuples are identical whichever row is chosen, so+/// losslessness alone cannot catch a wrong-row assignment. That fixture is+/// seeded with `.duplicateSiteRows`, because with one Site row there is no+/// wrong row to assign and the citation half of the assertion cannot fail.+/// Determinism is+/// asserted over duplicate Site rows via `SiteResolutionOrder` (Q16), and+/// convergence over the exact state an interruption leaves: a store already+/// converted to 5.0.0 with every relationship nil (Q28). The bootstrap-level+/// half of interruption — the marker still reading "4" and republished "5"+/// only after the pass — is `V5CertificationPathTests`.+@Suite("V5 relationship pass", .serialized)+struct V5RelationshipPassTests {++    // MARK: - Helpers++    private final class TempDir {+        let url: URL+        init() throws {+            url = FileManager.default.temporaryDirectory.appending(+                path: "V5Pass-\(UUID())", directoryHint: .isDirectory)+            try FileManager.default.createDirectory(at: url, withIntermediateDirectories: true)+        }+        deinit { try? FileManager.default.removeItem(at: url) }+    }++    private func config() throws -> (TempDir, LibraryConfiguration) {+        let dir = try TempDir()+        let configuration = LibraryConfiguration(rootDirectory: dir.url, environment: .development)+        try FileManager.default.createDirectory(+            at: configuration.v4StoreURL.deletingLastPathComponent(), withIntermediateDirectories: true)+        return (dir, configuration)+    }++    private static let ts = Date(timeIntervalSince1970: 1_800_000_000)++    /// Runs the pass over the store in its own container, released afterwards,+    /// so every observation before and after comes from a fresh context and+    /// asserts *persisted* state rather than in-memory objects.+    private func runPass(at storeURL: URL) throws {+        let container = try LibraryRepository.openV4Container(at: storeURL)+        let context = ModelContext(container)+        try V5RelationshipPass.run(context: context)+        withExtendedLifetime(container) {}+    }++    /// Sets every `Entry.site` and `Work.site` in the store back to nil.+    private func stripRelationships(at storeURL: URL) throws {+        let container = try LibraryRepository.openV4Container(at: storeURL)+        let context = ModelContext(container)+        for entry in try context.fetch(FetchDescriptor<Entry>()) { entry.site = nil }+        for work in try context.fetch(FetchDescriptor<Work>()) { work.site = nil }+        try context.save()+        withExtendedLifetime(container) {}+    }++    /// How many Entries and Works carry a populated `site`, read from a fresh+    /// container so the answer is persisted state rather than in-memory objects.+    private func linkedRecordCounts(at storeURL: URL) throws -> (entries: Int, works: Int) {+        let container = try LibraryRepository.openV4Container(at: storeURL)+        let context = ModelContext(container)+        defer { withExtendedLifetime(container) {} }+        return (+            try context.fetch(FetchDescriptor<Entry>()).count { $0.site != nil },+            try context.fetch(FetchDescriptor<Work>()).count { $0.site != nil }+        )+    }++    // MARK: - Snapshots (Req 2.2: every field, provenance tuple, timestamp)++    private struct EntrySnapshot: Equatable {+        let captureTitle: String+        let captureTitleSourceRaw: String+        let rawURLString: String+        let canonicalURLString: String?+        let hostname: String+        let entryIdentityKey: String+        let identityKeyVersion: Int+        let conservativeIdentityKey: String+        let identityBasisRaw: String+        let identityURLRuleID: UUID?+        let identityURLRuleVersion: Int?+        let identityNameTitleRuleID: UUID?+        let identityNameTitleRuleVersion: Int?+        let urlWorkIdentity: String?+        let urlWorkRuleID: UUID?+        let urlWorkRuleVersion: Int?+        let chapterSequence: String?+        let chapterSequenceRuleID: UUID?+        let chapterSequenceRuleVersion: Int?+        let chapterTitle: String?+        let chapterTitleProvenanceRaw: String+        let chapterPatternID: UUID?+        let chapterPatternVersion: Int?+        let note: String+        let ratingRaw: String?+        let firstCapturedAt: Date+        let lastSharedAt: Date+        let modifiedAt: Date+        let workID: UUID?+        let workAssignmentProvenanceRaw: String+        let workPatternID: UUID?+        let workPatternVersion: Int?+        let workURLRuleID: UUID?+        let workURLRuleVersion: Int?+        let workURLAssignmentKindRaw: String?+        let intentionallyUnattached: Bool++        init(_ entry: Entry) {+            captureTitle = entry.captureTitle+            captureTitleSourceRaw = entry.captureTitleSourceRaw+            rawURLString = entry.rawURLString+            canonicalURLString = entry.canonicalURLString+            hostname = entry.hostname+            entryIdentityKey = entry.entryIdentityKey+            identityKeyVersion = entry.identityKeyVersion+            conservativeIdentityKey = entry.conservativeIdentityKey+            identityBasisRaw = entry.identityBasisRaw+            identityURLRuleID = entry.identityURLRuleID+            identityURLRuleVersion = entry.identityURLRuleVersion+            identityNameTitleRuleID = entry.identityNameTitleRuleID+            identityNameTitleRuleVersion = entry.identityNameTitleRuleVersion+            urlWorkIdentity = entry.urlWorkIdentity+            urlWorkRuleID = entry.urlWorkRuleID+            urlWorkRuleVersion = entry.urlWorkRuleVersion+            chapterSequence = entry.chapterSequence+            chapterSequenceRuleID = entry.chapterSequenceRuleID+            chapterSequenceRuleVersion = entry.chapterSequenceRuleVersion+            chapterTitle = entry.chapterTitle+            chapterTitleProvenanceRaw = entry.chapterTitleProvenanceRaw+            chapterPatternID = entry.chapterPatternID+            chapterPatternVersion = entry.chapterPatternVersion+            note = entry.note+            ratingRaw = entry.ratingRaw+            firstCapturedAt = entry.firstCapturedAt+            lastSharedAt = entry.lastSharedAt+            modifiedAt = entry.modifiedAt+            workID = entry.work?.id+            workAssignmentProvenanceRaw = entry.workAssignmentProvenanceRaw+            workPatternID = entry.workPatternID+            workPatternVersion = entry.workPatternVersion+            workURLRuleID = entry.workURLRuleID+            workURLRuleVersion = entry.workURLRuleVersion+            workURLAssignmentKindRaw = entry.workURLAssignmentKindRaw+            intentionallyUnattached = entry.intentionallyUnattached+        }+    }++    private struct WorkSnapshot: Equatable {+        let displayTitle: String+        let lastParsedTitle: String?+        let siteHostname: String+        let urlIdentity: String?+        let urlIdentityStateRaw: String+        let urlIdentityRuleID: UUID?+        let urlIdentityRuleVersion: Int?+        let workURLString: String?+        let genericNotes: String+        let typeRaw: String+        let genreTags: [String]+        let titleProvenanceRaw: String+        let createdAt: Date+        let modifiedAt: Date+        let entryIDs: Set<UUID>++        init(_ work: Work) {+            displayTitle = work.displayTitle+            lastParsedTitle = work.lastParsedTitle+            siteHostname = work.siteHostname+            urlIdentity = work.urlIdentity+            urlIdentityStateRaw = work.urlIdentityStateRaw+            urlIdentityRuleID = work.urlIdentityRuleID+            urlIdentityRuleVersion = work.urlIdentityRuleVersion+            workURLString = work.workURLString+            genericNotes = work.genericNotes+            typeRaw = work.typeRaw+            genreTags = work.genreTags+            titleProvenanceRaw = work.titleProvenanceRaw+            createdAt = work.createdAt+            modifiedAt = work.modifiedAt+            entryIDs = Set(work.entryValues.map(\.id))+        }+    }++    /// Every stored column of `TitlePattern` bar the owning `site` relationship+    /// (Models.swift:230-251). An abbreviated snapshot would let the assertion+    /// message "every Site and its rules unchanged" claim more than it checks.+    private struct TitleRuleSnapshot: Equatable, Hashable {+        let id: UUID+        let version: Int+        let isActive: Bool+        let createdAt: Date+        let formRaw: String+        let segmentWorkAnchor: SegmentRangeSpec?+        let segmentIgnoredAnchors: [SegmentPositionSpec]?+        let phrasePrefix: String?+        let phraseSeparator: String?+        let phraseSuffix: String?+        let fieldOrderRaw: String?+        let trimPrefix: String?+        let trimSuffix: String?+        let chapterless: Bool++        init(_ pattern: TitlePattern) {+            id = pattern.id+            version = pattern.version+            isActive = pattern.isActive+            createdAt = pattern.createdAt+            formRaw = pattern.formRaw+            segmentWorkAnchor = pattern.segmentWorkAnchor+            segmentIgnoredAnchors = pattern.segmentIgnoredAnchors+            phrasePrefix = pattern.phrasePrefix+            phraseSeparator = pattern.phraseSeparator+            phraseSuffix = pattern.phraseSuffix+            fieldOrderRaw = pattern.fieldOrderRaw+            trimPrefix = pattern.trimPrefix+            trimSuffix = pattern.trimSuffix+            chapterless = pattern.chapterless+        }+    }++    /// Every stored column of `URLRulePattern` bar the owning `site`+    /// relationship — including the encoded definition, which is where the+    /// whole rule body lives.+    private struct URLRuleSnapshot: Equatable, Hashable {+        let id: UUID+        let version: Int+        let isCurrent: Bool+        let createdAt: Date+        let originRaw: String+        let definitionData: Data++        init(_ rule: URLRulePattern) {+            id = rule.id+            version = rule.version+            isCurrent = rule.isCurrent+            createdAt = rule.createdAt+            originRaw = rule.originRaw+            definitionData = rule.definitionData+        }+    }++    private struct SiteSnapshot: Equatable {+        let hostname: String+        let displayName: String+        let modeRaw: String+        let urlIdentityRule: URLIdentityRule?+        let junkSuffixRule: JunkSuffixRule?+        let patterns: Set<TitleRuleSnapshot>+        let urlRules: Set<URLRuleSnapshot>++        init(_ site: Site) {+            hostname = site.hostname+            displayName = site.displayName+            modeRaw = site.modeRaw+            urlIdentityRule = site.urlIdentityRule+            junkSuffixRule = site.junkSuffixRule+            patterns = Set(site.patternValues.map(TitleRuleSnapshot.init))+            urlRules = Set(site.urlRuleValues.map(URLRuleSnapshot.init))+        }+    }++    private struct GraphSnapshot: Equatable {+        let entries: [String: EntrySnapshot]+        let works: [String: WorkSnapshot]+        let sites: [String: SiteSnapshot]+        let counts: [Int]++        init(storeURL: URL) throws {+            let container = try LibraryRepository.openV4Container(at: storeURL)+            let context = ModelContext(container)+            let fetchedEntries = try context.fetch(FetchDescriptor<Entry>())+            let fetchedWorks = try context.fetch(FetchDescriptor<Work>())+            let fetchedSites = try context.fetch(FetchDescriptor<Site>())+            let patternCount = try context.fetchCount(FetchDescriptor<TitlePattern>())+            let ruleCount = try context.fetchCount(FetchDescriptor<URLRulePattern>())+            // Never `Dictionary(uniqueKeysWithValues:)`, and never a key that a+            // *tolerated* state can duplicate. Two Entries may share one+            // application UUID (`.duplicateIdentity`) and two Site rows may+            // share a hostname and display name (`.duplicateSiteRows`), so+            // keying on those alone would trap and take the whole test process+            // down rather than fail a test. Keys therefore carry the+            // discriminator each tolerated duplicate necessarily differs in —+            // the immutable raw URL, and the Site's rule ownership — and the+            // residual collision is *recorded*, not trapped.+            entries = Self.keyed(+                fetchedEntries.map { ("\($0.id)#\($0.rawURLString)", EntrySnapshot($0)) },+                kind: "Entry")+            works = Self.keyed(+                fetchedWorks.map { ("\($0.id)#\($0.displayTitle)", WorkSnapshot($0)) },+                kind: "Work")+            sites = Self.keyed(+                fetchedSites.map { (Self.siteKey($0), SiteSnapshot($0)) },+                kind: "Site")+            counts = [fetchedEntries.count, fetchedWorks.count, fetchedSites.count, patternCount, ruleCount]+            withExtendedLifetime(container) {}+        }++        /// Hostname, display name, mode and the ids of the rules the row owns.+        /// Duplicate rows for one hostname are a tolerated state and the+        /// duplicate is untaught, owning no rules, so the rule ids are what+        /// separate it from the taught row it shadows.+        private static func siteKey(_ site: Site) -> String {+            let patterns = site.patternValues.map { "\($0.id)v\($0.version)" }.sorted()+            let rules = site.urlRuleValues.map { "\($0.id)v\($0.version)" }.sorted()+            return "\(site.hostname)#\(site.displayName)#\(site.modeRaw)"+                + "#[\(patterns.joined(separator: ","))]#[\(rules.joined(separator: ","))]"+        }++        private static func keyed<Key: Hashable, Value>(+            _ pairs: [(Key, Value)], kind: String+        ) -> [Key: Value] {+            var result: [Key: Value] = [:]+            result.reserveCapacity(pairs.count)+            for (key, value) in pairs {+                guard result[key] == nil else {+                    let message = "\(kind) snapshot key \(key) is not unique — a tolerated "+                        + "duplicate the snapshot cannot represent; the later row was dropped"+                    Issue.record(Comment(rawValue: message))+                    continue+                }+                result[key] = value+            }+            return result+        }+    }++    /// Every citation pair the Entry carries must resolve — id *and* version —+    /// among the rules owned by the Site the pass assigned. This is what+    /// catches a wrong-row assignment that losslessness cannot.+    private func expectCitationsResolve(entry: Entry, in site: Site) {+        let titleCitations: [(UUID?, Int?, String)] = [+            (entry.chapterPatternID, entry.chapterPatternVersion, "chapter pattern"),+            (entry.workPatternID, entry.workPatternVersion, "work pattern"),+            (entry.identityNameTitleRuleID, entry.identityNameTitleRuleVersion, "identity name title rule"),+        ]+        let urlCitations: [(UUID?, Int?, String)] = [+            (entry.identityURLRuleID, entry.identityURLRuleVersion, "identity URL rule"),+            (entry.urlWorkRuleID, entry.urlWorkRuleVersion, "url-work rule"),+            (entry.chapterSequenceRuleID, entry.chapterSequenceRuleVersion, "chapter sequence rule"),+            (entry.workURLRuleID, entry.workURLRuleVersion, "work URL rule"),+        ]+        for (id, version, label) in titleCitations {+            guard let id else { continue }+            #expect(+                site.patternValues.contains { $0.id == id && $0.version == version },+                "\(entry.rawURLString): cited \(label) \(id) v\(String(describing: version)) must resolve within the assigned Site")+        }+        for (id, version, label) in urlCitations {+            guard let id else { continue }+            #expect(+                site.urlRuleValues.contains { $0.id == id && $0.version == version },+                "\(entry.rawURLString): cited \(label) \(id) v\(String(describing: version)) must resolve within the assigned Site")+        }+    }++    // MARK: - Losslessness over the 5,000-Entry fixture (Req 2.2)++    @Test("The pass is lossless over the 5,000-Entry fixture, which carries a duplicate Site row so a wrong-row assignment fails every citation")+    func losslessOverComposedFixture() async throws {+        let (dir, cfg) = try config()+        do {+            let container = try LibraryRepository.openV4Container(at: cfg.v4StoreURL)+            let repository = LibraryRepository.makeRepository(+                cfg, container, .m4, SystemRepositoryClock(), ModelContextSaveStrategy())+            // Seeded with the duplicate-row perturbation on purpose. With a+            // single Site row the citation half of this test cannot fail: the+            // only row that exists owns every rule, so "cited rules resolve+            // within the assigned Site" is true whatever the pass assigns. The+            // second row is untaught and owns no rules, so a wrong-row+            // assignment fails every citation assertion at once — which is the+            // failure losslessness provably cannot see.+            try await repository.seedM4PerformanceFixture(toleratedState: .duplicateSiteRows)+            withExtendedLifetime(container) {}+        }++        // Snapshotted *before* the strip below, which is what makes the+        // comparison after the pass a losslessness claim about the pass: the+        // snapshot carries no relationship, the strip changes nothing else, so+        // an equal snapshot afterwards means the pass moved no field, no+        // provenance tuple, no timestamp and no count.+        let before = try GraphSnapshot(storeURL: cfg.v4StoreURL)+        let expectedWorks = LibraryRepository.m4FixtureEntryCount+            / LibraryRepository.m4FixtureEntriesPerWork+        #expect(before.counts[0] == LibraryRepository.m4FixtureEntryCount)+        #expect(before.counts[1] == expectedWorks)++        // The fixture's write paths set both halves of every Site reference, so+        // it arrives fully linked and the pass over it would be a no-op —+        // leaving the assertions below testing the fixture's own writes rather+        // than the pass. Stripping the relationships reconstructs the state the+        // pass exists for: a store converted to 5.0.0 with every relationship+        // nil.+        try stripRelationships(at: cfg.v4StoreURL)+        #expect(try linkedRecordCounts(at: cfg.v4StoreURL) == (0, 0),+                "the pass must start from an all-nil graph or it proves nothing")++        try runPass(at: cfg.v4StoreURL)++        #expect(try linkedRecordCounts(at: cfg.v4StoreURL)+                == (LibraryRepository.m4FixtureEntryCount, expectedWorks),+                "the pass populates every relationship whose hostname carries a Site row (Req 2.1)")++        let after = try GraphSnapshot(storeURL: cfg.v4StoreURL)+        #expect(after.counts == before.counts, "per-type counts unchanged (Req 2.2)")+        #expect(after.entries == before.entries, "every Entry field, provenance tuple and timestamp unchanged")+        #expect(after.works == before.works, "every Work field unchanged")+        #expect(after.sites == before.sites, "every Site and its rules unchanged")++        let container = try LibraryRepository.openV4Container(at: cfg.v4StoreURL)+        let context = ModelContext(container)+        for entry in try context.fetch(FetchDescriptor<Entry>()) {+            let site = try #require(entry.site, "\(entry.rawURLString): a matching Site row exists, so the relationship must be populated (Req 2.1)")+            #expect(site.hostname == entry.hostname)+            expectCitationsResolve(entry: entry, in: site)+        }+        for work in try context.fetch(FetchDescriptor<Work>()) {+            let site = try #require(work.site)+            #expect(site.hostname == work.siteHostname)+            if let ruleID = work.urlIdentityRuleID {+                #expect(site.urlRuleValues.contains {+                    $0.id == ruleID && $0.version == work.urlIdentityRuleVersion+                }, "\(work.displayTitle): cited URL-identity rule must resolve within the assigned Site")+            }+        }+        withExtendedLifetime((dir, container)) {}+    }++    // MARK: - Determinism over duplicate Site rows (Q16)++    @Test("Duplicate Site rows pin every record to the SiteResolutionOrder winner, not the last row written")+    func duplicateRowsPinToTheWinner() throws {+        let (dir, cfg) = try config()+        let container = try LibraryRepository.openV4Container(at: cfg.v4StoreURL)+        let context = ModelContext(container)++        // The taught row is inserted FIRST and the untaught duplicate LAST, so+        // a last-write-wins map over fetch order — the V4 pass's shape — would+        // pick the untaught row. SiteResolutionOrder picks the taught one on+        // step 1 regardless of order.+        let taught = Site(hostname: "dup.example", displayName: "taught")+        taught.mode = .taught+        context.insert(taught)+        let pattern = try TitlePattern(+            version: 1, isActive: true, createdAt: Self.ts, definition: .wholeTitle, site: taught)+        context.insert(pattern)+        let untaught = Site(hostname: "dup.example", displayName: "untaught")+        context.insert(untaught)++        let raw = "https://dup.example/read/1"+        let entry = Entry(+            captureTitle: "One", captureTitleSource: .host, rawURLString: raw,+            hostname: "dup.example", entryIdentityKey: raw, timestamp: Self.ts)+        context.insert(entry)+        let work = Work(displayTitle: "A Work", siteHostname: "dup.example", timestamp: Self.ts)+        context.insert(work)+        try context.save()++        try V5RelationshipPass.run(context: context)+        #expect(entry.site === taught)+        #expect(work.site === taught)+        // The winner is the row the rest of the app would choose.+        let rows = try LibraryRepository.fetchSites(hostname: "dup.example", context: context)+        #expect(entry.site === rows.first)++        // Q33 discriminator: pin both records to the row that is NOT the+        // winner and re-run. Skip-if-set would leave them on the untaught row+        // — the outcome would depend on prior state rather than on store+        // content, and a record pinned to a losing row would never converge.+        // Without this the whole suite passes against a skip-if-set pass.+        entry.site = untaught+        work.site = untaught+        try context.save()+        try V5RelationshipPass.run(context: context)+        #expect(entry.site === taught, "a record pinned to a losing row is reassigned to the winner (Q33)")+        #expect(work.site === taught, "a record pinned to a losing row is reassigned to the winner (Q33)")++        // And from the other partly-assigned state — one half nil — the re-run+        // pins to the same row again (Q16).+        entry.site = nil+        try context.save()+        try V5RelationshipPass.run(context: context)+        #expect(entry.site === taught)+        #expect(work.site === taught)+        withExtendedLifetime((dir, container)) {}+    }++    // MARK: - Property-based over generated graph shapes++    /// Deterministic generator, so a failing seed reproduces exactly.+    private struct SplitMix64: RandomNumberGenerator {+        var state: UInt64+        init(seed: UInt64) { state = seed &+ 0x9E37_79B9_7F4A_7C15 }+        mutating func next() -> UInt64 {+            state &+= 0x9E37_79B9_7F4A_7C15+            var mixed = state+            mixed = (mixed ^ (mixed >> 30)) &* 0xBF58_476D_1CE4_E5B9+            mixed = (mixed ^ (mixed >> 27)) &* 0x94D0_49BB_1331_11EB+            return mixed ^ (mixed >> 31)+        }+    }++    @Test(+        "Generated graph shapes: lossless, winner-correct, nil only where no row matches, and re-run stable",+        arguments: UInt64(1)...UInt64(12))+    func generatedGraphShapes(seed: UInt64) throws {+        var rng = SplitMix64(seed: seed)+        let (dir, cfg) = try config()+        let container = try LibraryRepository.openV4Container(at: cfg.v4StoreURL)+        let context = ModelContext(container)+        defer { withExtendedLifetime((dir, container)) {} }++        // Sites: 1–4 hostnames, 1–3 rows each, taught rows carrying an active+        // pattern with a deterministic UUID. Ties between untaught rows fall+        // through to the identifier tiebreak, which is stable for one store.+        let hostnames = (0..<Int.random(in: 1...4, using: &rng)).map { "host\($0).example" }+        for (hostIndex, hostname) in hostnames.enumerated() {+            for rowIndex in 0..<Int.random(in: 1...3, using: &rng) {+                let site = Site(hostname: hostname, displayName: "\(hostname)#\(rowIndex)")+                context.insert(site)+                if Bool.random(using: &rng) {+                    site.mode = .taught+                    let id = UUID(uuidString: String(+                        format: "%08X-0000-4000-8000-%012X", hostIndex, rowIndex))!+                    let pattern = try TitlePattern(+                        id: id, version: 1, isActive: true, createdAt: Self.ts,+                        definition: .wholeTitle, site: site)+                    context.insert(pattern)+                }+            }+        }+        // Records: some name a hostname no Site row carries — the tolerated+        // state, whose relationship must stay nil (Req 2.1).+        let absentHostname = "absent.example"+        for index in 0..<Int.random(in: 0...15, using: &rng) {+            let hostname = Int.random(in: 0..<4, using: &rng) == 0+                ? absentHostname : hostnames.randomElement(using: &rng)!+            let raw = "https://\(hostname)/e/\(index)"+            let entry = Entry(+                captureTitle: "Entry \(index)", captureTitleSource: .host, rawURLString: raw,+                hostname: hostname, entryIdentityKey: raw,+                timestamp: Self.ts.addingTimeInterval(Double(index)))+            entry.note = "note \(index)"+            context.insert(entry)+        }+        for index in 0..<Int.random(in: 0...8, using: &rng) {+            let hostname = Int.random(in: 0..<4, using: &rng) == 0+                ? absentHostname : hostnames.randomElement(using: &rng)!+            context.insert(Work(+                displayTitle: "Work \(index)", siteHostname: hostname,+                timestamp: Self.ts.addingTimeInterval(Double(index))))+        }+        try context.save()+        withExtendedLifetime(container) {}++        let before = try GraphSnapshot(storeURL: cfg.v4StoreURL)+        try runPass(at: cfg.v4StoreURL)+        let after = try GraphSnapshot(storeURL: cfg.v4StoreURL)+        #expect(after == before, "seed \(seed): the pass must change no field, tuple, timestamp or count")++        let assignments = try assignmentsByRecord(at: cfg.v4StoreURL, seed: seed)++        // Re-run over the same store from a stripped state: same rows again.+        try stripRelationships(at: cfg.v4StoreURL)+        try runPass(at: cfg.v4StoreURL)+        let rerun = try assignmentsByRecord(at: cfg.v4StoreURL, seed: seed)+        #expect(rerun == assignments, "seed \(seed): a re-run must pin every record to the same row (Q16)")+    }++    /// Asserts winner-correctness and returns each record's assigned row (by+    /// its unique display name) keyed by record identity.+    private func assignmentsByRecord(at storeURL: URL, seed: UInt64) throws -> [String: String?] {+        let container = try LibraryRepository.openV4Container(at: storeURL)+        let context = ModelContext(container)+        defer { withExtendedLifetime(container) {} }+        var assignments: [String: String?] = [:]+        for entry in try context.fetch(FetchDescriptor<Entry>()) {+            let rows = try LibraryRepository.fetchSites(hostname: entry.hostname, context: context)+            if rows.isEmpty {+                #expect(entry.site == nil, "seed \(seed): \(entry.rawURLString) names no Site row, so its relationship stays nil")+            } else {+                #expect(entry.site === rows.first, "seed \(seed): \(entry.rawURLString) must pin to the SiteResolutionOrder winner")+            }+            assignments["entry:\(entry.rawURLString)"] = entry.site?.displayName+        }+        for work in try context.fetch(FetchDescriptor<Work>()) {+            let rows = try LibraryRepository.fetchSites(hostname: work.siteHostname, context: context)+            if rows.isEmpty {+                #expect(work.site == nil, "seed \(seed): \(work.displayTitle) names no Site row, so its relationship stays nil")+            } else {+                #expect(work.site === rows.first, "seed \(seed): \(work.displayTitle) must pin to the SiteResolutionOrder winner")+            }+            assignments["work:\(work.displayTitle)"] = work.site?.displayName+        }+        return assignments+    }++    // MARK: - 4.0.0 → 5.0.0 conversion losslessness at scale (Req 2.2)++    /// The only genuine pre-conversion coverage the branch had was the+    /// one-row-per-model `V4RecordedStoreFixture`. Everything else is built at+    /// the current schema, so it never crosses the 4.0.0 → 5.0.0 boundary at+    /// all. This runs the whole thing over a 432-Entry store a pre-freeze build+    /// wrote: every field read back as seeded, every citation resolving inside+    /// the assigned Site, and the duplicated hostname pinning to the+    /// `SiteResolutionOrder` winner rather than to whichever row the fetch+    /// happened to return first.+    @Test("A 432-Entry 4.0.0-recorded store converts and migrates with every field intact")+    func scaleRecordedStoreConvertsLosslessly() throws {+        typealias Fixture = V4RecordedScaleStoreFixture+        let (dir, cfg) = try config()+        try Fixture.install(at: cfg.v4StoreURL)+        #expect(try V4RecordedStoreFixture.recordedModelVersions(at: cfg.v4StoreURL) == ["4.0.0"],+                "the resource must never be converted in place")++        try runPass(at: cfg.v4StoreURL)+        #expect(try V4RecordedStoreFixture.recordedModelVersions(at: cfg.v4StoreURL) == ["5.0.0"])++        let container = try LibraryRepository.openV4Container(at: cfg.v4StoreURL)+        let context = ModelContext(container)+        defer { withExtendedLifetime((dir, container)) {} }++        let sites = try context.fetch(FetchDescriptor<Site>())+        let works = try context.fetch(FetchDescriptor<Work>())+        let entries = try context.fetch(FetchDescriptor<Entry>())+        let observedCounts: [Int] = [sites.count, works.count, entries.count]+        let seededCounts: [Int] = [Fixture.siteCount, Fixture.workCount, Fixture.entryCount]+        #expect(observedCounts == seededCounts)++        // Sites and their rules, against the seeded values.+        for (hostIndex, hostname) in Fixture.hostnames.enumerated() {+            let rows = try LibraryRepository.fetchSites(hostname: hostname, context: context)+            let taught = try #require(rows.first(where: { $0.mode == .taught }))+            #expect(taught.displayName == Fixture.siteDisplayName(hostIndex: hostIndex))+            let pattern = try #require(taught.patternValues.first)+            #expect(pattern.id == Fixture.patternID(hostIndex: hostIndex))+            #expect(pattern.version == Fixture.patternVersion)+            #expect(pattern.isActive)+            #expect(pattern.trimPrefix == "[")+            #expect(pattern.trimSuffix == "]")+            #expect(try pattern.definition == .phrase(+                prefix: "Chapter ", separator: " of ", suffix: ".", order: .chapterThenWork))+            let rule = try #require(taught.urlRuleValues.first)+            #expect(rule.id == Fixture.urlRuleID(hostIndex: hostIndex))+            #expect(rule.version == Fixture.urlRuleVersion)+            #expect(rule.isCurrent)+            #expect(rule.origin == .readerTaught)+            #expect(rule.definition == .sequence(locator: .query(name: ExactScalarString("chapter"))))++            if hostname == Fixture.duplicatedHostname {+                #expect(rows.count == 2, "the tolerated duplicate row must survive the conversion")+                let duplicate = try #require(rows.first(where: { $0.mode == .untaught }))+                #expect(duplicate.displayName == Fixture.duplicateRowDisplayName)+                #expect(duplicate.patternValues.isEmpty && duplicate.urlRuleValues.isEmpty)+                // Taught beats untaught on step 1 of SiteResolutionOrder, so+                // the winner is the row owning the rules every Entry cites.+                #expect(rows.first === taught)+            } else {+                #expect(rows.count == 1)+            }+        }++        // Works and Entries, against the seeded values, plus the relationship+        // the pass wrote and the citations it has to make resolvable.+        let worksByID = Dictionary(grouping: works, by: \.id).compactMapValues(\.first)+        let entriesByID = Dictionary(grouping: entries, by: \.id).compactMapValues(\.first)+        for (hostIndex, hostname) in Fixture.hostnames.enumerated() {+            let winner = try #require(+                try LibraryRepository.fetchSites(hostname: hostname, context: context).first)+            for workIndex in 0..<Fixture.worksPerHost {+                let work = try #require(+                    worksByID[Fixture.workID(hostIndex: hostIndex, workIndex: workIndex)])+                #expect(work.displayTitle == Fixture.workTitle(hostIndex: hostIndex, workIndex: workIndex))+                #expect(work.lastParsedTitle == work.displayTitle)+                #expect(work.siteHostname == hostname)+                #expect(work.urlIdentity == "\(workIndex)")+                #expect(work.urlIdentityState == .rule)+                #expect(work.urlIdentityRuleID == Fixture.urlRuleID(hostIndex: hostIndex))+                #expect(work.urlIdentityRuleVersion == Fixture.urlRuleVersion)+                #expect(work.genericNotes == "notes \(hostIndex)-\(workIndex)")+                #expect(work.genreTags == ["genre\(hostIndex)"])+                #expect(work.titleProvenance == .parsed)+                #expect(work.createdAt == Fixture.ts.addingTimeInterval(Double(workIndex)))+                #expect(work.site === winner, "\(work.displayTitle) pins to the winner")+                #expect(work.entryValues.count == Fixture.entriesPerWork)+                #expect(winner.urlRuleValues.contains {+                    $0.id == work.urlIdentityRuleID && $0.version == work.urlIdentityRuleVersion+                }, "\(work.displayTitle): cited URL-identity rule resolves within the assigned Site")++                for entryIndex in 0..<Fixture.entriesPerWork {+                    let entry = try #require(entriesByID[Fixture.entryID(+                        hostIndex: hostIndex, workIndex: workIndex, entryIndex: entryIndex)])+                    let raw = Fixture.rawURL(+                        hostname: hostname, workIndex: workIndex, entryIndex: entryIndex)+                    #expect(entry.captureTitle == Fixture.captureTitle(+                        hostIndex: hostIndex, workIndex: workIndex, entryIndex: entryIndex))+                    #expect(entry.captureTitleSourceRaw == CaptureTitleSource.host.rawValue)+                    #expect(entry.rawURLString == raw)+                    #expect(entry.entryIdentityKey == raw)+                    #expect(entry.conservativeIdentityKey == raw)+                    #expect(entry.hostname == hostname)+                    #expect(entry.note == "note \(entryIndex)")+                    #expect(entry.firstCapturedAt == Fixture.ts.addingTimeInterval(Double(entryIndex)))+                    #expect(entry.work?.id == work.id)+                    #expect(entry.chapterTitle == "Chapter \(entryIndex + 1)")+                    #expect(entry.chapterTitleProvenance == .pattern)+                    #expect(entry.chapterPatternID == Fixture.patternID(hostIndex: hostIndex))+                    #expect(entry.chapterPatternVersion == Fixture.patternVersion)+                    #expect(entry.workAssignmentProvenance == .pattern)+                    #expect(entry.workPatternID == Fixture.patternID(hostIndex: hostIndex))+                    #expect(entry.workPatternVersion == Fixture.patternVersion)+                    #expect(entry.chapterSequence == "\(entryIndex + 1)")+                    #expect(entry.chapterSequenceRuleID == Fixture.urlRuleID(hostIndex: hostIndex))+                    #expect(entry.chapterSequenceRuleVersion == Fixture.urlRuleVersion)+                    #expect(entry.site === winner, "\(raw) pins to the winner")+                    expectCitationsResolve(entry: entry, in: winner)+                }+            }+        }+    }++    // MARK: - Interruption convergence (Req 2.4, Q28)++    @Test("The pass converges the exact interrupted state: a store already converted to 5.0.0 with relationships nil")+    func convergesTheConvertedStore() throws {+        let (dir, cfg) = try config()+        try V4RecordedStoreFixture.install(at: cfg.v4StoreURL)++        // `ModelContainer.init` commits the schema conversion on the way in,+        // before the pass begins, and a failed pass does not undo it (Q28). So+        // the interrupted state is a store already recorded at 5.0.0 whose+        // relationships are nil — not an unconverted store.+        do {+            let container = try LibraryRepository.openV4Container(at: cfg.v4StoreURL)+            _ = ModelContext(container)+            withExtendedLifetime(container) {}+        }+        #expect(try V4RecordedStoreFixture.recordedModelVersions(at: cfg.v4StoreURL) == ["5.0.0"],+                "the conversion is committed before the pass runs")++        let container = try LibraryRepository.openV4Container(at: cfg.v4StoreURL)+        let context = ModelContext(container)+        defer { withExtendedLifetime((dir, container)) {} }+        let entry = try #require(try context.fetch(FetchDescriptor<Entry>()).first)+        let work = try #require(try context.fetch(FetchDescriptor<Work>()).first)+        #expect(entry.site == nil, "the interrupted state this test exists for")+        #expect(work.site == nil)++        // The re-run converges on the already-converted store.+        try V5RelationshipPass.run(context: context)+        #expect(entry.site?.hostname == V4RecordedStoreFixture.hostname)+        #expect(work.site?.hostname == V4RecordedStoreFixture.hostname)+        expectCitationsResolve(entry: entry, in: try #require(entry.site))++        // And a run over the converged store is a no-op that converges again.+        try V5RelationshipPass.run(context: context)+        #expect(entry.site?.hostname == V4RecordedStoreFixture.hostname)+        #expect(work.site?.hostname == V4RecordedStoreFixture.hostname)+    }+}