Pre-push review: T-2271/data-model-cleanups

diff --git a/Asterism/Asterism/ViewModels/AppLibraryModel.swift b/Asterism/Asterism/ViewModels/AppLibraryModel.swiftindex 73d82e4..e335553 100644--- a/Asterism/Asterism/ViewModels/AppLibraryModel.swift+++ b/Asterism/Asterism/ViewModels/AppLibraryModel.swift@@ -268,13 +268,18 @@ public final class AppLibraryModel {             resolvedConfiguration = configuration              // The app-role opener acquires the exclusive lease before its first-            // marker/store observation, populates site relationships when the-            // marker says the data pass has not run, and performs every startup-            // transition while that lease is held+            // marker/store observation and performs every startup transition+            // while that lease is held             // (task 25 runtime switch; the composed teaching surface commits             // against the real runtime in production). A first run creates             // the store and marks it ready, so there is no setup step to route             // around here — for production or for a UI test's disposable root.+            //+            // **No data pass runs.** The site-relationship population pass used+            // to run here for a library still on the `"4"` marker;+            // `data-model-cleanups` Decision 2 retired that generation, so the+            // pass has no production caller left and survives as test support+            // only (`SiteRelationshipPopulationPass`).             var repo = try await LibraryRepository.openForApp(                 configuration,                 capabilities: capabilities

diff --git a/Asterism/Asterism/ViewModels/SettingsBackupModel.swift b/Asterism/Asterism/ViewModels/SettingsBackupModel.swiftindex 86ac442..7e98983 100644--- a/Asterism/Asterism/ViewModels/SettingsBackupModel.swift+++ b/Asterism/Asterism/ViewModels/SettingsBackupModel.swift@@ -131,12 +131,15 @@ public final class SettingsBackupModel {     }      /// Produces a user-facing error message that never leaks titles, notes, or URLs.+    ///+    /// The `BackupValidationError` arm is gone with the type+    /// (`data-model-cleanups`): nothing had thrown it since `V2LibraryValidator`+    /// was retired, so it was an arm for a state no export could reach. Every+    /// arm below still stands for something a reader can actually meet.     private static func privacySafeMessage(for error: Error) -> String {         switch error {         case is BackupCodecError:             "Backup export failed due to an encoding error. Please try again."-        case is BackupValidationError:-            "Backup validation failed. The export was not saved. Please try again."         case let error as BackupV6ExportError:             exportMessage(for: error)         default:@@ -201,8 +204,8 @@ public final class SettingsBackupModel {         switch error {         case let e as BackupCodecError:             "codec: \(e)"-        case let e as BackupValidationError:-            "validation: \(e)"+        case let e as BackupV6ExportError:+            "export: \(e)"         case let e as LibraryRepositoryError:             "repository: \(e)"         default:

diff --git a/Asterism/AsterismTests/AppLibraryModelTests.swift b/Asterism/AsterismTests/AppLibraryModelTests.swiftindex 9cea7b0..4c0f04d 100644--- a/Asterism/AsterismTests/AppLibraryModelTests.swift+++ b/Asterism/AsterismTests/AppLibraryModelTests.swift@@ -135,7 +135,7 @@ struct AppLibraryModelTests {         // committer: the repository removes the sidecar as it completes, so a         // notice left standing afterwards would describe a file that is gone.         let archive = root.appending(path: "restore.json")-        try SettingsBackupImportModelTests.minimalV4BackupData.write(to: archive)+        try SettingsBackupImportModelTests.minimalBackupData.write(to: archive)         let importModel = try #require(model.settingsBackupImportModel())         await importModel.handleDocumentSelection(archive)         await importModel.confirmImport()@@ -712,9 +712,9 @@ struct AppLibraryModelSyncArrivalTests {         _ = try await mock.confirmImport(             plan: BackupImportPlan(                 metadata: BackupImportMetadata(-                    formatVersion: 4, schemaVersion: 4, appBuild: "test",+                    formatVersion: 6, schemaVersion: 7, appBuild: "test",                     exportedAt: .now, capabilityGate: "m4", entryCount: 0, workCount: 0),-                payload: BackupV4Payload(+                payload: BackupImportPayload(                     entries: [], works: [], sites: [], titlePatterns: [], urlRules: []),                 counts: .zero),             archiveName: "arrivals.json")

diff --git a/Asterism/AsterismTests/IntegrationSafetyNetTests.swift b/Asterism/AsterismTests/IntegrationSafetyNetTests.swiftindex fa47a7f..0c09fc4 100644--- a/Asterism/AsterismTests/IntegrationSafetyNetTests.swift+++ b/Asterism/AsterismTests/IntegrationSafetyNetTests.swift@@ -148,10 +148,10 @@ struct IntegrationSafetyNetTests {         )          let stagingDirectory = fixture.baseDirectory.appending(path: "validated-backups")-        let exporter = BackupV4Exporter(repository: repository, stagingDirectory: stagingDirectory)+        let exporter = BackupV6Exporter(repository: repository, stagingDirectory: stagingDirectory)         let exportedAt = Date(timeIntervalSince1970: 1_784_246_400)         let result = try await exporter.export(-            metadata: BackupV4Metadata(+            metadata: BackupV6Metadata(                 appBuild: "integration-1",                 exportedAt: exportedAt             )@@ -159,8 +159,8 @@ struct IntegrationSafetyNetTests {         defer { exporter.cleanup(result) }          let encoded = try Data(contentsOf: result.fileURL)-        let decoded = try BackupV4Codec.decode(encoded)-        let source = try await repository.backupV4Snapshot()+        let decoded = try BackupV6Codec.decode(encoded)+        let source = try await repository.backupV6Snapshot()          #expect(decoded.payload == source)         #expect(decoded.payload.entries.count == 1)@@ -321,9 +321,9 @@ struct IntegrationSafetyNetTests {         try await sourceRepo.moveEntry(entry.id, to: .existing(work.id))          let stagingDir = fixture.baseDirectory.appending(path: "export-stage")-        let exporter = BackupV4Exporter(repository: sourceRepo, stagingDirectory: stagingDir)+        let exporter = BackupV6Exporter(repository: sourceRepo, stagingDirectory: stagingDir)         let exportResult = try await exporter.export(-            metadata: BackupV4Metadata(appBuild: "fill-test", exportedAt: Date())+            metadata: BackupV6Metadata(appBuild: "fill-test", exportedAt: Date())         )         defer { exporter.cleanup(exportResult) }         let backupData = try Data(contentsOf: exportResult.fileURL)@@ -386,9 +386,9 @@ struct IntegrationSafetyNetTests {             )         )         let stagingDir = fixture.baseDirectory.appending(path: "restore-stage")-        let exporter = BackupV4Exporter(repository: sourceRepo, stagingDirectory: stagingDir)+        let exporter = BackupV6Exporter(repository: sourceRepo, stagingDirectory: stagingDir)         let exportResult = try await exporter.export(-            metadata: BackupV4Metadata(appBuild: "restore-test", exportedAt: Date())+            metadata: BackupV6Metadata(appBuild: "restore-test", exportedAt: Date())         )         defer { exporter.cleanup(exportResult) }         let plan = try BackupImporter.plan(from: try Data(contentsOf: exportResult.fileURL))@@ -890,15 +890,15 @@ struct IntegrationSafetyNetTests {         )          let stagingDir = fixture.baseDirectory.appending(path: "corrupt-stage")-        let exporter = BackupV4Exporter(repository: repo, stagingDirectory: stagingDir)+        let exporter = BackupV6Exporter(repository: repo, stagingDirectory: stagingDir)         let exportResult = try await exporter.export(-            metadata: BackupV4Metadata(appBuild: "corrupt-test", exportedAt: Date())+            metadata: BackupV6Metadata(appBuild: "corrupt-test", exportedAt: Date())         )         defer { exporter.cleanup(exportResult) }          // Verify good backup decodes         let goodData = try Data(contentsOf: exportResult.fileURL)-        let decoded = try BackupV4Codec.decode(goodData)+        let decoded = try BackupV6Codec.decode(goodData)         #expect(decoded.payload.entries.count == 1)          // Corrupt the data by flipping bytes in the payload area@@ -911,7 +911,7 @@ struct IntegrationSafetyNetTests {          // Corrupted backup should fail decode/checksum         do {-            _ = try BackupV4Codec.decode(corruptData)+            _ = try BackupV6Codec.decode(corruptData)             Issue.record("Expected corrupted backup to fail validation")         } catch {             // Expected: checksum or decode failure@@ -996,15 +996,15 @@ struct IntegrationSafetyNetTests {             return         } -        // Export V4+        // Export the archive         let stagingDir = fixture.baseDirectory.appending(path: "url-backup-stage")-        let exporter = BackupV4Exporter(repository: repo, stagingDirectory: stagingDir)+        let exporter = BackupV6Exporter(repository: repo, stagingDirectory: stagingDir)         let exportResult = try await exporter.export(-            metadata: BackupV4Metadata(appBuild: "url-backup-test", exportedAt: Date())+            metadata: BackupV6Metadata(appBuild: "url-backup-test", exportedAt: Date())         )         defer { exporter.cleanup(exportResult) }         let backupData = try Data(contentsOf: exportResult.fileURL)-        let decoded = try BackupV4Codec.decode(backupData)+        let decoded = try BackupV6Codec.decode(backupData)          // Site should be present in the payload.         let site = decoded.payload.sites.first { $0.hostname == "backupurl.test" }

diff --git a/Asterism/AsterismTests/SettingsImportTests.swift b/Asterism/AsterismTests/SettingsImportTests.swiftindex 743d25a..15b6309 100644--- a/Asterism/AsterismTests/SettingsImportTests.swift+++ b/Asterism/AsterismTests/SettingsImportTests.swift@@ -62,13 +62,13 @@ enum MockSetupError: Error, LocalizedError { @Suite("SettingsBackupImportModel") struct SettingsBackupImportModelTests { -    /// A real 4/4 document, because the model plans the bytes it is handed —+    /// A real 6/7 document, because the model plans the bytes it is handed —     /// stubbing the planner would leave the preview untested.-    static let minimalV4BackupData: Data = {+    static let minimalBackupData: Data = {         let hostname = "settings-import.example"         let rawURL = "https://\(hostname)/read?chapter=1"         let noProvenance = try! FieldProvenance(kind: .none)-        let payload = BackupV4Payload(+        let payload = BackupV6Payload(             entries: [                 BackupV4Entry(                     id: UUID(), captureTitle: "Chapter 1", captureTitleSource: .host,@@ -94,10 +94,11 @@ struct SettingsBackupImportModelTests {                     hostname: hostname, displayName: hostname, mode: .untaught,                     patternIDs: [], urlRuleIDs: [], junkSuffixRule: nil)             ],-            titlePatterns: [], urlRules: [])-        return try! BackupV4Codec.encode(+            titlePatterns: [], urlRules: [], workTypes: [],+            characters: [], suppressions: [], coverage: [])+        return try! BackupV6Codec.encode(             payload: payload,-            metadata: BackupV4Metadata(+            metadata: BackupV6Metadata(                 appBuild: "test", exportedAt: Date(timeIntervalSince1970: 1_800_000_000)))     }() @@ -193,7 +194,7 @@ struct SettingsBackupImportModelTests {         for current in [LibraryRecordCounts.zero,                         LibraryRecordCounts(entries: 10, works: 3, sites: 2, titlePatterns: 1)] {             let reader = MockBackupDocumentReader()-            reader.readDataResult = .success(Self.minimalV4BackupData)+            reader.readDataResult = .success(Self.minimalBackupData)             let committer = MockBackupImportCommitter()             committer.currentCountsResult = .success(current)             committer.confirmImportResult = .success(

diff --git a/CHANGELOG.md b/CHANGELOG.mdindex d29d183..c7f35a6 100644--- a/CHANGELOG.md+++ b/CHANGELOG.md@@ -8,6 +8,86 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).  ### Changed +- **One work-type directory fetch per reconciliation pass+  (data-model-cleanups, phase 5: Directory Reuse, T-2271).**+  `DuplicateScan.run` and `DuplicateReconciler.run` take the+  `WorkTypeDirectory` as a parameter; `reconcileAfterSync` folds it once,+  directly after `WorkTypeReconciler` converges the table, and hands it to+  both. The public convenience overload and the deletion phase's+  fresh-context fetch are deliberately unchanged (Q9, Q5). The real+  deliverable is the invariant, not the saved fetch (Q21): a new test pins+  that the duplicate phase's carrier gate reads the *post-convergence*+  directory — a type merged in the same pass propagates — where the old+  code satisfied that only by accident of call order. Closes the spec's+  final task; all twelve tasks done.++- **Unknown enum values read as data, not corruption (data-model-cleanups,+  phase 4: Enum Policy, T-2271).** One `ToleratedEnum` helper now carries the+  model accessors' tolerance policy (13 accessors, defaults unchanged), and+  the eight guard-throws in snapshot mapping and merge-basis building read+  the default instead of throwing `corruptLibrary` — a value written by a+  newer build renders as the default rather than failing the surface (Q2).+  Rule-definition decoding stays exempt (Q3), export refusal still fires on+  non-exempt unrepresentable columns (Q8/Q16), the validator's six raw reads+  stay strict as the designed per-hostname degrade (Q19), and the three+  `SiteMode` basis-builder throws became quarantined refusals rather than+  tolerance (Q20). Review caught and fixed a real edge: an unknown+  provenance raw beside populated pattern columns now drops the citation+  instead of manufacturing an illegal `FieldProvenance` that failed the+  whole snapshot.++- **LibraryValidator orders duplicate rows device-independently+  (data-model-cleanups, phase 3: Ordering Deletion, T-2271).**+  `RecordResolutionOrder` — the validator's row ordering, which ended on a+  device-local `PersistentIdentifier` so two devices could diagnose the same+  library differently — is deleted; both validator index sites order through+  `GroupOrdering` (Q12). A new pinned-winner test builds mirror-image+  duplicate groups whose capture titles oppose their capture dates and+  asserts representative and verdict in both directions; the retired order+  returns the opposite answer for each. No existing fixture changed verdict.+  Validator cost measured flat-to-better against the retire-migration-chain+  band (settling pass −0.8%, worst-case consolidation −1.3%; the+  duplicated-UUID open fixture runs *faster* than the coherent one). The+  Req 5.4 capture-projection budget joins the known-issue banded set (Q18):+  a five-run A/B showed its 100 ms budget sits inside this host's variance+  (0.0927–0.1018 s) with no branch regression, so the budget reports as a+  `withKnownIssue` while a hard regression ceiling asserted outside the+  block still fails a real slowdown — the orchestrator's call on the+  Req 5.5/10.1 precedent, recorded as pending user review.++- **The app bootstrap opens only marker digit "7" (data-model-cleanups,+  phase 2: Marker Retirement, T-2271).** The three marker-lagging generations+  ("4"/"5"/"6"), their `BootstrapState` cases, classifier arms, digit+  constants and `runPassAndCertify`'s flags are deleted (Decision 2:+  single-user population, every device on "7"). A store carrying any other+  digit refuses before any `ModelContainer` exists, naming the digit — the+  recovery is the backup archive, the below-V5 stance. Unknown digits still+  classify `.unrecognised` (now with the interpolated marker text capped),+  an empty store is still marked at birth, and `appOpenableMarkerVersions`+  remains the live acceptance check a new generation is added to (Q17).+  `SiteRelationshipPopulationPass` lost its only production caller and+  became test-support, compiled only under+  `#if DEBUG || ASTERISM_PERFORMANCE_TESTING` (Q14 fallback — the spec's+  two-caller premise was stale; a release build proves it out of the+  shipping app). No data pass runs in production any more.++- **Backup layer reads and writes one archive format (data-model-cleanups,+  phase 1: Backup Layer, T-2271).** The 4/4 and 5/6 archive read paths are+  deleted end to end — codecs, planners, materialisers, gates, reference+  validators, fixtures and their test files (Decision 2: single-user+  population, fully migrated). Any pair other than (6,7) refuses with a+  message naming the detected pair, proven by a test whose intact 4/4+  envelope fails the version check, not decode. The V4/V5 record types stay+  under their historical names as the 6/7 wire substrate (Q13). A golden-file+  test pins the export byte-for-byte over a fixture populating every payload+  array and every optional mapper field; it was written before the deletions+  and the 6/7 bytes never changed. Import preview and commit now construct+  records through one shared body (`ArchiveRecordBuilders`), with the preview+  staying verbatim — no type folding, coverage, or repair pass (Decision 1).+  One export error enum and one codec error enum keep every distinction the+  Settings surfaces present (Q7); the per-generation relabelling inits and+  catch ladders are gone. Net effect ~−4,500/+1,400 lines.+ - **Share sheet last note — the Catch up section (share-sheet-last-note,   phase 2: Extension, T-1917).** Both capture sheets show a read-only "Catch   up" section under the note editor whenever the share resolves to an existing

diff --git a/CLAUDE.md b/CLAUDE.mdindex 4287a6b..d5cedc1 100644--- a/CLAUDE.md+++ b/CLAUDE.md@@ -43,7 +43,7 @@ invocations where a target exists. - `make test-core` — AsterismCore package tests (host, fast, safe). Since `rule-suggestion` the package has a second product, `AsterismIntelligence` (linked by the app and `AsterismTests` only — never the share extension), and its tests include **two live Apple Intelligence calls** — one per pipeline, decoding into `RuleProposal` and (since `character-extraction`) into `ExtractionResult` — both of which degrade to a `withKnownIssue` when the host has no model available. On a host that does have the model, a transient `GenerationError` (rate limited, assets unavailable) is also a known issue — only a response that will not decode into the expected structure fails the target, so the pre-commit bar stays deterministic either way. - `make test-quick` — unit-test bundle only (simulator) - `make test` / `make test-ui` — full suites (simulator)-- `make test-performance-m4` — M4 Core budgets, host only, no device, safe to run. **~20 minutes** (1,213 s measured 2026-08-09, including a 165 s release build): 62% of it is the worst-case single-hostname consolidation in `M4ScalePerformanceTests` (5 samples, each paying its own ~40 s divert before a ~40 s measurement) and the Req 10.1 settling pass (10 samples, each re-seeding 1,350 duplicate rows plus an untimed observation pass). The V4→V5 migration measurement is **gone** — `retire-migration-chain` deleted the pass it timed along with the suite. **The target exits 0**, with four accepted breaches reported as `withKnownIssue` known issues rather than failures (Req 10.1's settling pass, Req 5.5's three diagnosis re-derivations); `RUNS=3` therefore completes all three runs. See `specs/retire-migration-chain/verification-run.md` for the numbers and `docs/agent-notes/testing.md` for recording a band.+- `make test-performance-m4` — M4 Core budgets, host only, no device, safe to run. **~20 minutes** (1,213 s measured 2026-08-09, including a 165 s release build): 62% of it is the worst-case single-hostname consolidation in `M4ScalePerformanceTests` (5 samples, each paying its own ~40 s divert before a ~40 s measurement) and the Req 10.1 settling pass (10 samples, each re-seeding 1,350 duplicate rows plus an untimed observation pass). The V4→V5 migration measurement is **gone** — `retire-migration-chain` deleted the pass it timed along with the suite. **The target exits 0**, with the accepted breaches reported as `withKnownIssue` known issues rather than failures — four in the steady state (Req 10.1's settling pass, Req 5.5's three diagnosis re-derivations) plus a fifth, intermittent one since `data-model-cleanups` Q18 (Req 5.4's capture-projection arm, which fires only when host noise crosses its 100 ms budget; a 125 ms ceiling outside the known-issue block still catches real regressions); `RUNS=3` therefore completes all three runs. See `specs/retire-migration-chain/verification-run.md` for the numbers and `docs/agent-notes/testing.md` for recording a band. - `make test-performance-chunks` — host-only calibration sweep of the shared bulk chunk constant (import commits and the reconciler re-pin). No device, safe to run, but gated on `ASTERISM_RUN_CHUNK_SWEEP=1` and **~20 minutes per run**, so it is deliberately *not* part of `make test-performance-m4`. It asserts nothing — a calibration is reported, not budgeted. Re-run it when the bulk write paths change (Q53 and the task 25 section of `specs/cloudkit-mirroring/implementation.md`). - `make test-performance-m4-recent` — **physical device, see above** 

diff --git a/Packages/AsterismCore/Sources/AsterismCore/ArchiveRecordBuilders.swift b/Packages/AsterismCore/Sources/AsterismCore/ArchiveRecordBuilders.swiftnew file mode 100644index 0000000..e8bf1cc--- /dev/null+++ b/Packages/AsterismCore/Sources/AsterismCore/ArchiveRecordBuilders.swift@@ -0,0 +1,124 @@+import Foundation+import SwiftData++/// The construction half of an archive record, stated once for both import+/// paths (Decision 1).+///+/// `materializeArchive` builds a prospective graph in an empty in-memory store;+/// `upsert` builds the rows the live library is missing. They were two+/// transcriptions of the same constructor calls, and T-2054 recorded the+/// consequence: a column added to one is silently absent from the other, and+/// nothing fails until a restored library is missing a field the preview said it+/// had.+///+/// The mutable half was already shared — `LibraryRepository.apply(_:to:)`, which+/// the upsert runs over an existing row and the materializer over a fresh one.+/// This is the other half: identity, the columns a constructor takes, and+/// nothing else. Relationships stay with the callers, because they are the one+/// thing the two paths genuinely answer differently — the preview wires to the+/// rows it just inserted, the commit to the rows the library already holds.+///+/// What is deliberately **not** here is anything the commit does beyond+/// construction: type folding and minting, coverage application, and the+/// reconciler's repair pass are commit-only, and moving them behind a shared+/// name would make the strict gate validate a repaired graph rather than the+/// archive's own.+internal enum ArchiveRecordBuilders {++    static func makeSite(_ record: BackupV4Site) -> Site {+        let site = Site(hostname: record.hostname, displayName: record.displayName)+        site.modeRaw = record.mode.rawValue+        site.junkSuffixRule = record.junkSuffixRule+        return site+    }++    static func makeTitlePattern(+        _ record: BackupV4TitlePattern, site: Site?+    ) throws -> TitlePattern {+        let pattern = try TitlePattern(+            id: record.id,+            version: record.version,+            isActive: record.isActive,+            createdAt: record.createdAt,+            definition: record.definition,+            site: site+        )+        pattern.trimPrefix = record.trimPrefix+        pattern.trimSuffix = record.trimSuffix+        return pattern+    }++    static func makeURLRule(+        _ record: BackupV4URLRule, site: Site?+    ) throws -> URLRulePattern {+        try URLRulePattern(+            id: record.id,+            version: record.version,+            isCurrent: record.isCurrent,+            createdAt: record.createdAt,+            origin: record.origin,+            definition: record.definition,+            site: site+        )+    }++    /// The wire timestamps are what an import-created row carries on both fields+    /// (Q33), and an unrecognised state coerces to `.active` rather than+    /// refusing — a type row from a later build's wider set is legal data.+    static func makeWorkType(_ record: BackupV5WorkTypeRecord) -> WorkTypeEntity {+        let row = WorkTypeEntity(+            id: record.id, name: record.name,+            state: WorkTypeState(rawValue: record.stateRaw) ?? .active,+            canonicalID: record.canonicalID, timestamp: record.modifiedAt)+        row.createdAt = record.createdAt+        return row+    }++    static func makeWork(_ record: some ArchiveWorkRecord) -> Work {+        let work = Work(+            id: record.id,+            displayTitle: record.displayTitle,+            siteHostname: record.siteHostname,+            timestamp: record.createdAt+        )+        LibraryRepository.apply(record, to: work)+        return work+    }++    static func makeEntry(_ record: BackupV4Entry) -> Entry {+        let entry = Entry(+            id: record.id,+            captureTitle: record.captureTitle,+            captureTitleSource: record.captureTitleSource,+            rawURLString: record.rawURL,+            canonicalURLString: record.canonicalURL,+            hostname: record.hostname,+            entryIdentityKey: record.entryIdentityKey,+            timestamp: record.firstCapturedAt+        )+        LibraryRepository.apply(record, to: entry)+        return entry+    }++    static func makeCharacter(_ record: BackupV6Character) -> CharacterRecord {+        let character = CharacterRecord(+            id: record.id, name: record.name, nameKey: record.nameKey,+            aliases: record.aliases, note: record.note, facts: record.facts,+            timestamp: record.createdAt)+        character.modifiedAt = record.modifiedAt+        return character+    }++    /// The raw columns travel verbatim, so a value written by a later build's+    /// wider set survives the round trip rather than being coerced to this+    /// build's default.+    static func makeSuppression(_ record: BackupV6Suppression) -> CharacterSuppression {+        let row = CharacterSuppression(+            id: record.id, kind: record.kind, nameKey: record.nameKey,+            source: record.source, evidence: record.evidence, status: record.status,+            actionAt: record.actionAt)+        row.kindRaw = record.kindRaw+        row.statusRaw = record.statusRaw+        return row+    }+}

diff --git a/Packages/AsterismCore/Sources/AsterismCore/ArchiveWorkRecord.swift b/Packages/AsterismCore/Sources/AsterismCore/ArchiveWorkRecord.swiftindex 374e2aa..199dc97 100644--- a/Packages/AsterismCore/Sources/AsterismCore/ArchiveWorkRecord.swift+++ b/Packages/AsterismCore/Sources/AsterismCore/ArchiveWorkRecord.swift@@ -1,19 +1,13 @@ import Foundation -/// What the import commit needs from an archive's Work record, over both formats-/// the app accepts.+/// What the import commit needs from an archive's Work record. ///-/// The four other record kinds are literally the same types in 4/4 and 5/6-/// (Decision 12) — only the Work record changed shape — so the commit loop and-/// the materializers would otherwise be written twice for the sake of two type-/// columns. Stating the shared half as a protocol keeps one body and puts the-/// single genuine difference where a reader will look for it:-/// `applyTypeColumns`, which is the whole of Q35 on one side and one line on the-/// other.-///-/// Conforming the frozen 4/4 record is not a change to the format: a protocol-/// conformance adds no wire surface, and the mapping it declares is the one the-/// import already performed inline.+/// It existed because two generations' Work records differed in their type+/// columns and nothing else, and the commit loop would otherwise have been+/// written twice for the sake of them. One generation is left, so the protocol+/// now has one conformer — kept because it is where `applyTypeColumns` and+/// `referenceRecord` say what a Work record *is* to the import and the wire+/// checks, independently of which envelope carried it. internal protocol ArchiveWorkRecord {     var id: UUID { get }     var displayTitle: String { get }@@ -31,19 +25,13 @@ internal protocol ArchiveWorkRecord {     var createdAt: Date { get }     var modifiedAt: Date { get } -    /// Writes the record's type onto a row. The only thing the two formats do-    /// differently, and the only write here that reads the row before writing it.+    /// Writes the record's type onto a row.     func applyTypeColumns(to work: Work) }  extension ArchiveWorkRecord {     /// The record as the shared reference checks see it: the fields a Work-    /// record is *checked* by, which are the same in both formats and none of-    /// which is a type column.-    ///-    /// Stated once here rather than per codec for the reason the protocol-    /// exists: two identical projections are two chances for one format's-    /// validation to stop checking something.+    /// record is *checked* by, none of which is a type column.     internal var referenceRecord: BackupWireWorkReference {         BackupWireWorkReference(             id: id, siteHostname: siteHostname, entryIDs: entryIDs,@@ -53,40 +41,19 @@ extension ArchiveWorkRecord {     } } -extension BackupV4Work: ArchiveWorkRecord {-    /// Req 7.5 as Q35 scopes it.-    ///-    /// A 4/4 archive can say only what a pre-feature build could say, so its-    /// untyped record — the raw value `other` — is ambiguous in exactly one-    /// direction: it may be an archived untype, or it may be the compatibility-    /// value a configured or unrecognised assignment stores. Requirement 7.5-    /// forbids the second reading ("importing it SHALL NOT untype a work whose-    /// current type is not expressible in that format"), and nothing more: an-    /// archived untype of a *legacy-typed* or already untyped work is a-    /// legitimate pre-feature edit and applies under the commit's timestamp-    /// guard.-    ///-    /// Any other value is a legacy retype and is written whole — `typeRaw` set-    /// and `workTypeID` cleared — which is [6.10](../../../../specs/configurable-work-types/requirements.md#6.10)'s-    /// rule reached through an archive instead of through sync.-    func applyTypeColumns(to work: Work) {-        let archived = WorkTypeAssignment.assignment(typeRaw: type.rawValue, workTypeID: nil)-        if archived == .none {-            switch WorkTypeAssignment.assignment(of: work) {-            case .configured, .unrecognised: return-            case .none, .legacy: break-            }-        }-        WorkTypeWriter.apply(archived, to: work)-    }-}- extension BackupV5Work: ArchiveWorkRecord {-    /// The 5/6 record says what it means, so there is nothing to interpret: a+    /// The record says what it means, so there is nothing to interpret: a     /// configured identifier, a legacy raw value, or untyped, written through the     /// one shared writer. An identifier the merged list still cannot resolve is     /// written anyway and renders as unresolved (Q24) — refusing it would be     /// worse, and fabricating a name would be inventing data.+    ///+    /// The 4/4 record's conformance stood beside this one and carried Q35's+    /// whole reading: a 4/4 archive could say only what a pre-feature build+    /// could say, so its untyped record was ambiguous and had to be refused the+    /// power to untype a configured work. It went with the 4/4 read path+    /// (Decision 2) — there is no longer an archive that can express the+    /// ambiguity.     func applyTypeColumns(to work: Work) {         WorkTypeWriter.apply(assignment, to: work)     }

diff --git a/Packages/AsterismCore/Sources/AsterismCore/AsterismCapabilities.swift b/Packages/AsterismCore/Sources/AsterismCore/AsterismCapabilities.swiftindex a67ea33..7751d90 100644--- a/Packages/AsterismCore/Sources/AsterismCore/AsterismCapabilities.swift+++ b/Packages/AsterismCore/Sources/AsterismCore/AsterismCapabilities.swift@@ -21,7 +21,7 @@ public struct AsterismCapabilities: Codable, Equatable, Sendable {     public static let m4 = AsterismCapabilities(gate: .m4)      /// The current runtime gate is `.m4` (Decision 2, backup 4/4 work).-    /// `BackupV4Codec` stamps the literal `"m4"` rather than reading this value,+    /// `BackupV6Codec` stamps the literal `"m4"` rather than reading this value,     /// so the archive's gate is independent of the runtime's. Earlier gates stay     /// available because the schema and teaching suites still exercise them —     /// `SchemaV2Tests`, `CapabilityGatingTests`, `PhraseParsingTests`,

diff --git a/Packages/AsterismCore/Sources/AsterismCore/BackupV4Exporter.swift b/Packages/AsterismCore/Sources/AsterismCore/BackupArchiveProjection.swiftsimilarity index 66%rename from Packages/AsterismCore/Sources/AsterismCore/BackupV4Exporter.swiftrename to Packages/AsterismCore/Sources/AsterismCore/BackupArchiveProjection.swiftindex 09e8409..8f688e6 100644--- a/Packages/AsterismCore/Sources/AsterismCore/BackupV4Exporter.swift+++ b/Packages/AsterismCore/Sources/AsterismCore/BackupArchiveProjection.swift@@ -2,76 +2,22 @@ import Foundation import OSLog import SwiftData -private let exportLogger = Logger(subsystem: "AsterismCore", category: "BackupV4Exporter")+private let exportLogger = Logger(subsystem: "AsterismCore", category: "BackupExport") -// MARK: - V4 Snapshot Providing--/// Provides one coherent Backup V4 payload under a shared lock. Isolated from-/// persistence so export can be unit-tested with injected snapshots.-public protocol BackupV4SnapshotProviding: Sendable {-    func backupV4Snapshot() async throws -> BackupV4Payload-}--// MARK: - V4 Export Errors--public enum BackupV4ExportError: Error, Equatable, Sendable, CustomStringConvertible {-    /// Req 8.1. The store holds a **torn** identity group: one application UUID-    /// over rows that disagree about something the reader wrote. The archive-    /// keys records by UUID and cannot hold both variants, and silently dropping-    /// one is data loss inside a backup (Decision 2).-    ///-    /// This replaced `duplicateRecordIdentity`, which refused for *any* repeated-    /// UUID. Rows that agree are one record and now project to one (Req 8.2), so-    /// the refusal is exactly the state a reader has to resolve — and the-    /// payload carries the count and the route that says so (Req 8.4).-    case tornGroups(TornGroupsPayload)--    /// Req 3.6. A record holds a stored value the 4/4 wire format cannot-    /// represent — typically an enum raw value a newer app version wrote and-    /// synced down. Omitting the record is silent data loss; representing the-    /// value is a format change (Decision 4). So the record and the value are-    /// named and the export refuses.-    case unrepresentableValue(record: String, field: String, value: String)--    /// Req 3.7. A record cites a rule no row in the library holds, or a rule-    /// whose owning Site is absent and which no citing record locates. The-    /// import gates rightly refuse an archive whose citations do not resolve-    /// (relational-references Decision 3), so export must not produce one.-    ///-    /// Transient by nature: the missing row is en route.-    case referencesStillArriving(detail: String)--    case snapshotFailed(reason: String)-    case encodingFailed(reason: String)-    case stagingFailed(reason: String)--    public var description: String {-        switch self {-        case .tornGroups(let payload):-            payload.count == 1-                ? "Backup export refused: 1 record exists in differing copies, and a "-                    + "backup cannot hold both"-                : "Backup export refused: \(payload.count) records exist in differing "-                    + "copies, and a backup cannot hold them all"-        case .unrepresentableValue(let record, let field, let value):-            "Backup export refused: \(record) holds \(field) '\(value)', which this "-                + "backup format cannot represent — it was probably written by a newer "-                + "version of Asterism"-        case .referencesStillArriving(let detail):-            "Backup export refused: records are still arriving from iCloud (\(detail)). "-                + "Try again once syncing has settled"-        case .snapshotFailed(let reason): "Backup V4 snapshot failed: \(reason)"-        case .encodingFailed(let reason): "Backup V4 encoding failed: \(reason)"-        case .stagingFailed(let reason): "Backup V4 staging failed: \(reason)"-        }-    }-}+// The record projection every 6/7 export runs through, and the three refusals+// it names. It stood in `BackupV4Exporter.swift` while three generations shared+// it; the file it was named for is gone and this is the live export path, so it+// stands on its own.+//+// The record types keep their historical prefixes (Q13): `BackupV4Entry` and+// its siblings are the wire substrate of the 6/7 payload, and renaming a shipped+// record is churn with no behaviour change.  // MARK: - The format-independent half of a projection -/// What `projectCommonArchiveRecords` produced: the records both shipped-/// archive formats write identically, plus the identity groups and version-/// rewrites their Work mappers need.+/// What `projectCommonArchiveRecords` produced: the records the payload carries+/// unchanged from the generation that froze them, plus the identity groups and+/// version rewrites the Work mapper needs. internal struct ArchiveCommonProjection {     let groups: BackupGroupProjection.Projection     let entries: [BackupV4Entry]@@ -83,83 +29,20 @@ internal struct ArchiveCommonProjection {     let rewrites: [UUID: Int] } -// MARK: - LibraryRepository V4 Snapshot+// MARK: - The shared projection -extension LibraryRepository: BackupV4SnapshotProviding {-    /// Provides a coherent V4 backup payload under a shared lock.+extension LibraryRepository {+    /// Everything an archive projection does before the Work records are+    /// written: the Entry, Site, TitlePattern and URLRule records, the identity+    /// groups, the unreadable-rule partition, the site union and its version+    /// rewrites.     ///-    /// **The quarantine and unresolved gates are gone** (Req 3.1). They refused a-    /// file at exactly the moment one is most wanted: an ordinary sync quarantines-    /// a hostname or leaves 2,995 of 3,000 records holding an unresolved Site-    /// reference (Q25), and the backup tool then declined. What made removing them-    /// possible is `SiteUnionProjection` — duplicate rows project to one wire Site,-    /// rowless hostnames to a synthesised untaught one, and nil-site rules attach-    /// through their citers — so the snapshot is total over the ordinary sync-    /// states rather than merely permitted to try.-    ///-    /// Three refusals remain, each named: duplicate application UUIDs (3.3), a-    /// stored value the format cannot represent (3.6), and citations that do not-    /// resolve (3.7).-    ///-    /// Export never writes. The projection is computed read-side precisely so a-    /// backup cannot mutate the library on the way out (Q38); the archive it-    /// produces is nonetheless the shape reconciliation settles on, which is what-    /// makes Req 3.5's round-trip hold.-    public func backupV4Snapshot() async throws -> BackupV4Payload {-        let outcome: Result<BackupV4Payload, BackupV4ExportError> =-            try await withLockedBackupContext { context in-                do { return .success(try Self.projectV4Payload(context: context)) }-                catch let error as BackupV4ExportError { return .failure(error) }-            }-        return try outcome.get()-    }--    /// The whole snapshot, from a context. Static and pure so the projection can-    /// be exercised without an actor.-    internal static func projectV4Payload(context: ModelContext) throws -> BackupV4Payload {-        // 4/4 keeps its type refusal: it can only spell the closed `WorkType`-        // set, and by Req 6.11 every work an updated build typed reads as-        // `other` here, so the guard now only ever fires on a value a *newer*-        // build wrote — which is what it was always for.-        let common = try projectCommonArchiveRecords(-            context: context, refusingUnrepresentableWorkTypes: true)-        let payload = BackupV4Payload(-            entries: common.entries,-            works: try common.groups.works.map {-                try mapV4WorkRecord(-                    $0, canonicalWorkIDs: common.groups.canonicalWorkIDs,-                    rewrites: common.rewrites, types: common.groups.types)-            },-            sites: common.sites,-            titlePatterns: common.titlePatterns,-            urlRules: common.urlRules-        )-        // Req 3.7: the archive's own reference validator refuses a citation that-        // does not resolve, and the import gates refuse such a file. Discovering-        // that inside export's verify-decode would surface a library-shape problem-        // as a codec error, so it is named here instead.-        try requireCitationsResolve(-            entries: payload.entries,-            workIdentityRules: payload.works.map { ($0.id, $0.urlIdentityRuleID) },-            titlePatternIDs: Set(payload.titlePatterns.map(\.id)),-            urlRuleIDs: Set(payload.urlRules.map(\.id)))-        return payload-    }--    /// Everything an archive projection does that does not depend on which-    /// archive format is being written.-    ///-    /// The 5/6 format changed the Work record's type columns and added the type-    /// list; the Entry, Site, TitlePattern and URLRule records, the group-    /// projection, the unreadable-rule partition, the site union and its version-    /// rewrites are all the same work. Stating it once is what keeps a 5/6-    /// backup and a 4/4 backup of the same library describing the same library.-    ///-    /// - Parameter refusingUnrepresentableWorkTypes: whether a `typeRaw` outside-    ///   the closed `WorkType` set refuses the export. True for 4/4, which has-    ///   nowhere to put one; false for 5/6, which carries it verbatim (Q34).+    /// It was parameterised on whether an unrepresentable `typeRaw` refuses —+    /// true for 4/4, which had nowhere to put one, false for the generation that+    /// carries it verbatim (Q34). Only the second reading survives, so the+    /// parameter is gone rather than pinned to a constant.     internal static func projectCommonArchiveRecords(-        context: ModelContext, refusingUnrepresentableWorkTypes: Bool+        context: ModelContext     ) throws -> ArchiveCommonProjection {         let entries = try context.fetch(FetchDescriptor<Entry>())             .sorted { $0.id.uuidString < $1.id.uuidString }@@ -204,8 +87,7 @@ extension LibraryRepository: BackupV4SnapshotProviding {         // a losing row's is still in the library after the export.         try requireRepresentableValues(             entries: entries, works: works, sites: sites,-            patterns: patterns, urlRules: archivableURLRules,-            refusingUnrepresentableWorkTypes: refusingUnrepresentableWorkTypes)+            patterns: patterns, urlRules: archivableURLRules)          // Rules whose Site has not arrived are attached through a citing record's         // hostname (Q41). One that nothing cites cannot be placed at all.@@ -213,7 +95,7 @@ extension LibraryRepository: BackupV4SnapshotProviding {         var additionalPatterns: [String: [TitlePattern]] = [:]         for pattern in patterns where pattern.site == nil {             guard let hostname = citers[pattern.id] else {-                throw BackupV4ExportError.referencesStillArriving(+                throw BackupV6ExportError.referencesStillArriving(                     detail: "title rule \(pattern.id) has no site and no entry naming one")             }             additionalPatterns[hostname, default: []].append(pattern)@@ -221,7 +103,7 @@ extension LibraryRepository: BackupV4SnapshotProviding {         var additionalURLRules: [String: [URLRulePattern]] = [:]         for rule in archivableURLRules where rule.site == nil {             guard let hostname = citers[rule.id] else {-                throw BackupV4ExportError.referencesStillArriving(+                throw BackupV6ExportError.referencesStillArriving(                     detail: "URL rule \(rule.id) has no site and no record naming one")             }             additionalURLRules[hostname, default: []].append(rule)@@ -276,13 +158,17 @@ extension LibraryRepository: BackupV4SnapshotProviding {      // MARK: - The three named refusals -    /// Req 3.6. Every stored raw value the 4/4 mappers read, checked before they-    /// read it — several of them coerce (`?? .conservative`, `?? .manual`) rather-    /// than throw, and a coerced value is silent data loss in a backup.+    /// Req 3.6. Every stored raw value the record mappers read, checked before+    /// they read it — several of them coerce (`?? .conservative`, `?? .manual`)+    /// rather than throw, and a coerced value is silent data loss in a backup.+    ///+    /// A Work's `typeRaw` is deliberately absent (Q8, Q34): the wire record+    /// carries any stored raw verbatim, so there is nothing here that could be+    /// lost, and refusing would fail an export over legal data a newer build+    /// wrote.     private static func requireRepresentableValues(         entries: [Entry], works: [Work], sites: [Site],-        patterns: [TitlePattern], urlRules: [URLRulePattern],-        refusingUnrepresentableWorkTypes: Bool+        patterns: [TitlePattern], urlRules: [URLRulePattern]     ) throws {         for entry in entries {             let record = "Entry \(entry.id)"@@ -303,9 +189,6 @@ extension LibraryRepository: BackupV4SnapshotProviding {         }         for work in works {             let record = "Work \(work.id)"-            if refusingUnrepresentableWorkTypes {-                try require(WorkType(rawValue: work.typeRaw), record, "type", work.typeRaw)-            }             try require(TitleProvenance(rawValue: work.titleProvenanceRaw),                 record, "title provenance", work.titleProvenanceRaw)             try require(WorkURLIdentityState(rawValue: work.urlIdentityStateRaw),@@ -319,7 +202,7 @@ extension LibraryRepository: BackupV4SnapshotProviding {             try require(PatternForm(rawValue: pattern.formRaw), record, "form", pattern.formRaw)             do { _ = try pattern.definition }             catch {-                throw BackupV4ExportError.unrepresentableValue(+                throw BackupV6ExportError.unrepresentableValue(                     record: record, field: "definition", value: pattern.formRaw)             }         }@@ -359,7 +242,7 @@ extension LibraryRepository: BackupV4SnapshotProviding {         var omitted: Set<UUID> = []         for (id, rule) in unreadable.sorted(by: { $0.key.uuidString < $1.key.uuidString }) {             guard !cited.contains(id) else {-                throw BackupV4ExportError.unrepresentableValue(+                throw BackupV6ExportError.unrepresentableValue(                     record: "URL rule \(id)", field: "definition",                     value: "\(rule.definitionData.count) bytes that do not decode")             }@@ -390,13 +273,13 @@ extension LibraryRepository: BackupV4SnapshotProviding {         _ value: Value?, _ record: String, _ field: String, _ raw: String     ) throws {         guard value == nil else { return }-        throw BackupV4ExportError.unrepresentableValue(record: record, field: field, value: raw)+        throw BackupV6ExportError.unrepresentableValue(record: record, field: field, value: raw)     } -    /// Req 3.7's third face: a hostname whose *projected* tuple the 4/4 format-    /// has no case for.+    /// Req 3.7's third face: a hostname whose *projected* tuple the archive+    /// format has no case for.     ///-    /// The archive's closed tuple table (`BackupV4ReferenceValidator`) wants a+    /// The archive's closed tuple table (`BackupArchiveReferenceChecks`) wants a     /// `.taught` Site to hold exactly one active title rule, an `.untaught` one     /// to hold nothing but imported V2 URL history, and an `.articles` one to     /// hold neither an active title rule nor a current URL rule.@@ -426,7 +309,7 @@ extension LibraryRepository: BackupV4SnapshotProviding {             switch site.mode {             case .taught:                 guard activePatterns != 1 else { continue }-                throw BackupV4ExportError.referencesStillArriving(+                throw BackupV6ExportError.referencesStillArriving(                     detail: "site \(site.hostname) is taught, and the one active title rule "                         + "that state needs is not in the library")             case .untaught:@@ -434,12 +317,12 @@ extension LibraryRepository: BackupV4SnapshotProviding {                     $0.rule.origin == .importedV2 && !$0.isCurrent                 }                 guard !site.patterns.isEmpty || currentRules > 0 || !historyOnly else { continue }-                throw BackupV4ExportError.referencesStillArriving(+                throw BackupV6ExportError.referencesStillArriving(                     detail: "site \(site.hostname) is untaught while still holding rules, "                         + "so the teaching that owns them has not arrived")             case .articles:                 guard activePatterns > 0 || currentRules > 0 else { continue }-                throw BackupV4ExportError.referencesStillArriving(+                throw BackupV6ExportError.referencesStillArriving(                     detail: "site \(site.hostname) reads as articles while still holding an "                         + "active rule, so the change that cleared them has not arrived")             }@@ -475,7 +358,7 @@ extension LibraryRepository: BackupV4SnapshotProviding {      private static func missingCitation(         _ record: String, _ field: String-    ) -> BackupV4ExportError {+    ) -> BackupV6ExportError {         .referencesStillArriving(             detail: "\(record) names \(field), which the library does not hold")     }@@ -532,10 +415,6 @@ extension LibraryRepository: BackupV4SnapshotProviding {         let snap = try snapshot(group)         let entry = group.representative         let carrier = group.carrier-        func version(_ id: UUID?, _ stored: Int?) -> Int? {-            guard let id else { return stored }-            return rewrites[id] ?? stored-        }         return BackupV4Entry(             id: snap.id,             captureTitle: snap.captureTitle,@@ -548,17 +427,21 @@ extension LibraryRepository: BackupV4SnapshotProviding {             conservativeIdentityKey: entry.conservativeIdentityKey,             identityBasis: EntryIdentityBasis(rawValue: entry.identityBasisRaw) ?? .conservative,             identityURLRuleID: entry.identityURLRuleID,-            identityURLRuleVersion: version(entry.identityURLRuleID, entry.identityURLRuleVersion),+            identityURLRuleVersion: version(+                entry.identityURLRuleID, entry.identityURLRuleVersion, rewrites: rewrites),             identityNameTitleRuleID: entry.identityNameTitleRuleID,             identityNameTitleRuleVersion: version(-                entry.identityNameTitleRuleID, entry.identityNameTitleRuleVersion),+                entry.identityNameTitleRuleID, entry.identityNameTitleRuleVersion,+                rewrites: rewrites),             urlWorkIdentity: entry.urlWorkIdentity,             urlWorkRuleID: entry.urlWorkRuleID,-            urlWorkRuleVersion: version(entry.urlWorkRuleID, entry.urlWorkRuleVersion),+            urlWorkRuleVersion: version(+                entry.urlWorkRuleID, entry.urlWorkRuleVersion, rewrites: rewrites),             chapterSequence: entry.chapterSequence,             chapterSequenceRuleID: entry.chapterSequenceRuleID,             chapterSequenceRuleVersion: version(-                entry.chapterSequenceRuleID, entry.chapterSequenceRuleVersion),+                entry.chapterSequenceRuleID, entry.chapterSequenceRuleVersion,+                rewrites: rewrites),             chapterTitle: snap.chapterTitle,             chapterTitleProvenance: try rewritten(snap.chapterTitleProvenance, rewrites),             note: snap.note,@@ -569,10 +452,12 @@ extension LibraryRepository: BackupV4SnapshotProviding {             workID: snap.workID,             workAssignmentProvenance: try rewritten(snap.workAssignmentProvenance, rewrites),             workURLRuleID: entry.workURLRuleID,-            workURLRuleVersion: version(entry.workURLRuleID, entry.workURLRuleVersion),+            workURLRuleVersion: version(+                entry.workURLRuleID, entry.workURLRuleVersion, rewrites: rewrites),             workURLAssignmentKind: entry.workURLAssignmentKind,             workPatternID: carrier.workPatternID,-            workPatternVersion: version(carrier.workPatternID, carrier.workPatternVersion),+            workPatternVersion: version(+                carrier.workPatternID, carrier.workPatternVersion, rewrites: rewrites),             intentionallyUnattached: snap.intentionallyUnattached         )     }@@ -595,13 +480,40 @@ extension LibraryRepository: BackupV4SnapshotProviding {     /// Work it belongs to, and a split Entry group hanging off two rows of one     /// Work group would be listed twice, which the archive's own validator     /// counts as a duplicate reference.-    internal static func mapV4WorkRecord(-        _ group: WorkGroup, canonicalWorkIDs: [UUID: UUID], rewrites: [UUID: Int] = [:],+    ///+    /// The type columns come from the **carrier**'s assignment — the same row+    /// the rest of a group's authored content comes from. The stored+    /// `workTypeID` is written verbatim, never canonicalized: the archive+    /// carries the merged entries too, so the import's chase resolves a pointer+    /// at a non-surviving entry the same way this device's directory does. A+    /// pointer to an entry the library does not hold exports verbatim with+    /// `typeName: nil` (Q24) — refusing there would fail an export at exactly+    /// the moment sync has not settled.+    ///+    /// `typeName` is set for configured types only. A legacy or unrecognised+    /// value *is* its own label and travels in `legacyType`; a second copy of it+    /// would be a field that can disagree with the first.+    internal static func mapV5WorkRecord(+        _ group: WorkGroup,+        canonicalWorkIDs: [UUID: UUID],+        rewrites: [UUID: Int] = [:],         types: WorkTypeDirectory-    ) throws -> BackupV4Work {+    ) throws -> BackupV5Work {         let snap = try snapshot(group, canonicalWorkIDs: canonicalWorkIDs, types: types)         let work = group.representative-        return BackupV4Work(+        let assignment = WorkTypeAssignment.assignment(of: group.carrier)+        let workTypeID: UUID?+        let legacyType: String?+        let typeName: String?+        switch assignment {+        case .none:+            (workTypeID, legacyType, typeName) = (nil, nil, nil)+        case .configured(let id):+            (workTypeID, legacyType, typeName) = (id, nil, types.resolve(id)?.name)+        case .legacy(let raw), .unrecognised(let raw):+            (workTypeID, legacyType, typeName) = (nil, raw, nil)+        }+        return BackupV5Work(             id: snap.id,             displayTitle: snap.displayTitle,             lastParsedTitle: snap.lastParsedTitle,@@ -609,16 +521,13 @@ extension LibraryRepository: BackupV4SnapshotProviding {             urlIdentity: snap.urlIdentity,             urlIdentityState: work.urlIdentityState,             urlIdentityRuleID: work.urlIdentityRuleID,-            urlIdentityRuleVersion: work.urlIdentityRuleID-                .flatMap { rewrites[$0] } ?? work.urlIdentityRuleVersion,+            urlIdentityRuleVersion: version(+                work.urlIdentityRuleID, work.urlIdentityRuleVersion, rewrites: rewrites),             workURL: snap.workURLString,             genericNotes: snap.genericNotes,-            // The **compatibility** column, verbatim from the carrier — which is-            // exactly what a pre-feature build reads off the row (Decision 4).-            // A configured type therefore archives as `other`, the same untyped-            // value such a build would show for it (Req 6.11); an unrepresentable-            // raw never reaches here, because the 4/4 projection refuses it.-            type: WorkType(rawValue: group.carrier.typeRaw) ?? .other,+            workTypeID: workTypeID,+            legacyType: legacyType,+            typeName: typeName,             genreTags: snap.genreTags,             titleProvenance: snap.titleProvenance,             createdAt: snap.createdAt,@@ -665,8 +574,9 @@ extension LibraryRepository: BackupV4SnapshotProviding {      /// `throws` because the definition does (Req 4.5): the mapper needs a typed     /// `URLRuleDefinition` for every row it writes, so a row that will not-    /// decode cannot be archived at all. `projectV4Payload` refuses or omits by-    /// rule **id**, but the site projection picks one representative *row* per+    /// decode cannot be archived at all. `projectCommonArchiveRecords` refuses+    /// or omits by rule **id**, but the site projection picks one+    /// representative *row* per     /// id — so a duplicate-UUID group holding one readable and one corrupt row     /// can still surface the corrupt row here. Export refuses either way; the     /// catch keeps that refusal a named `unrepresentableValue` rather than a@@ -677,7 +587,7 @@ extension LibraryRepository: BackupV4SnapshotProviding {         let definition: URLRuleDefinition         do { definition = try projected.rule.definition }         catch {-            throw BackupV4ExportError.unrepresentableValue(+            throw BackupV6ExportError.unrepresentableValue(                 record: "URL rule \(projected.rule.id)", field: "definition",                 value: "\(projected.rule.definitionData.count) bytes that do not decode")         }@@ -694,6 +604,16 @@ extension LibraryRepository: BackupV4SnapshotProviding {         )     } +    /// A cited rule's archived version: the union's renumbered version where+    /// `rewrites` holds one for the id, the stored version otherwise+    /// (Decision 7).+    private static func version(+        _ id: UUID?, _ stored: Int?, rewrites: [UUID: Int]+    ) -> Int? {+        guard let id else { return stored }+        return rewrites[id] ?? stored+    }+     /// A `FieldProvenance` whose cited pattern version follows the union.     private static func rewritten(         _ provenance: FieldProvenance, _ rewrites: [UUID: Int]@@ -703,84 +623,3 @@ extension LibraryRepository: BackupV4SnapshotProviding {         return try FieldProvenance(kind: provenance.kind, patternID: id, patternVersion: version)     } }--// MARK: - V4 Exporter--/// Orchestrates coherent V4 snapshot → validated Backup V4 encoding → staging.-///-/// Export is V4-only (Req 3.2): it decode-validates its own bytes before sharing,-/// so a produced file is always a valid strict Backup V4 document (Req 3.4).-///-/// That gate should now pass whenever none of the three named refusals fires-/// (3.3, 3.6, 3.7) — the snapshot projection makes the payload total over the-/// ordinary sync states. A decode failure beyond them is a bug, and the-/// round-trip tests treat it as one.-public final class BackupV4Exporter: Sendable {-    private let repository: any BackupV4SnapshotProviding-    private let stagingDirectory: URL--    public init(-        repository: any BackupV4SnapshotProviding,-        stagingDirectory: URL-    ) {-        self.repository = repository-        self.stagingDirectory = stagingDirectory-    }--    public func export(metadata: BackupV4Metadata) async throws -> BackupExportResult {-        let payload: BackupV4Payload-        do {-            payload = try await repository.backupV4Snapshot()-        } catch let error as BackupV4ExportError {-            throw error-        } catch {-            throw BackupV4ExportError.snapshotFailed(reason: String(describing: error))-        }--        let encoded: Data-        do {-            encoded = try BackupV4Codec.encode(payload: payload, metadata: metadata)-        } catch {-            throw BackupV4ExportError.encodingFailed(reason: String(describing: error))-        }--        // Decode-validate the produced bytes (Req 5.2).-        do {-            let decoded = try BackupV4Codec.decode(encoded)-            guard decoded.payload == payload else {-                throw BackupV4ExportError.encodingFailed(reason: "decode-validation payload mismatch")-            }-        } catch let error as BackupV4ExportError {-            throw error-        } catch {-            throw BackupV4ExportError.encodingFailed(reason: "decode-validation failed: \(error)")-        }--        do {-            try FileManager.default.createDirectory(-                at: stagingDirectory, withIntermediateDirectories: true)-            let fileURL = stagingDirectory.appending(-                path: ExportStaging.backupFilename(-                    version: "v4", exportedAt: metadata.exportedAt))-            do {-                try ExportStaging.write(encoded, to: fileURL)-            } catch {-                throw BackupV4ExportError.stagingFailed(reason: String(describing: error))-            }-            return BackupExportResult(fileURL: fileURL)-        } catch let error as BackupV4ExportError {-            throw error-        } catch {-            throw BackupV4ExportError.stagingFailed(reason: "preparing staging directory failed: \(error)")-        }-    }--    public func cleanup(_ result: BackupExportResult) {-        try? FileManager.default.removeItem(at: result.fileURL)-    }--    /// Removes abandoned backup files older than 24 hours from the staging area.-    public func scavengeStaleFiles() {-        ExportStaging.scavengeBackups(in: stagingDirectory)-    }-}

diff --git a/Packages/AsterismCore/Sources/AsterismCore/BackupExporter.swift b/Packages/AsterismCore/Sources/AsterismCore/BackupExporter.swiftindex aaeece5..136d2eb 100644--- a/Packages/AsterismCore/Sources/AsterismCore/BackupExporter.swift+++ b/Packages/AsterismCore/Sources/AsterismCore/BackupExporter.swift@@ -1,7 +1,7 @@ import Foundation  /// The file a completed backup export produced, handed to the share sheet and-/// cleaned up afterwards. `BackupV4Exporter` is the only producer.+/// cleaned up afterwards. `BackupV6Exporter` is the only producer. public struct BackupExportResult: Sendable {     public let fileURL: URL 

diff --git a/Packages/AsterismCore/Sources/AsterismCore/BackupGroupProjection.swift b/Packages/AsterismCore/Sources/AsterismCore/BackupGroupProjection.swiftindex b8d62bb..6c25ebf 100644--- a/Packages/AsterismCore/Sources/AsterismCore/BackupGroupProjection.swift+++ b/Packages/AsterismCore/Sources/AsterismCore/BackupGroupProjection.swift@@ -72,7 +72,7 @@ enum BackupGroupProjection {         let characters: [CharacterGroup]     } -    /// - Throws: `BackupV4ExportError.tornGroups` when the store holds a torn+    /// - Throws: `BackupV6ExportError.tornGroups` when the store holds a torn     ///   group — the biconditional of Req 8.1, since nothing else here refuses.     static func project(         entries: [Entry], works: [Work], characters: [CharacterRecord] = [],@@ -98,7 +98,7 @@ enum BackupGroupProjection {         // no site at all and a torn character would export one variant silently.         let tornCharacters = characterGroups.values.filter(\.isTorn)         guard tornEntries.isEmpty, tornWorks.isEmpty, tornCharacters.isEmpty else {-            throw BackupV4ExportError.tornGroups(+            throw BackupV6ExportError.tornGroups(                 tornGroupsPayload(                     tornEntries: tornEntries, tornWorks: tornWorks,                     tornCharacters: tornCharacters,

diff --git a/Packages/AsterismCore/Sources/AsterismCore/BackupImportCharacters.swift b/Packages/AsterismCore/Sources/AsterismCore/BackupImportCharacters.swiftindex c374317..2bf74bb 100644--- a/Packages/AsterismCore/Sources/AsterismCore/BackupImportCharacters.swift+++ b/Packages/AsterismCore/Sources/AsterismCore/BackupImportCharacters.swift@@ -32,7 +32,7 @@ extension LibraryRepository {     ///     in the map lands unattached, which is the tolerated in-flight state     ///     Req 6.7 names rather than a reason to drop the record.     internal static func mergeImportedCharacters(-        _ payload: BackupV6Payload,+        _ payload: BackupImportPayload,         workTargets: [UUID: Work],         workRows: [UUID: [Work]],         entryRows: [UUID: [Entry]],@@ -54,11 +54,7 @@ extension LibraryRepository {                     if let target { row.work = target }                 }             } else {-                let character = CharacterRecord(-                    id: record.id, name: record.name, nameKey: record.nameKey,-                    aliases: record.aliases, note: record.note, facts: record.facts,-                    timestamp: record.createdAt)-                character.modifiedAt = record.modifiedAt+                let character = ArchiveRecordBuilders.makeCharacter(record)                 context.insert(character)                 character.work = target                 characterRows[record.id] = [character]@@ -75,15 +71,7 @@ extension LibraryRepository {                     if let target { row.work = target }                 }             } else {-                let row = CharacterSuppression(-                    id: record.id, kind: record.kind, nameKey: record.nameKey,-                    source: record.source, evidence: record.evidence, status: record.status,-                    actionAt: record.actionAt)-                // The raw columns verbatim, so a value written by a later-                // build's wider set survives the round trip rather than being-                // coerced to this build's default.-                row.kindRaw = record.kindRaw-                row.statusRaw = record.statusRaw+                let row = ArchiveRecordBuilders.makeSuppression(record)                 context.insert(row)                 row.work = target                 suppressionRows[record.id] = [row]

diff --git a/Packages/AsterismCore/Sources/AsterismCore/BackupImportWorkTypes.swift b/Packages/AsterismCore/Sources/AsterismCore/BackupImportWorkTypes.swiftindex 9ed314d..62e1356 100644--- a/Packages/AsterismCore/Sources/AsterismCore/BackupImportWorkTypes.swift+++ b/Packages/AsterismCore/Sources/AsterismCore/BackupImportWorkTypes.swift@@ -1,7 +1,7 @@ import Foundation import SwiftData -// The type-list half of a 5/6 import (Reqs 7.3, 7.4, 7.7, 7.8).+// The type-list half of an import (Reqs 7.3, 7.4, 7.7, 7.8). // // **Additive, and never a rewrite of a work.** Import brings entries the library // lacks, restores one the archive says is active, and redirects the archive's@@ -48,13 +48,17 @@ extension LibraryRepository {             id: UUID, name: String, state: WorkTypeState, canonicalID: UUID?,             createdAt: Date, modifiedAt: Date         ) {-            let row = WorkTypeEntity(-                id: id, name: name, state: state, canonicalID: canonicalID,-                timestamp: modifiedAt)-            // The record's own `createdAt`, which `timestamp:` would otherwise-            // have overwritten with its `modifiedAt`. Survivor election is-            // earliest-created, so this is not decoration.-            row.createdAt = createdAt+            // Through the one builder that turns archive data into a row+            // (`ArchiveRecordBuilders.makeWorkType`), including its restore of+            // the record's own `createdAt` — survivor election is+            // earliest-created, so that is not decoration. What varies between+            // this caller and the record-by-record path is the *arguments* — a+            // mint wears the archive's timestamp, an alias a locally chosen+            // canonical target — never the construction.+            let row = ArchiveRecordBuilders.makeWorkType(+                BackupV5WorkTypeRecord(+                    id: id, name: name, stateRaw: state.rawValue, canonicalID: canonicalID,+                    createdAt: createdAt, modifiedAt: modifiedAt))             context.insert(row)             rows.append(row)             rowsByID[id, default: []].append(row)

diff --git a/Packages/AsterismCore/Sources/AsterismCore/BackupImporter.swift b/Packages/AsterismCore/Sources/AsterismCore/BackupImporter.swiftindex a88cb04..5342b1f 100644--- a/Packages/AsterismCore/Sources/AsterismCore/BackupImporter.swift+++ b/Packages/AsterismCore/Sources/AsterismCore/BackupImporter.swift@@ -3,85 +3,73 @@ import OSLog  // MARK: - Import Plan -/// The records an accepted archive carries, and which format wrote them.+/// The records an accepted archive carries. ///-/// One case per generation rather than one up-converted shape, because the-/// generations mean genuinely different things by an untyped work and the-/// difference is not expressible in one record. A 4/4 archive says "untyped as a-/// pre-feature build can say it", which must not untype a configured or-/// unrecognised assignment (Q35); a 5/6 archive says exactly what it means, and-/// a 6/7 archive says it while also carrying characters. Everything *else* they-/// carry is literally the same record types (Decision 12), which is why the four-/// shared arrays read straight off any case.-public enum BackupImportPayload: Sendable, Equatable {-    case v4Archive(BackupV4Payload)-    case v5Archive(BackupV5Payload)-    case v6Archive(BackupV6Payload)--    public var entries: [BackupV4Entry] {-        switch self {-        case .v4Archive(let payload): payload.entries-        case .v5Archive(let payload): payload.entries-        case .v6Archive(let payload): payload.entries-        }-    }--    public var sites: [BackupV4Site] {-        switch self {-        case .v4Archive(let payload): payload.sites-        case .v5Archive(let payload): payload.sites-        case .v6Archive(let payload): payload.sites-        }-    }+/// It was an enum with a case per generation and five switch accessors, because+/// the generations meant genuinely different things by an untyped work. One+/// generation is left, so the discriminator described a distinction that can no+/// longer exist and every accessor answered the same arm three times. What+/// remains is the payload's arrays, named.+///+/// This is `BackupV6Payload`'s content rather than the type itself: the wire+/// struct is a `Codable` frozen shape and the plan is what the commit reads, and+/// keeping them separate is what lets a future generation arrive without the+/// upsert learning its envelope.+public struct BackupImportPayload: Sendable, Equatable {+    public let entries: [BackupV4Entry]+    public let works: [BackupV5Work]+    public let sites: [BackupV4Site]+    public let titlePatterns: [BackupV4TitlePattern]+    public let urlRules: [BackupV4URLRule]+    public let workTypes: [BackupV5WorkTypeRecord]+    public let characters: [BackupV6Character]+    public let suppressions: [BackupV6Suppression]+    public let coverage: [BackupV6Coverage] -    public var titlePatterns: [BackupV4TitlePattern] {-        switch self {-        case .v4Archive(let payload): payload.titlePatterns-        case .v5Archive(let payload): payload.titlePatterns-        case .v6Archive(let payload): payload.titlePatterns-        }+    public init(+        entries: [BackupV4Entry],+        works: [BackupV5Work],+        sites: [BackupV4Site],+        titlePatterns: [BackupV4TitlePattern],+        urlRules: [BackupV4URLRule],+        workTypes: [BackupV5WorkTypeRecord] = [],+        characters: [BackupV6Character] = [],+        suppressions: [BackupV6Suppression] = [],+        coverage: [BackupV6Coverage] = []+    ) {+        self.entries = entries+        self.works = works+        self.sites = sites+        self.titlePatterns = titlePatterns+        self.urlRules = urlRules+        self.workTypes = workTypes+        self.characters = characters+        self.suppressions = suppressions+        self.coverage = coverage     } -    public var urlRules: [BackupV4URLRule] {-        switch self {-        case .v4Archive(let payload): payload.urlRules-        case .v5Archive(let payload): payload.urlRules-        case .v6Archive(let payload): payload.urlRules-        }+    public init(_ payload: BackupV6Payload) {+        self.init(+            entries: payload.entries, works: payload.works, sites: payload.sites,+            titlePatterns: payload.titlePatterns, urlRules: payload.urlRules,+            workTypes: payload.workTypes, characters: payload.characters,+            suppressions: payload.suppressions, coverage: payload.coverage)     } -    /// How many Work records the archive holds. A count rather than the records-    /// themselves: the formats' Work records are different types, and every+    /// How many Work records the archive holds. Kept as a name because every     /// caller outside the commit loop only ever wanted the number.-    public var workCount: Int {-        switch self {-        case .v4Archive(let payload): payload.works.count-        case .v5Archive(let payload): payload.works.count-        case .v6Archive(let payload): payload.works.count-        }-    }--    /// The type list and the works that cite it, for the generations that carry-    /// one. 4/4 carries neither, and its untyped record means something the-    /// merge must not act on (Q35), so it answers with nothing.-    internal var workTypeRecords: (types: [BackupV5WorkTypeRecord], works: [BackupV5Work]) {-        switch self {-        case .v4Archive: ([], [])-        case .v5Archive(let payload): (payload.workTypes, payload.works)-        case .v6Archive(let payload): (payload.workTypes, payload.works)-        }-    }+    public var workCount: Int { works.count } }  /// The immutable import plan built outside the repository actor and without a /// process lease. Represents a complete validated prospective graph ready to be /// materialized atomically. ///-/// Three source versions are accepted: native `4/4`, `5/6`, and the `6/7` this-/// feature mints (Req 6.1). The `2/2` and `3/3` import paths were retired once-/// every archive worth importing had been re-exported at 4/4; recovering a-/// pre-M3.5 archive now means checking out a build that still carries those-/// codecs.+/// One source version is accepted, `6/7`. The `2/2` and `3/3` paths were retired+/// once every archive worth importing had been re-exported at 4/4, and the `4/4`+/// and `5/6` paths went the same way (Decision 2) once every archive worth+/// importing had been re-exported at 6/7. Recovering an older archive means+/// checking out a build that still carries its codec. public struct BackupImportPlan: Sendable, Equatable {     public let metadata: BackupImportMetadata     public let payload: BackupImportPayload@@ -96,14 +84,13 @@ public struct BackupImportPlan: Sendable, Equatable {         self.counts = counts     } -    /// A 4/4 plan, spelled the way it was before the 5/6 arm existed. Kept-    /// because the suites that build one by hand are about the upsert, not about-    /// which format reached it.+    /// A plan over a wire payload, which is how every archive reaches one.     public init(-        metadata: BackupImportMetadata, payload: BackupV4Payload,+        metadata: BackupImportMetadata, payload: BackupV6Payload,         counts: LibraryRecordCounts     ) {-        self.init(metadata: metadata, payload: .v4Archive(payload), counts: counts)+        self.init(+            metadata: metadata, payload: BackupImportPayload(payload), counts: counts)     } } @@ -174,110 +161,59 @@ public enum BackupImportError: Error, Equatable, Sendable, CustomStringConvertib  // MARK: - BackupImporter -/// Reads the strict envelope discriminator and dispatches to the codec that-/// claims the pair. Builds an immutable `BackupImportPlan` outside the repository-/// actor and without a process lease. Never mutates the selected file.+/// Reads the strict envelope discriminator and refuses anything that is not the+/// one shape this app reads. Builds an immutable `BackupImportPlan` outside the+/// repository actor and without a process lease. Never mutates the selected+/// file. ///-/// Import supports exact native `4/4`, `5/6` and `6/7`. Mixed pairs and malformed-/// or future headers reject before repository mutation — which is the same door a-/// *pre-feature* build meets `(6, 7)` at, and why a 6/7 archive cannot half-apply-/// on one (`character-extraction` Req 6.1).+/// Import supports exact native `6/7` and nothing else. Mixed pairs, older+/// generations and future headers reject before repository mutation — which is+/// the same door a *pre-feature* build meets `(6, 7)` at, and why a 6/7 archive+/// cannot half-apply on one (`character-extraction` Req 6.1). public enum BackupImporter {     private static let logger = Logger(subsystem: "me.nore.ig.Asterism", category: "BackupImporter") +    /// The pair this app reads and writes.+    private static let supportedVersions = (+        format: BackupV6Document.formatVersion, schema: BackupV6Document.schemaVersion+    )+     // MARK: - Plan Dispatch (Req 5.1, 5.2, Decision 2) -    /// Builds a validated prospective import plan from raw backup data. Native-    /// `4/4`, `5/6` and `6/7` are the accepted source versions; everything else-    /// is unsupported. Runs entirely outside the repository actor and holds no-    /// process lease.+    /// Builds a validated prospective import plan from raw backup data. Runs+    /// entirely outside the repository actor and holds no process lease.     public static func plan(from data: Data) throws -> BackupImportPlan {         logger.debug("Building import plan from \(data.count) bytes")          let (formatVersion, schemaVersion) = try detectVersions(data)         logger.debug("Detected format=\(formatVersion) schema=\(schemaVersion)") -        switch (formatVersion, schemaVersion) {-        case (4, 4):-            return try planFromV4Archive(data)-        case (5, 6):-            return try planFromV5Archive(data)-        case (6, 7):-            return try planFromV6Archive(data)-        case (2, 2), (3, 3):-            // Recognised, and deliberately no longer readable. Say so plainly:-            // these archives were restorable until the older import paths were-            // retired, so a reader meeting this has done nothing wrong.+        guard (formatVersion, schemaVersion) == supportedVersions else {+            // The pair is named, always. An older archive was restorable until+            // its read path was retired, so a reader meeting this has done+            // nothing wrong and is owed the version rather than a shrug.             throw BackupImportError.unsupportedFormat(                 reason: """-                    this backup is in the older \(formatVersion)/\(schemaVersion) \-                    format, which this version of Asterism can no longer restore. \-                    Only backups exported by a recent version (4/4, 5/6 or 6/7) can \+                    this backup declares format \(formatVersion)/schema \+                    \(schemaVersion), which this version of Asterism cannot \+                    restore. Only backups exported by a recent version \+                    (\(supportedVersions.format)/\(supportedVersions.schema)) can be \                     imported.                     """             )-        default:-            throw BackupImportError.unsupportedFormat(-                reason:-                    "format \(formatVersion)/schema \(schemaVersion) is not supported; "-                    + "expected 4/4, 5/6 or 6/7"-            )-        }-    }--    private static func planFromV4Archive(_ data: Data) throws -> BackupImportPlan {-        logger.debug("Decoding native Backup V4")-        let document: BackupV4Document-        do {-            document = try BackupV4Codec.decode(data)-        } catch {-            throw BackupImportError.decodingFailed(reason: String(describing: error))-        }-        let counts = try validateV4(document.payload)-        let metadata = BackupImportMetadata(-            formatVersion: document.backupFormatVersion,-            schemaVersion: document.databaseSchemaVersion,-            appBuild: document.appBuild,-            exportedAt: document.exportedAt,-            capabilityGate: document.capabilityGate,-            entryCount: document.entryCount,-            workCount: document.workCount-        )-        return BackupImportPlan(-            metadata: metadata, payload: .v4Archive(document.payload), counts: counts)-    }--    private static func planFromV5Archive(_ data: Data) throws -> BackupImportPlan {-        logger.debug("Decoding native Backup V5")-        let document: BackupV5Document-        do {-            document = try BackupV5Codec.decode(data)-        } catch {-            throw BackupImportError.decodingFailed(reason: String(describing: error))         }-        let counts = try validateV5(document.payload)-        let metadata = BackupImportMetadata(-            formatVersion: document.backupFormatVersion,-            schemaVersion: document.databaseSchemaVersion,-            appBuild: document.appBuild,-            exportedAt: document.exportedAt,-            capabilityGate: document.capabilityGate,-            entryCount: document.entryCount,-            workCount: document.workCount-        )-        return BackupImportPlan(-            metadata: metadata, payload: .v5Archive(document.payload), counts: counts)+        return try planFromArchive(data)     } -    private static func planFromV6Archive(_ data: Data) throws -> BackupImportPlan {-        logger.debug("Decoding native Backup V6")+    private static func planFromArchive(_ data: Data) throws -> BackupImportPlan {         let document: BackupV6Document         do {             document = try BackupV6Codec.decode(data)         } catch {             throw BackupImportError.decodingFailed(reason: String(describing: error))         }-        let counts = try validateV6(document.payload)+        let payload = BackupImportPayload(document.payload)+        let counts = try validate(payload)         let metadata = BackupImportMetadata(             formatVersion: document.backupFormatVersion,             schemaVersion: document.databaseSchemaVersion,@@ -288,44 +224,20 @@ public enum BackupImporter {             workCount: document.workCount         )         return BackupImportPlan(-            metadata: metadata, payload: .v6Archive(document.payload), counts: counts)-    }--    /// Materializes and V4-validates a prospective import graph entirely in-    /// memory, so a malformed composed tuple fails before any store or readiness-    /// marker can be touched.-    private static func validateV4(_ payload: BackupV4Payload) throws -> LibraryRecordCounts {-        do {-            return try LibraryRepository.validateImportPlanPayloadV4(payload)-        } catch {-            throw BackupImportError.validationFailed(-                reason: "prospective V4 graph failed validation: \(error)"-            )-        }+            metadata: metadata, payload: payload, counts: counts)     } -    /// The same gate over a 5/6 graph — the type list rides into the in-memory-    /// store with it, so a payload whose records contradict the schema fails here-    /// rather than at the commit.-    private static func validateV5(_ payload: BackupV5Payload) throws -> LibraryRecordCounts {+    /// Materializes and validates a prospective import graph entirely in memory,+    /// so a malformed composed tuple fails before any store or readiness marker+    /// can be touched. The characters, suppressions and type list ride into the+    /// in-memory store with the rest, so a payload whose records contradict the+    /// schema fails here rather than at the commit.+    private static func validate(_ payload: BackupImportPayload) throws -> LibraryRecordCounts {         do {-            return try LibraryRepository.validateImportPlanPayloadV5(payload)+            return try LibraryRepository.validateImportPlanPayload(payload)         } catch {             throw BackupImportError.validationFailed(-                reason: "prospective V5 graph failed validation: \(error)"-            )-        }-    }--    /// The same gate over a 6/7 graph. The characters, suppressions and coverage-    /// ride into the in-memory store with the rest, so a payload whose records-    /// contradict the schema fails here rather than at the commit.-    private static func validateV6(_ payload: BackupV6Payload) throws -> LibraryRecordCounts {-        do {-            return try LibraryRepository.validateImportPlanPayloadV6(payload)-        } catch {-            throw BackupImportError.validationFailed(-                reason: "prospective V6 graph failed validation: \(error)"+                reason: "prospective graph failed validation: \(error)"             )         }     }@@ -347,4 +259,3 @@ public enum BackupImporter {         return (format, schema)     } }-

diff --git a/Packages/AsterismCore/Sources/AsterismCore/BackupJSONCodecSupport.swift b/Packages/AsterismCore/Sources/AsterismCore/BackupJSONCodecSupport.swiftindex e1a7f6e..10228fe 100644--- a/Packages/AsterismCore/Sources/AsterismCore/BackupJSONCodecSupport.swift+++ b/Packages/AsterismCore/Sources/AsterismCore/BackupJSONCodecSupport.swift@@ -1,48 +1,119 @@ import Foundation  // Extracted from the retired `LegacyBackupV2Codec` when the 2/2 and 3/3 import-// paths were removed. Both helpers are used by the live `BackupV4Codec`: the+// paths were removed. Both helpers are used by the live `BackupV6Codec`: the // date formatter fixes the archive's timestamp encoding, and the duplicate-key // validator is what makes a decode strict rather than last-key-wins. //-// `BackupCanonicalJSON` joined them when 5/6 shipped: the canonical encoder-// settings, the checksum and the date coders are the same in both formats and-// have to stay that way, so they are stated once.+// `BackupCanonicalJSON` joined them when 5/6 shipped, back when two generations+// had to agree about them. One generation is left, and the canonical encoder+// settings, the checksum and the date coders still belong together: they are the+// file's validity, not a per-caller preference, so they stay stated once.++// MARK: - Codec Error++/// Everything that can go wrong reading or writing an archive, in one enum.+///+/// It used to be two: a format-neutral `BackupCodecError` for structural JSON+/// faults, and a per-generation `BackupVxCodecError` for the envelope and+/// reference refusals — three copies of the same nine cases, each with an+/// initializer relabelling the shared reference checks under its own name. One+/// generation is left, so the neutral name carries all of it and the+/// relabelling inits are gone.+///+/// **Every distinction the reader is shown survives** (Q7). The import sheet+/// displays `BackupImportError.description` verbatim, which wraps this type's+/// `description`, so checksum, shape, version, gate, count, reference and tuple+/// failures each still say which of those it was. What went is the "V4"/"V5"/"V6"+/// prefix, which duplicated the version pair the refusal already reports.+public enum BackupCodecError: Error, Equatable, Sendable, CustomStringConvertible {+    // Structural faults in the JSON itself, raised by+    // `DuplicateJSONKeyValidator` and `BackupArchiveShapeValidator`.+    case decodingFailed(reason: String)+    case encodingFailed(reason: String)+    case unknownKey(String)+    case duplicateKey(String)+    case missingKey(String)+    case invalidValue(key: String, reason: String)+    case trailingBytes++    // The envelope's own claims, checked against what the file holds.+    case invalidFormatVersion(Int)+    case invalidSchemaVersion(Int)+    case unsupportedGate(String)+    case countMismatch(field: String, expected: Int, actual: Int)+    case checksumMismatch(expected: String, actual: String)++    // The payload contradicting itself.+    case unresolvedReference(type: String, id: String, reference: String)+    case invalidStateTuple(type: String, id: String, reason: String)++    /// The shared record-level checks' finding, as a codec refusal.+    internal init(_ issue: BackupArchiveReferenceIssue) {+        switch issue {+        case .unresolvedReference(let type, let id, let reference):+            self = .unresolvedReference(type: type, id: id, reference: reference)+        case .invalidStateTuple(let type, let id, let reason):+            self = .invalidStateTuple(type: type, id: id, reason: reason)+        }+    }++    public var description: String {+        switch self {+        case .decodingFailed(let reason): "Backup decoding failed: \(reason)"+        case .encodingFailed(let reason): "Backup encoding failed: \(reason)"+        case .unknownKey(let key): "Unknown key in the backup: \(key)"+        case .duplicateKey(let key): "Duplicate key in the backup: \(key)"+        case .missingKey(let key): "Missing required backup key: \(key)"+        case .invalidValue(let key, let reason): "Invalid backup value for \(key): \(reason)"+        case .trailingBytes: "Trailing bytes after the backup document"+        case .invalidFormatVersion(let v): "Unsupported backup format version: \(v)"+        case .invalidSchemaVersion(let v): "Unsupported backup schema version: \(v)"+        case .unsupportedGate(let g): "Unsupported backup capability gate: \(g)"+        case .countMismatch(let field, let expected, let actual):+            "Backup \(field) mismatch: header says \(expected), payload has \(actual)"+        case .checksumMismatch(let expected, let actual):+            "Backup checksum mismatch: expected \(expected), computed \(actual)"+        case .unresolvedReference(let type, let id, let reference):+            "Backup \(type) \(id) has unresolved reference: \(reference)"+        case .invalidStateTuple(let type, let id, let reason):+            "Backup invalid \(type) tuple \(id): \(reason)"+        }+    }+}  // MARK: - Canonical Archive JSON -/// The bytes an archive is made of, spelled once for both shipped formats.+/// The bytes an archive is made of, spelled once for the shipped format. ///-/// Nothing here names a version, and nothing here may be varied per format: the-/// checksum is taken over the encoded payload and re-taken over a re-encode at-/// decode time, so the encoder settings *are* part of the file's validity. Two-/// copies of `.sortedKeys` is two chances for one of them to change.+/// Nothing here names a version, and nothing here may be varied per call site:+/// the checksum is taken over the encoded payload and re-taken over a re-encode+/// at decode time, so the encoder settings *are* part of the file's validity.+/// Two copies of `.sortedKeys` is two chances for one of them to change. internal enum BackupCanonicalJSON {      /// Deterministic bytes: sorted keys so a re-encode reproduces the checksum,     /// unescaped slashes so a URL reads as itself in the file.     static let outputFormatting: JSONEncoder.OutputFormatting = .canonical -    /// The encoder both codecs write with — envelope, payload, and the checksum+    /// The encoder the codec writes with — envelope, payload, and the checksum     /// re-encode alike.     ///-    /// The strategy is a parameter only so the 4/4 codec can pass its own named-    /// spelling of `encodeDate`; every caller passes the same behaviour.-    static func encoder(-        dateEncoding: JSONEncoder.DateEncodingStrategy = .custom(encodeDate)-    ) -> JSONEncoder {+    /// The date strategy used to be a parameter, so a second codec could pass+    /// its own named spelling of `encodeDate`. There is no second codec, and a+    /// caller that could vary the date encoding could write an archive whose+    /// checksum no re-encode reproduces, so it is fixed here.+    static func encoder() -> JSONEncoder {         let encoder = JSONEncoder()-        encoder.dateEncodingStrategy = dateEncoding+        encoder.dateEncodingStrategy = .custom(encodeDate)         encoder.outputFormatting = outputFormatting         return encoder     } -    /// The decoder both codecs read with.-    static func decoder(-        dateDecoding: JSONDecoder.DateDecodingStrategy = .custom(decodeDate)-    ) -> JSONDecoder {+    /// The decoder the codec reads with.+    static func decoder() -> JSONDecoder {         let decoder = JSONDecoder()-        decoder.dateDecodingStrategy = dateDecoding+        decoder.dateDecodingStrategy = .custom(decodeDate)         return decoder     } @@ -94,7 +165,7 @@ internal enum BackupArchiveDateFormatter { /// the live decode path: `BackupV4ShapeValidator` goes through /// `JSONSerialization`, which collapses duplicates without complaint, so this is /// the only thing standing between a two-`payload` archive and importing the-/// wrong one. It also enforces no-trailing-bytes. `BackupV4CodecTests` covers+/// wrong one. It also enforces no-trailing-bytes. `BackupV6ArchiveTests` covers /// both properties by editing encoded bytes directly — they cannot be reached /// through any `JSONSerialization` round-trip. internal struct DuplicateJSONKeyValidator {

diff --git a/Packages/AsterismCore/Sources/AsterismCore/BackupV2Types.swift b/Packages/AsterismCore/Sources/AsterismCore/BackupV2Types.swiftdeleted file mode 100644index 655b047..0000000--- a/Packages/AsterismCore/Sources/AsterismCore/BackupV2Types.swift+++ /dev/null@@ -1,73 +0,0 @@-import Foundation--// The V2 backup records stood here — `EntryRecord`, `WorkRecord`, `SiteRecord`,-// `TitlePatternRecord`, and the `LibraryBackupSnapshot` that bundled them. They-// existed for the snapshot `LibraryRepository.validateStore` handed to-// `V2LibraryValidator`, and they went out with both. The live 4/4 backup format-// has never shared them: `BackupV4Types` declares `BackupV4Entry` /-// `BackupV4Work` / `BackupV4Site` / `BackupV4TitlePattern`, and-// `BackupV4Exporter` builds those through its own `mapV4*Record` mappers.-//-// The two error types below outlive the records. `BackupCodecError` is live —-// `DuplicateJSONKeyValidator` throws it on the import path. Nothing throws-// `BackupValidationError` any more, but the app target still matches on it in-// `SettingsBackupModel`, so it stays until those arms are revisited.--/// Structural faults in an archive's JSON, raised by `DuplicateJSONKeyValidator`-/// and surfaced through `BackupImportError.decodingFailed` — which reaches the-/// reader on the import screen, so the wording is archive-generic rather than-/// naming a format version. The four cases the retired format-2 codec threw-/// (`encodingFailed`, `invalidFormatVersion`, `invalidSchemaVersion`,-/// `capabilityMismatch`) went with it; `BackupV4CodecError` carries the live-/// equivalents.-public enum BackupCodecError: Error, Equatable, Sendable, CustomStringConvertible {-    case decodingFailed(reason: String)-    case unknownKey(String)-    case duplicateKey(String)-    case missingKey(String)-    case invalidValue(key: String, reason: String)-    case trailingBytes--    public var description: String {-        switch self {-        case .decodingFailed(let reason): "Backup decoding failed: \(reason)"-        case .unknownKey(let key): "Unknown key in the backup: \(key)"-        case .duplicateKey(let key): "Duplicate key in the backup: \(key)"-        case .missingKey(let key): "Missing required backup key: \(key)"-        case .invalidValue(let key, let reason): "Invalid backup value for \(key): \(reason)"-        case .trailingBytes: "Trailing bytes after the backup document"-        }-    }-}--public enum BackupValidationError: Error, Equatable, Sendable, CustomStringConvertible {-    case duplicateID(type: String, id: UUID)-    case duplicateHostname(String)-    case unresolvedReference(type: String, id: UUID, referencedType: String, referencedID: UUID)-    case unresolvedHostname(type: String, id: String, hostname: String)-    case unresolvedProvenance(type: String, id: UUID, patternID: UUID, patternVersion: Int)-    case invalidActivePatternCount(hostname: String, count: Int)-    case invalidPatternDefinition(id: UUID, reason: String)-    case invalidStateTuple(type: String, id: String, reason: String)-    case snapshotMismatch(reason: String)--    public var description: String {-        switch self {-        case .duplicateID(let type, let id): "Duplicate \(type) ID: \(id)"-        case .duplicateHostname(let hostname): "Duplicate Site hostname: \(hostname)"-        case .unresolvedReference(let type, let id, let referencedType, let referencedID):-            "\(type) \(id) references missing \(referencedType) \(referencedID)"-        case .unresolvedHostname(let type, let id, let hostname):-            "\(type) \(id) references missing Site hostname \(hostname)"-        case .unresolvedProvenance(let type, let id, let patternID, let patternVersion):-            "\(type) \(id) references missing pattern \(patternID) version \(patternVersion)"-        case .invalidActivePatternCount(let hostname, let count):-            "Site \(hostname) has \(count) active patterns"-        case .invalidPatternDefinition(let id, let reason):-            "TitlePattern \(id) has an invalid definition: \(reason)"-        case .invalidStateTuple(let type, let id, let reason):-            "\(type) \(id) has an invalid state: \(reason)"-        case .snapshotMismatch(let reason): "Library snapshot mismatch: \(reason)"-        }-    }-}

diff --git a/Packages/AsterismCore/Sources/AsterismCore/BackupV4Codec.swift b/Packages/AsterismCore/Sources/AsterismCore/BackupV4Codec.swiftdeleted file mode 100644index c194a32..0000000--- a/Packages/AsterismCore/Sources/AsterismCore/BackupV4Codec.swift+++ /dev/null@@ -1,230 +0,0 @@-import Foundation--/// Strict Backup V4 codec (Req 5.2, Decision 2), and the only archive codec the-/// app has: canonical JSON, a SHA-256 checksum over the payload bytes,-/// entry/work counts, root-strict envelope validation, typed nested decode, and-/// a reference validator enforcing the closed tuple and Entry-state tables. The-/// shape was inherited from the format-3 codec, which has since been retired-/// along with the older import paths.-///-/// The capability gate is pinned to the literal `"m4"`. A V4 payload is frozen-/// the moment it ships; the codec must never stamp or accept a later gate even-/// after `AsterismCapabilities.current` advances again.-public enum BackupV4Codec {-    /// The historical capability gate for the 4/4 format. Pinned literally so a-    /// future `current` flip cannot change what a 4/4 backup declares.-    static let gate = "m4"--    // MARK: - Encode--    /// Encodes a complete V4 backup from the coherent snapshot. The exporter-    /// decode-validates the produced bytes before sharing.-    public static func encode(-        payload: BackupV4Payload,-        metadata: BackupV4Metadata-    ) throws -> Data {-        let encoder = BackupCanonicalJSON.encoder(dateEncoding: .custom(encodeV4Date))--        let payloadData = try encoder.encode(payload)-        let checksum = BackupCanonicalJSON.sha256Hex(payloadData)--        let document = BackupV4Document(-            appBuild: metadata.appBuild,-            exportedAt: metadata.exportedAt,-            capabilityGate: Self.gate,-            entryCount: payload.entries.count,-            workCount: payload.works.count,-            checksum: checksum,-            payload: payload-        )--        return try encoder.encode(document)-    }--    // MARK: - Decode--    /// Decodes and validates a Backup V4 document from JSON data. Validates:-    /// envelope format/schema, capability gate, duplicate keys, strict root-    /// shape, entry/work counts, payload checksum, and all references and tuples.-    public static func decode(_ data: Data) throws -> BackupV4Document {-        do {-            try DuplicateJSONKeyValidator.validate(data)-            try BackupV4ShapeValidator.validate(data)--            let document = try BackupCanonicalJSON.decoder(dateDecoding: .custom(decodeV4Date))-                .decode(BackupV4Document.self, from: data)--            guard document.backupFormatVersion == BackupV4Document.formatVersion else {-                throw BackupV4CodecError.invalidFormatVersion(document.backupFormatVersion)-            }-            guard document.databaseSchemaVersion == BackupV4Document.schemaVersion else {-                throw BackupV4CodecError.invalidSchemaVersion(document.databaseSchemaVersion)-            }-            guard document.capabilityGate == Self.gate else {-                throw BackupV4CodecError.unsupportedGate(document.capabilityGate)-            }--            guard document.entryCount == document.payload.entries.count else {-                throw BackupV4CodecError.countMismatch(-                    field: "entryCount",-                    expected: document.entryCount,-                    actual: document.payload.entries.count-                )-            }-            guard document.workCount == document.payload.works.count else {-                throw BackupV4CodecError.countMismatch(-                    field: "workCount",-                    expected: document.workCount,-                    actual: document.payload.works.count-                )-            }--            // Verify checksum: re-encode payload with the same settings.-            let payloadData = try BackupCanonicalJSON-                .encoder(dateEncoding: .custom(encodeV4Date))-                .encode(document.payload)-            let computedChecksum = BackupCanonicalJSON.sha256Hex(payloadData)-            guard document.checksum == computedChecksum else {-                throw BackupV4CodecError.checksumMismatch(-                    expected: document.checksum,-                    actual: computedChecksum-                )-            }--            try BackupV4ReferenceValidator.validate(payload: document.payload)--            return document-        } catch let error as BackupV4CodecError { throw error }-        catch let error as BackupCodecError { throw error }-        catch {-            throw BackupV4CodecError.decodingFailed(reason: String(describing: error))-        }-    }--    // MARK: - Utilities--    /// The 4/4 names for the archive's date coding. The *bodies* live in-    /// `BackupCanonicalJSON`, shared with 5/6, so the two formats cannot encode-    /// a timestamp differently. The names stay here because they name the-    /// archive format, which is one of the things a version number may-    /// legitimately name in this package — see `FrozenLibraryPathTests`.-    private static func encodeV4Date(_ date: Date, encoder: Encoder) throws {-        try BackupCanonicalJSON.encodeDate(date, encoder: encoder)-    }--    private static func decodeV4Date(_ decoder: Decoder) throws -> Date {-        try BackupCanonicalJSON.decodeDate(decoder)-    }-}--// MARK: - V4 Codec Error--public enum BackupV4CodecError: Error, Equatable, Sendable, CustomStringConvertible {-    case encodingFailed(reason: String)-    case decodingFailed(reason: String)-    case invalidFormatVersion(Int)-    case invalidSchemaVersion(Int)-    case unsupportedGate(String)-    case countMismatch(field: String, expected: Int, actual: Int)-    case checksumMismatch(expected: String, actual: String)-    case unresolvedReference(type: String, id: String, reference: String)-    case invalidStateTuple(type: String, id: String, reason: String)--    /// The shared record-level checks' finding, named as a 4/4 refusal.-    internal init(_ issue: BackupArchiveReferenceIssue) {-        switch issue {-        case .unresolvedReference(let type, let id, let reference):-            self = .unresolvedReference(type: type, id: id, reference: reference)-        case .invalidStateTuple(let type, let id, let reason):-            self = .invalidStateTuple(type: type, id: id, reason: reason)-        }-    }--    public var description: String {-        switch self {-        case .encodingFailed(let reason): "Backup V4 encoding failed: \(reason)"-        case .decodingFailed(let reason): "Backup V4 decoding failed: \(reason)"-        case .invalidFormatVersion(let v): "Backup V4 unsupported format version: \(v)"-        case .invalidSchemaVersion(let v): "Backup V4 unsupported schema version: \(v)"-        case .unsupportedGate(let g): "Backup V4 unsupported capability gate: \(g)"-        case .countMismatch(let field, let expected, let actual):-            "Backup V4 \(field) mismatch: header says \(expected), payload has \(actual)"-        case .checksumMismatch(let expected, let actual):-            "Backup V4 checksum mismatch: expected \(expected), computed \(actual)"-        case .unresolvedReference(let type, let id, let reference):-            "Backup V4 \(type) \(id) has unresolved reference: \(reference)"-        case .invalidStateTuple(let type, let id, let reason):-            "Backup V4 invalid \(type) tuple \(id): \(reason)"-        }-    }-}--// MARK: - V4 Metadata--public struct BackupV4Metadata: Sendable {-    public let appBuild: String-    public let exportedAt: Date--    public init(appBuild: String, exportedAt: Date) {-        self.appBuild = appBuild-        self.exportedAt = exportedAt-    }-}--// MARK: - V4 Shape Validator--/// Root-strict shape validation: the envelope root must carry exactly the-/// required keys; deeper shape is enforced by typed decoding and the reference-/// validator. Note this runs through `JSONSerialization`, which resolves a-/// duplicate key silently — `DuplicateJSONKeyValidator` is what rejects one, and-/// `decode` must keep running it first.-internal enum BackupV4ShapeValidator {-    static func validate(_ data: Data) throws {-        try BackupArchiveShapeValidator.validate(data)-    }-}--/// The envelope root both shipped archive formats declare: 5/6 kept 4/4's-/// envelope keys unchanged and put everything it adds inside `payload`, so-/// root-strictness is one rule rather than two copies that could drift.-internal enum BackupArchiveShapeValidator {-    static func validate(_ data: Data) throws {-        let object = try JSONSerialization.jsonObject(with: data)-        guard let root = object as? [String: Any] else {-            throw BackupCodecError.invalidValue(key: "$", reason: "expected object")-        }-        let required: Set<String> = [-            "backupFormatVersion", "databaseSchemaVersion", "appBuild",-            "exportedAt", "capabilityGate", "entryCount", "workCount",-            "checksum", "payload",-        ]-        if let unknown = Set(root.keys).subtracting(required).sorted().first {-            throw BackupCodecError.unknownKey("$.\(unknown)")-        }-        if let missing = required.subtracting(root.keys).sorted().first {-            throw BackupCodecError.missingKey("$.\(missing)")-        }-    }-}--// MARK: - V4 Reference Validator--/// Names the shared record-level checks as a 4/4 refusal-/// (`BackupArchiveReferenceChecks`). The body moved there when 5/6 arrived: the-/// two formats carry the same Entry, Site, TitlePattern and URLRule records, so-/// one body validates both and each codec says which format refused.-internal enum BackupV4ReferenceValidator {-    static func validate(payload: BackupV4Payload) throws {-        do {-            try BackupArchiveReferenceChecks.validate(-                entries: payload.entries,-                works: payload.works.map(\.referenceRecord),-                sites: payload.sites,-                titlePatterns: payload.titlePatterns,-                urlRules: payload.urlRules,-                formatLabel: "V4")-        } catch let issue as BackupArchiveReferenceIssue {-            throw BackupV4CodecError(issue)-        }-    }-}

diff --git a/Packages/AsterismCore/Sources/AsterismCore/BackupV4Types.swift b/Packages/AsterismCore/Sources/AsterismCore/BackupV4Types.swiftindex 5f9a423..9515cf2 100644--- a/Packages/AsterismCore/Sources/AsterismCore/BackupV4Types.swift+++ b/Packages/AsterismCore/Sources/AsterismCore/BackupV4Types.swift@@ -1,72 +1,16 @@ import Foundation -// MARK: - Backup V4 Document--/// The V4 backup envelope. Format version 4, schema version 4 (Req 5.2,-/// Decision 2). Carries the format-3 envelope shape — entry/work counts plus a-/// checksum over the canonical payload bytes — plus the composed rule set. It-/// was added as a new type rather than an edit to the format-3 document because-/// a shipped archive format is never redefined in place.-public struct BackupV4Document: Codable, Equatable, Sendable {-    public static let formatVersion = 4-    public static let schemaVersion = 4--    public let backupFormatVersion: Int-    public let databaseSchemaVersion: Int-    public let appBuild: String-    public let exportedAt: Date-    public let capabilityGate: String-    public let entryCount: Int-    public let workCount: Int-    public let checksum: String-    public let payload: BackupV4Payload--    public init(-        appBuild: String,-        exportedAt: Date,-        capabilityGate: String,-        entryCount: Int,-        workCount: Int,-        checksum: String,-        payload: BackupV4Payload-    ) {-        backupFormatVersion = Self.formatVersion-        databaseSchemaVersion = Self.schemaVersion-        self.appBuild = appBuild-        self.exportedAt = exportedAt-        self.capabilityGate = capabilityGate-        self.entryCount = entryCount-        self.workCount = workCount-        self.checksum = checksum-        self.payload = payload-    }-}--// MARK: - V4 Payload--public struct BackupV4Payload: Codable, Equatable, Sendable {-    public let entries: [BackupV4Entry]-    public let works: [BackupV4Work]-    public let sites: [BackupV4Site]-    public let titlePatterns: [BackupV4TitlePattern]-    public let urlRules: [BackupV4URLRule]--    public init(-        entries: [BackupV4Entry],-        works: [BackupV4Work],-        sites: [BackupV4Site],-        titlePatterns: [BackupV4TitlePattern],-        urlRules: [BackupV4URLRule]-    ) {-        self.entries = entries-        self.works = works-        self.sites = sites-        self.titlePatterns = titlePatterns-        self.urlRules = urlRules-    }-}--// MARK: - V4 Records+// The four records the 4/4 generation froze that the live 6/7 payload still+// carries verbatim (`BackupV6Types.swift`). They keep their historical prefix+// (Q13): they are the wire substrate of a shipped format, and renaming a record+// nothing about has changed is churn that would also break the "a shipped+// format is never redefined in place" reading of this file.+//+// The generation's own envelope — `BackupV4Document`, `BackupV4Payload`,+// `BackupV4Work` and `BackupV4Metadata` — went with the 4/4 read and write paths+// (Decision 2). What is left here is only what a 6/7 archive is made of.++// MARK: - Frozen Records  public struct BackupV4Entry: Codable, Equatable, Sendable {     public let id: UUID@@ -186,61 +130,6 @@ public struct BackupV4Entry: Codable, Equatable, Sendable {     } } -public struct BackupV4Work: Codable, Equatable, Sendable {-    public let id: UUID-    public let displayTitle: String-    public let lastParsedTitle: String?-    public let siteHostname: String-    public let urlIdentity: String?-    public let urlIdentityState: WorkURLIdentityState-    public let urlIdentityRuleID: UUID?-    public let urlIdentityRuleVersion: Int?-    public let workURL: String?-    public let genericNotes: String-    public let type: WorkType-    public let genreTags: [String]-    public let titleProvenance: TitleProvenance-    public let createdAt: Date-    public let modifiedAt: Date-    public let entryIDs: [UUID]--    public init(-        id: UUID,-        displayTitle: String,-        lastParsedTitle: String?,-        siteHostname: String,-        urlIdentity: String?,-        urlIdentityState: WorkURLIdentityState,-        urlIdentityRuleID: UUID?,-        urlIdentityRuleVersion: Int?,-        workURL: String?,-        genericNotes: String,-        type: WorkType,-        genreTags: [String],-        titleProvenance: TitleProvenance,-        createdAt: Date,-        modifiedAt: Date,-        entryIDs: [UUID]-    ) {-        self.id = id-        self.displayTitle = displayTitle-        self.lastParsedTitle = lastParsedTitle-        self.siteHostname = siteHostname-        self.urlIdentity = urlIdentity-        self.urlIdentityState = urlIdentityState-        self.urlIdentityRuleID = urlIdentityRuleID-        self.urlIdentityRuleVersion = urlIdentityRuleVersion-        self.workURL = workURL-        self.genericNotes = genericNotes-        self.type = type-        self.genreTags = genreTags-        self.titleProvenance = titleProvenance-        self.createdAt = createdAt-        self.modifiedAt = modifiedAt-        self.entryIDs = entryIDs-    }-}- /// The V4 Site record. Drops the M3 `titleInterpretation` column and the /// site-level `workTitleTrimRule` (absorbed into the title rule's trims, Req /// 3.1, 5.1); everything else mirrors the V3 Site.

diff --git a/Packages/AsterismCore/Sources/AsterismCore/BackupV5Codec.swift b/Packages/AsterismCore/Sources/AsterismCore/BackupV5Codec.swiftdeleted file mode 100644index ae0ebba..0000000--- a/Packages/AsterismCore/Sources/AsterismCore/BackupV5Codec.swift+++ /dev/null@@ -1,218 +0,0 @@-import Foundation--/// The strict 5/6 archive codec: canonical JSON, a SHA-256 checksum over the-/// payload bytes, entry/work counts, root-strict envelope validation, typed-/// nested decode, and a reference validator over the shared record checks plus-/// this format's type-list rules.-///-/// Cloned from `BackupV4Codec` rather than grown out of it — a shipped archive-/// format is never redefined in place. What the two share is the *record-level*-/// checking body (`BackupArchiveReferenceChecks`) and the envelope shape-/// (`BackupArchiveShapeValidator`), which are the same rules over the same-/// records; what is restated here is everything that names a version.-///-/// The capability gate is pinned to the literal `"m4"`, for the reason the 4/4-/// codec pins it: the payload is frozen the moment it ships, and a later-/// `AsterismCapabilities.current` must not change what a 5/6 backup declares.-public enum BackupV5Codec {-    /// Pinned literally. The 5/6 format ships at the m4 gate; a future gate flip-    /// cannot retroactively change what these files say.-    static let gate = "m4"--    // MARK: - Encode--    public static func encode(-        payload: BackupV5Payload,-        metadata: BackupV5Metadata-    ) throws -> Data {-        let encoder = BackupCanonicalJSON.encoder()--        let payloadData = try encoder.encode(payload)-        let checksum = BackupCanonicalJSON.sha256Hex(payloadData)--        let document = BackupV5Document(-            appBuild: metadata.appBuild,-            exportedAt: metadata.exportedAt,-            capabilityGate: Self.gate,-            entryCount: payload.entries.count,-            workCount: payload.works.count,-            checksum: checksum,-            payload: payload-        )--        return try encoder.encode(document)-    }--    // MARK: - Decode--    /// Decodes and validates a 5/6 document. Validates: envelope format/schema,-    /// capability gate, duplicate keys, strict root shape, entry/work counts,-    /// payload checksum, and all references and tuples.-    ///-    /// The version pair is exact. `(5, 5)` and `(6, 6)` are rejected here, not-    /// only at the importer's dispatch: a mismatched pair is a file this codec-    /// cannot claim to understand whichever door it arrived through.-    public static func decode(_ data: Data) throws -> BackupV5Document {-        do {-            try DuplicateJSONKeyValidator.validate(data)-            try BackupV5ShapeValidator.validate(data)--            let document = try BackupCanonicalJSON.decoder()-                .decode(BackupV5Document.self, from: data)--            guard document.backupFormatVersion == BackupV5Document.formatVersion else {-                throw BackupV5CodecError.invalidFormatVersion(document.backupFormatVersion)-            }-            guard document.databaseSchemaVersion == BackupV5Document.schemaVersion else {-                throw BackupV5CodecError.invalidSchemaVersion(document.databaseSchemaVersion)-            }-            guard document.capabilityGate == Self.gate else {-                throw BackupV5CodecError.unsupportedGate(document.capabilityGate)-            }--            guard document.entryCount == document.payload.entries.count else {-                throw BackupV5CodecError.countMismatch(-                    field: "entryCount",-                    expected: document.entryCount,-                    actual: document.payload.entries.count-                )-            }-            guard document.workCount == document.payload.works.count else {-                throw BackupV5CodecError.countMismatch(-                    field: "workCount",-                    expected: document.workCount,-                    actual: document.payload.works.count-                )-            }--            // Verify checksum: re-encode payload with the same settings.-            let payloadData = try BackupCanonicalJSON.encoder().encode(document.payload)-            let computedChecksum = BackupCanonicalJSON.sha256Hex(payloadData)-            guard document.checksum == computedChecksum else {-                throw BackupV5CodecError.checksumMismatch(-                    expected: document.checksum,-                    actual: computedChecksum-                )-            }--            try BackupV5ReferenceValidator.validate(payload: document.payload)--            return document-        } catch let error as BackupV5CodecError { throw error }-        catch let error as BackupCodecError { throw error }-        catch {-            throw BackupV5CodecError.decodingFailed(reason: String(describing: error))-        }-    }--}--// MARK: - V5 Codec Error--public enum BackupV5CodecError: Error, Equatable, Sendable, CustomStringConvertible {-    case encodingFailed(reason: String)-    case decodingFailed(reason: String)-    case invalidFormatVersion(Int)-    case invalidSchemaVersion(Int)-    case unsupportedGate(String)-    case countMismatch(field: String, expected: Int, actual: Int)-    case checksumMismatch(expected: String, actual: String)-    case unresolvedReference(type: String, id: String, reference: String)-    case invalidStateTuple(type: String, id: String, reason: String)--    /// The shared record-level checks' finding, named as a 5/6 refusal.-    internal init(_ issue: BackupArchiveReferenceIssue) {-        switch issue {-        case .unresolvedReference(let type, let id, let reference):-            self = .unresolvedReference(type: type, id: id, reference: reference)-        case .invalidStateTuple(let type, let id, let reason):-            self = .invalidStateTuple(type: type, id: id, reason: reason)-        }-    }--    public var description: String {-        switch self {-        case .encodingFailed(let reason): "Backup V5 encoding failed: \(reason)"-        case .decodingFailed(let reason): "Backup V5 decoding failed: \(reason)"-        case .invalidFormatVersion(let v): "Backup V5 unsupported format version: \(v)"-        case .invalidSchemaVersion(let v): "Backup V5 unsupported schema version: \(v)"-        case .unsupportedGate(let g): "Backup V5 unsupported capability gate: \(g)"-        case .countMismatch(let field, let expected, let actual):-            "Backup V5 \(field) mismatch: header says \(expected), payload has \(actual)"-        case .checksumMismatch(let expected, let actual):-            "Backup V5 checksum mismatch: expected \(expected), computed \(actual)"-        case .unresolvedReference(let type, let id, let reference):-            "Backup V5 \(type) \(id) has unresolved reference: \(reference)"-        case .invalidStateTuple(let type, let id, let reason):-            "Backup V5 invalid \(type) tuple \(id): \(reason)"-        }-    }-}--// MARK: - V5 Metadata--public struct BackupV5Metadata: Sendable {-    public let appBuild: String-    public let exportedAt: Date--    public init(appBuild: String, exportedAt: Date) {-        self.appBuild = appBuild-        self.exportedAt = exportedAt-    }-}--// MARK: - V5 Shape Validator--/// Root-strict envelope validation, over the shape both formats share.-internal enum BackupV5ShapeValidator {-    static func validate(_ data: Data) throws {-        try BackupArchiveShapeValidator.validate(data)-    }-}--// MARK: - V5 Reference Validator--/// The shared record checks, plus the two things only 5/6 carries: the type list-/// and the works' references into it.-///-/// **What it deliberately does not do.** It does not refuse a `workTypeID` or a-/// `canonicalID` naming an entry the list lacks: the live library tolerates an-/// unresolved assignment as a rendered state rather than corruption-/// ([8.6](../../../../specs/configurable-work-types/requirements.md#8.6)), and an-/// archive that refused over one would break-/// [7.1](../../../../specs/configurable-work-types/requirements.md#7.1) for-/// exactly the reader whose sync has not settled (Q24). Nor does it constrain-/// `legacyType` to the closed `WorkType` set (Q34), nor require a `merged` entry-/// to name a target: the fold produces a target-less merged identity when no-/// merged row carries one (Q40), and the chase answers for it anyway.-///-/// What it does refuse is a payload that contradicts itself: two records for one-/// type identity — the exporter folds, so a duplicate id means the file was not-/// written by this exporter and the import's id-matching would be ambiguous —-/// and a work claiming both a configured type and a legacy one.-internal enum BackupV5ReferenceValidator {-    static func validate(payload: BackupV5Payload) throws {-        do {-            try BackupArchiveReferenceChecks.validate(-                entries: payload.entries,-                works: payload.works.map(\.referenceRecord),-                sites: payload.sites,-                titlePatterns: payload.titlePatterns,-                urlRules: payload.urlRules,-                formatLabel: "V5")-        } catch let issue as BackupArchiveReferenceIssue {-            throw BackupV5CodecError(issue)-        }--        let typeIDs = Set(payload.workTypes.map(\.id))-        guard typeIDs.count == payload.workTypes.count else {-            throw BackupV5CodecError.invalidStateTuple(-                type: "Payload", id: "V5", reason: "duplicate work type ID")-        }-        for work in payload.works where work.workTypeID != nil && work.legacyType != nil {-            throw BackupV5CodecError.invalidStateTuple(-                type: "Work", id: work.id.uuidString,-                reason: "a work carries a configured type or a legacy value, never both")-        }-    }-}

diff --git a/Packages/AsterismCore/Sources/AsterismCore/BackupV5Exporter.swift b/Packages/AsterismCore/Sources/AsterismCore/BackupV5Exporter.swiftdeleted file mode 100644index d0768f5..0000000--- a/Packages/AsterismCore/Sources/AsterismCore/BackupV5Exporter.swift+++ /dev/null@@ -1,291 +0,0 @@-import Foundation-import SwiftData--// MARK: - V5 Snapshot Providing--/// Provides one coherent 5/6 payload under a shared lock. Isolated from-/// persistence so export can be unit-tested with injected snapshots.-public protocol BackupV5SnapshotProviding: Sendable {-    func backupV5Snapshot() async throws -> BackupV5Payload-}--// MARK: - V5 Export Errors--/// The 5/6 export's refusals. The same four states the 4/4 export names — the-/// refusals are facts about the library, not the format — restated under this-/// format's name so a reader is told which export declined.-///-/// One 4/4 refusal is deliberately absent from the 5/6 path in practice rather-/// than from the enum: `unrepresentableValue` no longer fires on a work's type.-/// The 5/6 record carries any stored raw verbatim (Q34), the projection half of-/// [7.1](../../../../specs/configurable-work-types/requirements.md#7.1) —-/// "export succeeds for works of any type". The other half is upstream:-/// `snapshot(_ work:)` still refuses an unrecognised `typeRaw` until task 8.2-/// (Decision 5) removes that throw, so 7.1 holds only once both halves land.-public enum BackupV5ExportError: Error, Equatable, Sendable, CustomStringConvertible {-    /// The store holds a **torn** identity group: one application UUID over rows-    /// that disagree about something the reader wrote.-    case tornGroups(TornGroupsPayload)-    /// A record holds a stored value the wire format cannot represent.-    case unrepresentableValue(record: String, field: String, value: String)-    /// A record cites a rule no row in the library holds. Transient by nature.-    case referencesStillArriving(detail: String)--    case snapshotFailed(reason: String)-    case encodingFailed(reason: String)-    case stagingFailed(reason: String)--    /// The shared projection's refusal, named as a 5/6 refusal. The projection-    /// is one body for both formats, so its findings arrive spelled 4/4.-    internal init(_ error: BackupV4ExportError) {-        switch error {-        case .tornGroups(let payload): self = .tornGroups(payload)-        case .unrepresentableValue(let record, let field, let value):-            self = .unrepresentableValue(record: record, field: field, value: value)-        case .referencesStillArriving(let detail): self = .referencesStillArriving(detail: detail)-        case .snapshotFailed(let reason): self = .snapshotFailed(reason: reason)-        case .encodingFailed(let reason): self = .encodingFailed(reason: reason)-        case .stagingFailed(let reason): self = .stagingFailed(reason: reason)-        }-    }--    public var description: String {-        switch self {-        case .tornGroups(let payload):-            payload.count == 1-                ? "Backup export refused: 1 record exists in differing copies, and a "-                    + "backup cannot hold both"-                : "Backup export refused: \(payload.count) records exist in differing "-                    + "copies, and a backup cannot hold them all"-        case .unrepresentableValue(let record, let field, let value):-            "Backup export refused: \(record) holds \(field) '\(value)', which this "-                + "backup format cannot represent — it was probably written by a newer "-                + "version of Asterism"-        case .referencesStillArriving(let detail):-            "Backup export refused: records are still arriving from iCloud (\(detail)). "-                + "Try again once syncing has settled"-        case .snapshotFailed(let reason): "Backup V5 snapshot failed: \(reason)"-        case .encodingFailed(let reason): "Backup V5 encoding failed: \(reason)"-        case .stagingFailed(let reason): "Backup V5 staging failed: \(reason)"-        }-    }-}--// MARK: - LibraryRepository V5 Snapshot--extension LibraryRepository: BackupV5SnapshotProviding {-    /// Provides a coherent 5/6 backup payload under a shared lock.-    public func backupV5Snapshot() async throws -> BackupV5Payload {-        let outcome: Result<BackupV5Payload, BackupV5ExportError> =-            try await withLockedBackupContext { context in-                do { return .success(try Self.projectV5Payload(context: context)) }-                catch let error as BackupV5ExportError { return .failure(error) }-                catch let error as BackupV4ExportError { return .failure(BackupV5ExportError(error)) }-            }-        return try outcome.get()-    }--    /// The whole 5/6 snapshot, from a context.-    ///-    /// Everything but the type list and the Work records is-    /// `projectCommonArchiveRecords`, which is what keeps a 5/6 and a 4/4 backup-    /// of one library describing one library.-    internal static func projectV5Payload(context: ModelContext) throws -> BackupV5Payload {-        try projectV5Payload(from: context).payload-    }--    /// The same, keeping the common projection.-    ///-    /// 6/7 is 5/6 plus three character arrays, and every input it needs — the-    /// character groups, the work groups, the entry groups — is already in-    /// `common`. Re-deriving them (a second whole-table fetch of characters, and-    /// a third of works and entries for the coverage pairs) made one export walk-    /// the library twice and gave the two walks two chances to describe two-    /// moments.-    internal static func projectV5Payload(-        from context: ModelContext-    ) throws -> (payload: BackupV5Payload, common: ArchiveCommonProjection) {-        let common: ArchiveCommonProjection-        do {-            // No type refusal (Req 7.1): a raw value outside the closed set is-            // legal data now, and the 5/6 Work record carries it verbatim.-            common = try projectCommonArchiveRecords(-                context: context, refusingUnrepresentableWorkTypes: false)-        } catch let error as BackupV4ExportError {-            throw BackupV5ExportError(error)-        }--        // Req 7.2 and Q32: the **folded** list, one record per identity. Rows-        // sharing a UUID are a normal permanent state in the live store — the-        // strict duplicate arm applies to materialized archives, which is what-        // this fold produces. `identities` is ordered by identifier, so two-        // devices holding the same rows write the same bytes.-        let directory = common.groups.types-        let workTypes = directory.identities.map {-            BackupV5WorkTypeRecord(-                id: $0.id, name: $0.name, stateRaw: $0.state.rawValue,-                canonicalID: $0.canonicalID, createdAt: $0.createdAt,-                modifiedAt: $0.modifiedAt)-        }--        let payload = BackupV5Payload(-            entries: common.entries,-            works: try common.groups.works.map {-                try mapV5WorkRecord(-                    $0, canonicalWorkIDs: common.groups.canonicalWorkIDs,-                    rewrites: common.rewrites, types: directory)-            },-            sites: common.sites,-            titlePatterns: common.titlePatterns,-            urlRules: common.urlRules,-            workTypes: workTypes-        )-        do {-            try requireCitationsResolve(-                entries: payload.entries,-                workIdentityRules: payload.works.map { ($0.id, $0.urlIdentityRuleID) },-                titlePatternIDs: Set(payload.titlePatterns.map(\.id)),-                urlRuleIDs: Set(payload.urlRules.map(\.id)))-        } catch let error as BackupV4ExportError {-            throw BackupV5ExportError(error)-        }-        return (payload, common)-    }--    /// The 5/6 Work record. Identical to the 4/4 mapper but for the type-    /// columns, which come from the **carrier**'s assignment — the same row the-    /// rest of a group's authored content comes from.-    ///-    /// The stored `workTypeID` is written verbatim, never canonicalized: the-    /// archive carries the merged entries too, so the import's chase resolves a-    /// pointer at a non-surviving entry the same way this device's directory-    /// does. A pointer to an entry the library does not hold exports verbatim-    /// with `typeName: nil` (Q24) — refusing there would fail an export at-    /// exactly the moment sync has not settled.-    ///-    /// `typeName` is set for configured types only. A legacy or unrecognised-    /// value *is* its own label and travels in `legacyType`; a second copy of it-    /// would be a field that can disagree with the first.-    internal static func mapV5WorkRecord(-        _ group: WorkGroup,-        canonicalWorkIDs: [UUID: UUID],-        rewrites: [UUID: Int] = [:],-        types: WorkTypeDirectory-    ) throws -> BackupV5Work {-        let snap = try snapshot(group, canonicalWorkIDs: canonicalWorkIDs, types: types)-        let work = group.representative-        let assignment = WorkTypeAssignment.assignment(of: group.carrier)-        let workTypeID: UUID?-        let legacyType: String?-        let typeName: String?-        switch assignment {-        case .none:-            (workTypeID, legacyType, typeName) = (nil, nil, nil)-        case .configured(let id):-            (workTypeID, legacyType, typeName) = (id, nil, types.resolve(id)?.name)-        case .legacy(let raw), .unrecognised(let raw):-            (workTypeID, legacyType, typeName) = (nil, raw, nil)-        }-        return BackupV5Work(-            id: snap.id,-            displayTitle: snap.displayTitle,-            lastParsedTitle: snap.lastParsedTitle,-            siteHostname: snap.siteHostname,-            urlIdentity: snap.urlIdentity,-            urlIdentityState: work.urlIdentityState,-            urlIdentityRuleID: work.urlIdentityRuleID,-            urlIdentityRuleVersion: work.urlIdentityRuleID-                .flatMap { rewrites[$0] } ?? work.urlIdentityRuleVersion,-            workURL: snap.workURLString,-            genericNotes: snap.genericNotes,-            workTypeID: workTypeID,-            legacyType: legacyType,-            typeName: typeName,-            genreTags: snap.genreTags,-            titleProvenance: snap.titleProvenance,-            createdAt: snap.createdAt,-            modifiedAt: snap.modifiedAt,-            entryIDs: snap.entries.map(\.id)-                .sorted { $0.uuidString.lowercased() < $1.uuidString.lowercased() }-        )-    }-}--// MARK: - V5 Exporter--/// Orchestrates coherent 5/6 snapshot → validated encoding → staging.-///-/// It decode-validates its own bytes before sharing, so a produced file is-/// always a valid strict 5/6 document — the 4/4 exporter's contract, kept.-public final class BackupV5Exporter: Sendable {-    private let repository: any BackupV5SnapshotProviding-    private let stagingDirectory: URL--    public init(-        repository: any BackupV5SnapshotProviding,-        stagingDirectory: URL-    ) {-        self.repository = repository-        self.stagingDirectory = stagingDirectory-    }--    public func export(metadata: BackupV5Metadata) async throws -> BackupExportResult {-        let payload: BackupV5Payload-        do {-            payload = try await repository.backupV5Snapshot()-        } catch let error as BackupV5ExportError {-            throw error-        } catch let error as BackupV4ExportError {-            throw BackupV5ExportError(error)-        } catch {-            throw BackupV5ExportError.snapshotFailed(reason: String(describing: error))-        }--        let encoded: Data-        do {-            encoded = try BackupV5Codec.encode(payload: payload, metadata: metadata)-        } catch {-            throw BackupV5ExportError.encodingFailed(reason: String(describing: error))-        }--        do {-            let decoded = try BackupV5Codec.decode(encoded)-            guard decoded.payload == payload else {-                throw BackupV5ExportError.encodingFailed(reason: "decode-validation payload mismatch")-            }-        } catch let error as BackupV5ExportError {-            throw error-        } catch {-            throw BackupV5ExportError.encodingFailed(reason: "decode-validation failed: \(error)")-        }--        do {-            try FileManager.default.createDirectory(-                at: stagingDirectory, withIntermediateDirectories: true)-            let fileURL = stagingDirectory.appending(-                path: ExportStaging.backupFilename(-                    version: "v5", exportedAt: metadata.exportedAt))-            do {-                try ExportStaging.write(encoded, to: fileURL)-            } catch {-                throw BackupV5ExportError.stagingFailed(reason: String(describing: error))-            }-            return BackupExportResult(fileURL: fileURL)-        } catch let error as BackupV5ExportError {-            throw error-        } catch {-            throw BackupV5ExportError.stagingFailed(-                reason: "preparing staging directory failed: \(error)")-        }-    }--    public func cleanup(_ result: BackupExportResult) {-        try? FileManager.default.removeItem(at: result.fileURL)-    }--    /// Removes abandoned backup files older than 24 hours from the staging area,-    /// which still covers the 4/4 files a previous build staged.-    public func scavengeStaleFiles() {-        ExportStaging.scavengeBackups(in: stagingDirectory)-    }-}

diff --git a/Packages/AsterismCore/Sources/AsterismCore/BackupV5Types.swift b/Packages/AsterismCore/Sources/AsterismCore/BackupV5Types.swiftindex 194cda6..fe0627e 100644--- a/Packages/AsterismCore/Sources/AsterismCore/BackupV5Types.swift+++ b/Packages/AsterismCore/Sources/AsterismCore/BackupV5Types.swift@@ -1,94 +1,13 @@ import Foundation -// MARK: - Backup V5 Document+// The two records the 5/6 generation froze that the live 6/7 payload still+// carries verbatim (`BackupV6Types.swift`). They keep their historical prefix+// for the reason the 4/4 records do (Q13).+//+// The generation's own envelope — `BackupV5Document`, `BackupV5Payload` and+// `BackupV5Metadata` — went with the 5/6 read and write paths (Decision 2). -/// The 5/6 backup envelope: format version 5 over schema version 6-/// (`configurable-work-types` Req 7.6, Q8).-///-/// A new document type rather than an edit to the 4/4 one, because a shipped-/// archive format is never redefined in place — the same reason format 4 was-/// added beside format 3. Pre-feature builds meet the `(5, 6)` pair in their-/// importer's default arm and refuse it before touching the library-/// ([7.6](../../../../specs/configurable-work-types/requirements.md#7.6)).-///-/// The envelope keys are 4/4's, unchanged. Everything this format adds is inside-/// `payload`.-public struct BackupV5Document: Codable, Equatable, Sendable {-    public static let formatVersion = 5-    public static let schemaVersion = 6--    public let backupFormatVersion: Int-    public let databaseSchemaVersion: Int-    public let appBuild: String-    public let exportedAt: Date-    public let capabilityGate: String-    public let entryCount: Int-    public let workCount: Int-    public let checksum: String-    public let payload: BackupV5Payload--    public init(-        appBuild: String,-        exportedAt: Date,-        capabilityGate: String,-        entryCount: Int,-        workCount: Int,-        checksum: String,-        payload: BackupV5Payload-    ) {-        backupFormatVersion = Self.formatVersion-        databaseSchemaVersion = Self.schemaVersion-        self.appBuild = appBuild-        self.exportedAt = exportedAt-        self.capabilityGate = capabilityGate-        self.entryCount = entryCount-        self.workCount = workCount-        self.checksum = checksum-        self.payload = payload-    }-}--// MARK: - V5 Payload--/// 4/4's five arrays plus the configured type list.-///-/// The Entry, Site, TitlePattern and URLRule records are the 4/4 records-/// *themselves*, not clones: 5/6 changes the Work record's type columns and adds-/// `workTypes`, and nothing else. Cloning four unchanged record types would have-/// produced two definitions of one wire shape with no way to notice them-/// drifting apart; the 4/4 records are frozen, so sharing them cannot drag a-/// later 4/4 edit into this format.-public struct BackupV5Payload: Codable, Equatable, Sendable {-    public let entries: [BackupV4Entry]-    public let works: [BackupV5Work]-    public let sites: [BackupV4Site]-    public let titlePatterns: [BackupV4TitlePattern]-    public let urlRules: [BackupV4URLRule]-    /// The **full** configured type list, including entries no work uses and-    /// entries in every state — `merged` included, so importing an archive can-    /// never resurrect a non-surviving entry-    /// ([7.2](../../../../specs/configurable-work-types/requirements.md#7.2),-    /// [6.3](../../../../specs/configurable-work-types/requirements.md#6.3)).-    public let workTypes: [BackupV5WorkTypeRecord]--    public init(-        entries: [BackupV4Entry],-        works: [BackupV5Work],-        sites: [BackupV4Site],-        titlePatterns: [BackupV4TitlePattern],-        urlRules: [BackupV4URLRule],-        workTypes: [BackupV5WorkTypeRecord]-    ) {-        self.entries = entries-        self.works = works-        self.sites = sites-        self.titlePatterns = titlePatterns-        self.urlRules = urlRules-        self.workTypes = workTypes-    }-}--// MARK: - V5 Records+// MARK: - Frozen Records  /// One entry of the configured type list, as the exporter's fold produced it. ///

diff --git a/Packages/AsterismCore/Sources/AsterismCore/BackupV6Codec.swift b/Packages/AsterismCore/Sources/AsterismCore/BackupV6Codec.swiftindex 0596045..7462bf9 100644--- a/Packages/AsterismCore/Sources/AsterismCore/BackupV6Codec.swift+++ b/Packages/AsterismCore/Sources/AsterismCore/BackupV6Codec.swift@@ -5,15 +5,17 @@ import Foundation /// nested decode, and a reference validator over the shared record checks plus /// this generation's own rules. ///-/// Cloned from `BackupV5Codec` rather than grown out of it — a shipped archive-/// format is never redefined in place. What the generations share is the-/// *record-level* checking body (`BackupArchiveReferenceChecks`), the envelope-/// shape (`BackupArchiveShapeValidator`) and the canonical JSON settings; what is-/// restated here is everything that names a version.+/// The only codec. It was cloned from the 5/6 one rather than grown out of it —+/// a shipped archive format is never redefined in place — and the generations it+/// stood beside have since been retired end to end (Decision 2). What it still+/// shares with nothing in particular, because there is nothing else, is stated+/// once beside it: the record-level checking body+/// (`BackupArchiveReferenceChecks`), the envelope shape+/// (`BackupArchiveShapeValidator`) and the canonical JSON settings. ///-/// The capability gate is pinned to the literal `"m4"`, for the reason 4/4 and-/// 5/6 pin it: the payload is frozen the moment it ships, and a later-/// `AsterismCapabilities.current` must not change what a 6/7 backup declares.+/// The capability gate is pinned to the literal `"m4"`: the payload is frozen+/// the moment it ships, and a later `AsterismCapabilities.current` must not+/// change what a 6/7 backup declares. public enum BackupV6Codec {     /// Pinned literally. 6/7 ships at the m4 gate; a future gate flip cannot     /// retroactively change what these files say.@@ -55,30 +57,30 @@ public enum BackupV6Codec {     public static func decode(_ data: Data) throws -> BackupV6Document {         do {             try DuplicateJSONKeyValidator.validate(data)-            try BackupV6ShapeValidator.validate(data)+            try BackupArchiveShapeValidator.validate(data)              let document = try BackupCanonicalJSON.decoder()                 .decode(BackupV6Document.self, from: data)              guard document.backupFormatVersion == BackupV6Document.formatVersion else {-                throw BackupV6CodecError.invalidFormatVersion(document.backupFormatVersion)+                throw BackupCodecError.invalidFormatVersion(document.backupFormatVersion)             }             guard document.databaseSchemaVersion == BackupV6Document.schemaVersion else {-                throw BackupV6CodecError.invalidSchemaVersion(document.databaseSchemaVersion)+                throw BackupCodecError.invalidSchemaVersion(document.databaseSchemaVersion)             }             guard document.capabilityGate == Self.gate else {-                throw BackupV6CodecError.unsupportedGate(document.capabilityGate)+                throw BackupCodecError.unsupportedGate(document.capabilityGate)             }              guard document.entryCount == document.payload.entries.count else {-                throw BackupV6CodecError.countMismatch(+                throw BackupCodecError.countMismatch(                     field: "entryCount",                     expected: document.entryCount,                     actual: document.payload.entries.count                 )             }             guard document.workCount == document.payload.works.count else {-                throw BackupV6CodecError.countMismatch(+                throw BackupCodecError.countMismatch(                     field: "workCount",                     expected: document.workCount,                     actual: document.payload.works.count@@ -89,7 +91,7 @@ public enum BackupV6Codec {             let payloadData = try BackupCanonicalJSON.encoder().encode(document.payload)             let computedChecksum = BackupCanonicalJSON.sha256Hex(payloadData)             guard document.checksum == computedChecksum else {-                throw BackupV6CodecError.checksumMismatch(+                throw BackupCodecError.checksumMismatch(                     expected: document.checksum,                     actual: computedChecksum                 )@@ -98,52 +100,9 @@ public enum BackupV6Codec {             try BackupV6ReferenceValidator.validate(payload: document.payload)              return document-        } catch let error as BackupV6CodecError { throw error }-        catch let error as BackupCodecError { throw error }+        } catch let error as BackupCodecError { throw error }         catch {-            throw BackupV6CodecError.decodingFailed(reason: String(describing: error))-        }-    }-}--// MARK: - V6 Codec Error--public enum BackupV6CodecError: Error, Equatable, Sendable, CustomStringConvertible {-    case encodingFailed(reason: String)-    case decodingFailed(reason: String)-    case invalidFormatVersion(Int)-    case invalidSchemaVersion(Int)-    case unsupportedGate(String)-    case countMismatch(field: String, expected: Int, actual: Int)-    case checksumMismatch(expected: String, actual: String)-    case unresolvedReference(type: String, id: String, reference: String)-    case invalidStateTuple(type: String, id: String, reason: String)--    /// The shared record-level checks' finding, named as a 6/7 refusal.-    internal init(_ issue: BackupArchiveReferenceIssue) {-        switch issue {-        case .unresolvedReference(let type, let id, let reference):-            self = .unresolvedReference(type: type, id: id, reference: reference)-        case .invalidStateTuple(let type, let id, let reason):-            self = .invalidStateTuple(type: type, id: id, reason: reason)-        }-    }--    public var description: String {-        switch self {-        case .encodingFailed(let reason): "Backup V6 encoding failed: \(reason)"-        case .decodingFailed(let reason): "Backup V6 decoding failed: \(reason)"-        case .invalidFormatVersion(let v): "Backup V6 unsupported format version: \(v)"-        case .invalidSchemaVersion(let v): "Backup V6 unsupported schema version: \(v)"-        case .unsupportedGate(let g): "Backup V6 unsupported capability gate: \(g)"-        case .countMismatch(let field, let expected, let actual):-            "Backup V6 \(field) mismatch: header says \(expected), payload has \(actual)"-        case .checksumMismatch(let expected, let actual):-            "Backup V6 checksum mismatch: expected \(expected), computed \(actual)"-        case .unresolvedReference(let type, let id, let reference):-            "Backup V6 \(type) \(id) has unresolved reference: \(reference)"-        case .invalidStateTuple(let type, let id, let reason):-            "Backup V6 invalid \(type) tuple \(id): \(reason)"+            throw BackupCodecError.decodingFailed(reason: String(describing: error))         }     } }@@ -160,19 +119,43 @@ public struct BackupV6Metadata: Sendable {     } } -// MARK: - V6 Shape Validator+// MARK: - Shape Validator -/// Root-strict envelope validation, over the shape every generation shares.-internal enum BackupV6ShapeValidator {+/// Root-strict shape validation: the envelope root must carry exactly the+/// required keys; deeper shape is enforced by typed decoding and the reference+/// validator.+///+/// Note this runs through `JSONSerialization`, which resolves a duplicate key+/// silently — `DuplicateJSONKeyValidator` is what rejects one, and `decode` must+/// keep running it first.+///+/// It stood in `BackupV4Codec.swift` as the body two generations' shape+/// validators delegated to; one generation is left, so it is stated here once+/// rather than behind a `BackupV6ShapeValidator` that forwarded to it.+internal enum BackupArchiveShapeValidator {     static func validate(_ data: Data) throws {-        try BackupArchiveShapeValidator.validate(data)+        let object = try JSONSerialization.jsonObject(with: data)+        guard let root = object as? [String: Any] else {+            throw BackupCodecError.invalidValue(key: "$", reason: "expected object")+        }+        let required: Set<String> = [+            "backupFormatVersion", "databaseSchemaVersion", "appBuild",+            "exportedAt", "capabilityGate", "entryCount", "workCount",+            "checksum", "payload",+        ]+        if let unknown = Set(root.keys).subtracting(required).sorted().first {+            throw BackupCodecError.unknownKey("$.\(unknown)")+        }+        if let missing = required.subtracting(root.keys).sorted().first {+            throw BackupCodecError.missingKey("$.\(missing)")+        }     } }  // MARK: - V6 Reference Validator -/// The shared record checks, 5/6's type-list rules, and the three things only-/// 6/7 carries.+/// The shared record checks, the type-list rules, and the three character+/// arrays. /// /// **What it deliberately does not check.** A fact's `sourceEntryID` and a fact /// suppression's are exempt (Decision 2): a citation whose entry the reader@@ -198,16 +181,16 @@ internal enum BackupV6ReferenceValidator {                 urlRules: payload.urlRules,                 formatLabel: "V6")         } catch let issue as BackupArchiveReferenceIssue {-            throw BackupV6CodecError(issue)+            throw BackupCodecError(issue)         }          let typeIDs = Set(payload.workTypes.map(\.id))         guard typeIDs.count == payload.workTypes.count else {-            throw BackupV6CodecError.invalidStateTuple(+            throw BackupCodecError.invalidStateTuple(                 type: "Payload", id: "V6", reason: "duplicate work type ID")         }         for work in payload.works where work.workTypeID != nil && work.legacyType != nil {-            throw BackupV6CodecError.invalidStateTuple(+            throw BackupCodecError.invalidStateTuple(                 type: "Work", id: work.id.uuidString,                 reason: "a work carries a configured type or a legacy value, never both")         }@@ -217,11 +200,11 @@ internal enum BackupV6ReferenceValidator {         var characterIDs: Set<UUID> = []         for character in payload.characters {             guard characterIDs.insert(character.id).inserted else {-                throw BackupV6CodecError.invalidStateTuple(+                throw BackupCodecError.invalidStateTuple(                     type: "Payload", id: "V6", reason: "duplicate Character ID")             }             if let workID = character.workID, !workIDs.contains(workID) {-                throw BackupV6CodecError.unresolvedReference(+                throw BackupCodecError.unresolvedReference(                     type: "Character", id: character.id.uuidString, reference: "Work \(workID)")             }         }@@ -229,11 +212,11 @@ internal enum BackupV6ReferenceValidator {         var suppressionIDs: Set<UUID> = []         for suppression in payload.suppressions {             guard suppressionIDs.insert(suppression.id).inserted else {-                throw BackupV6CodecError.invalidStateTuple(+                throw BackupCodecError.invalidStateTuple(                     type: "Payload", id: "V6", reason: "duplicate CharacterSuppression ID")             }             if let workID = suppression.workID, !workIDs.contains(workID) {-                throw BackupV6CodecError.unresolvedReference(+                throw BackupCodecError.unresolvedReference(                     type: "CharacterSuppression", id: suppression.id.uuidString,                     reference: "Work \(workID)")             }@@ -242,13 +225,13 @@ internal enum BackupV6ReferenceValidator {         var coveredRevisions: Set<String> = []         for record in payload.coverage {             guard record.sourceKind != nil else {-                throw BackupV6CodecError.invalidStateTuple(+                throw BackupCodecError.invalidStateTuple(                     type: "Coverage", id: record.recordID.uuidString,                     reason: "unrecognised source kind '\(record.sourceKindRaw)'")             }             let key = "\(record.sourceKindRaw)\u{1F}\(record.recordID.uuidString.lowercased())"             guard coveredRevisions.insert(key).inserted else {-                throw BackupV6CodecError.invalidStateTuple(+                throw BackupCodecError.invalidStateTuple(                     type: "Coverage", id: record.recordID.uuidString,                     reason: "two fingerprints for one source revision")             }

diff --git a/Packages/AsterismCore/Sources/AsterismCore/BackupV6Exporter.swift b/Packages/AsterismCore/Sources/AsterismCore/BackupV6Exporter.swiftindex 0146307..3b85beb 100644--- a/Packages/AsterismCore/Sources/AsterismCore/BackupV6Exporter.swift+++ b/Packages/AsterismCore/Sources/AsterismCore/BackupV6Exporter.swift@@ -1,7 +1,7 @@ import Foundation import SwiftData -// MARK: - V6 Snapshot Providing+// MARK: - Snapshot Providing  /// Provides one coherent 6/7 payload under a shared lock. Isolated from /// persistence so export can be unit-tested with injected snapshots.@@ -9,57 +9,45 @@ public protocol BackupV6SnapshotProviding: Sendable {     func backupV6Snapshot() async throws -> BackupV6Payload } -// MARK: - V6 Export Errors+// MARK: - Export Errors -/// The 6/7 export's refusals — the same four states 5/6 names, restated under-/// this generation's name so a reader is told which export declined.+/// The export's refusals — the four states a backup can decline over, and the+/// three ways the machinery around it can fail. ///-/// `tornGroups` gains a member it did not have: a **character** group whose rows-/// disagree about something the reader wrote refuses the export exactly as a-/// torn Entry or Work does+/// One enum, not one per generation. It used to be three, each restating the+/// same six cases and each carrying an initializer that renamed another+/// generation's finding into its own; the projection had one body throwing 4/4's+/// spelling and every caller relabelled it. The distinctions a reader is shown+/// are all here (Q7) — what is gone is the per-generation prefix, which said+/// nothing the detected format pair does not already say.+///+/// `tornGroups` covers a **character** group whose rows disagree about something+/// the reader wrote exactly as it covers a torn Entry or Work /// ([6.5](../../../../specs/character-extraction/requirements.md#6.5)). What /// does *not* refuse is a fact whose citation dangles — Decision 2 makes that a /// tolerated state, so /// [6.2](../../../../specs/character-extraction/requirements.md#6.2) holds. public enum BackupV6ExportError: Error, Equatable, Sendable, CustomStringConvertible {     /// The store holds a **torn** identity group: one application UUID over rows-    /// that disagree about something the reader wrote.+    /// that disagree about something the reader wrote. The archive keys records+    /// by UUID and cannot hold both variants, and silently dropping one is data+    /// loss inside a backup.     case tornGroups(TornGroupsPayload)-    /// A record holds a stored value the wire format cannot represent.+    /// A record holds a stored value the wire format cannot represent —+    /// typically an enum raw value a newer app version wrote and synced down.+    /// Omitting the record is silent data loss; representing the value is a+    /// format change. So the record and the value are named and the export+    /// refuses.     case unrepresentableValue(record: String, field: String, value: String)-    /// A record cites a rule no row in the library holds. Transient by nature.+    /// A record cites a rule no row in the library holds, or a hostname whose+    /// projected tuple the format has no case for. Transient by nature: the+    /// missing row is en route.     case referencesStillArriving(detail: String)      case snapshotFailed(reason: String)     case encodingFailed(reason: String)     case stagingFailed(reason: String) -    /// The shared projection's refusal, named as a 6/7 refusal. The projection-    /// is one body for every generation, so its findings arrive spelled 4/4.-    internal init(_ error: BackupV4ExportError) {-        switch error {-        case .tornGroups(let payload): self = .tornGroups(payload)-        case .unrepresentableValue(let record, let field, let value):-            self = .unrepresentableValue(record: record, field: field, value: value)-        case .referencesStillArriving(let detail): self = .referencesStillArriving(detail: detail)-        case .snapshotFailed(let reason): self = .snapshotFailed(reason: reason)-        case .encodingFailed(let reason): self = .encodingFailed(reason: reason)-        case .stagingFailed(let reason): self = .stagingFailed(reason: reason)-        }-    }--    internal init(_ error: BackupV5ExportError) {-        switch error {-        case .tornGroups(let payload): self = .tornGroups(payload)-        case .unrepresentableValue(let record, let field, let value):-            self = .unrepresentableValue(record: record, field: field, value: value)-        case .referencesStillArriving(let detail): self = .referencesStillArriving(detail: detail)-        case .snapshotFailed(let reason): self = .snapshotFailed(reason: reason)-        case .encodingFailed(let reason): self = .encodingFailed(reason: reason)-        case .stagingFailed(let reason): self = .stagingFailed(reason: reason)-        }-    }-     public var description: String {         switch self {         case .tornGroups(let payload):@@ -75,47 +63,86 @@ public enum BackupV6ExportError: Error, Equatable, Sendable, CustomStringConvert         case .referencesStillArriving(let detail):             "Backup export refused: records are still arriving from iCloud (\(detail)). "                 + "Try again once syncing has settled"-        case .snapshotFailed(let reason): "Backup V6 snapshot failed: \(reason)"-        case .encodingFailed(let reason): "Backup V6 encoding failed: \(reason)"-        case .stagingFailed(let reason): "Backup V6 staging failed: \(reason)"+        case .snapshotFailed(let reason): "Backup snapshot failed: \(reason)"+        case .encodingFailed(let reason): "Backup encoding failed: \(reason)"+        case .stagingFailed(let reason): "Backup staging failed: \(reason)"         }     } } -// MARK: - LibraryRepository V6 Snapshot+// MARK: - LibraryRepository Snapshot  extension LibraryRepository: BackupV6SnapshotProviding {     /// Provides a coherent 6/7 backup payload under a shared lock.+    ///+    /// **The quarantine and unresolved gates are gone** (Req 3.1). They refused a+    /// file at exactly the moment one is most wanted: an ordinary sync quarantines+    /// a hostname or leaves 2,995 of 3,000 records holding an unresolved Site+    /// reference (Q25), and the backup tool then declined. What made removing them+    /// possible is `SiteUnionProjection` — duplicate rows project to one wire Site,+    /// rowless hostnames to a synthesised untaught one, and nil-site rules attach+    /// through their citers — so the snapshot is total over the ordinary sync+    /// states rather than merely permitted to try.+    ///+    /// Three refusals remain, each named: a torn identity group (3.3), a stored+    /// value the format cannot represent (3.6), and citations that do not+    /// resolve (3.7).+    ///+    /// Export never writes. The projection is computed read-side precisely so a+    /// backup cannot mutate the library on the way out (Q38); the archive it+    /// produces is nonetheless the shape reconciliation settles on, which is what+    /// makes Req 3.5's round-trip hold.     public func backupV6Snapshot() async throws -> BackupV6Payload {         let outcome: Result<BackupV6Payload, BackupV6ExportError> =             try await withLockedBackupContext { context in                 do { return .success(try Self.projectV6Payload(context: context)) }                 catch let error as BackupV6ExportError { return .failure(error) }-                catch let error as BackupV5ExportError { return .failure(BackupV6ExportError(error)) }-                catch let error as BackupV4ExportError { return .failure(BackupV6ExportError(error)) }             }         return try outcome.get()     } -    /// The whole 6/7 snapshot, from a context.+    /// The whole 6/7 snapshot, from a context. Static and pure so the projection+    /// can be exercised without an actor.     ///-    /// The six frozen arrays are 5/6's projection verbatim — the same body, so a-    /// 5/6 and a 6/7 backup of one library describe one library — and what is-    /// added here are the three character arrays, all three read from the same-    /// context under the same lock.+    /// **One projection pass.** `projectCommonArchiveRecords` already enumerated+    /// every character whole (Q78 — never works→children, so a sync orphan+    /// exports with a nil work reference instead of vanishing), already refused a+    /// torn group, and already sorted by UUID; the work and entry groups the+    /// coverage pairs need are the ones it built, under the same assignment+    /// normalisation (Q106). Re-deriving any of it would be a second walk of the+    /// two largest tables and a second chance to describe two moments.     internal static func projectV6Payload(context: ModelContext) throws -> BackupV6Payload {-        let frozen: BackupV5Payload-        let common: ArchiveCommonProjection-        do { (frozen, common) = try projectV5Payload(from: context) }-        catch let error as BackupV5ExportError { throw BackupV6ExportError(error) }-        catch let error as BackupV4ExportError { throw BackupV6ExportError(error) }+        let common = try projectCommonArchiveRecords(context: context)++        // Req 7.2 and Q32: the **folded** list, one record per identity. Rows+        // sharing a UUID are a normal permanent state in the live store — the+        // strict duplicate arm applies to materialized archives, which is what+        // this fold produces. `identities` is ordered by identifier, so two+        // devices holding the same rows write the same bytes.+        let directory = common.groups.types+        let workTypes = directory.identities.map {+            BackupV5WorkTypeRecord(+                id: $0.id, name: $0.name, stateRaw: $0.state.rawValue,+                canonicalID: $0.canonicalID, createdAt: $0.createdAt,+                modifiedAt: $0.modifiedAt)+        }++        let works = try common.groups.works.map {+            try mapV5WorkRecord(+                $0, canonicalWorkIDs: common.groups.canonicalWorkIDs,+                rewrites: common.rewrites, types: directory)+        }++        // Req 3.7: the archive's own reference validator refuses a citation that+        // does not resolve, and the import gates refuse such a file. Discovering+        // that inside export's verify-decode would surface a library-shape+        // problem as a codec error, so it is named here instead.+        try requireCitationsResolve(+            entries: common.entries,+            workIdentityRules: works.map { ($0.id, $0.urlIdentityRuleID) },+            titlePatternIDs: Set(common.titlePatterns.map(\.id)),+            urlRuleIDs: Set(common.urlRules.map(\.id))) -        // **One projection pass.** The shared projection already enumerated every-        // character whole (Q78 — never works→children, so a sync orphan exports-        // with a nil work reference instead of vanishing), already refused a torn-        // group, and already sorted by UUID. Re-fetching and re-grouping them-        // here was a second answer to a question with one answer, and the field-        // it duplicated was carried on every 4/4 and 5/6 export for nothing.         let characters = common.groups.characters.map(mapV6CharacterRecord)          let suppressions = try context.fetch(FetchDescriptor<CharacterSuppression>())@@ -123,12 +150,12 @@ extension LibraryRepository: BackupV6SnapshotProviding {             .sorted { $0.id.uuidString < $1.id.uuidString }          return BackupV6Payload(-            entries: frozen.entries,-            works: frozen.works,-            sites: frozen.sites,-            titlePatterns: frozen.titlePatterns,-            urlRules: frozen.urlRules,-            workTypes: frozen.workTypes,+            entries: common.entries,+            works: works,+            sites: common.sites,+            titlePatterns: common.titlePatterns,+            urlRules: common.urlRules,+            workTypes: workTypes,             characters: characters,             suppressions: suppressions,             coverage: projectV6Coverage(common.groups))@@ -169,12 +196,6 @@ extension LibraryRepository: BackupV6SnapshotProviding {     /// text: the archive is a snapshot of what the store holds, and the import     /// is where a stale pair is dropped (Q81). Read from the carrier row, which     /// is the row the group presents.-    ///-    /// Takes the shared projection rather than a context: the work and entry-    /// groups it needs are exactly the ones the export has already built, under-    /// the same assignment normalisation (Q106). Re-deriving them was a third-    /// walk of the two largest tables and a third chance to fold them-    /// differently.     private static func projectV6Coverage(         _ groups: BackupGroupProjection.Projection     ) -> [BackupV6Coverage] {@@ -197,12 +218,12 @@ extension LibraryRepository: BackupV6SnapshotProviding {     } } -// MARK: - V6 Exporter+// MARK: - The Exporter  /// Orchestrates coherent 6/7 snapshot → validated encoding → staging. ///-/// It decode-validates its own bytes before sharing, so a produced file is-/// always a valid strict 6/7 document — the 4/4 exporter's contract, kept.+/// The only exporter. It decode-validates its own bytes before sharing, so a+/// produced file is always a valid strict 6/7 document. public final class BackupV6Exporter: Sendable {     private let repository: any BackupV6SnapshotProviding     private let stagingDirectory: URL@@ -221,10 +242,6 @@ public final class BackupV6Exporter: Sendable {             payload = try await repository.backupV6Snapshot()         } catch let error as BackupV6ExportError {             throw error-        } catch let error as BackupV5ExportError {-            throw BackupV6ExportError(error)-        } catch let error as BackupV4ExportError {-            throw BackupV6ExportError(error)         } catch {             throw BackupV6ExportError.snapshotFailed(reason: String(describing: error))         }

diff --git a/Packages/AsterismCore/Sources/AsterismCore/BackupV6Types.swift b/Packages/AsterismCore/Sources/AsterismCore/BackupV6Types.swiftindex eac06fb..d9f46fc 100644--- a/Packages/AsterismCore/Sources/AsterismCore/BackupV6Types.swift+++ b/Packages/AsterismCore/Sources/AsterismCore/BackupV6Types.swift@@ -96,14 +96,6 @@ public struct BackupV6Payload: Codable, Equatable, Sendable {         self.suppressions = suppressions         self.coverage = coverage     }--    /// The same six arrays a 5/6 archive of this library would hold. What the-    /// import path reads when it is doing the work both generations share.-    public var frozenRecords: BackupV5Payload {-        BackupV5Payload(-            entries: entries, works: works, sites: sites, titlePatterns: titlePatterns,-            urlRules: urlRules, workTypes: workTypes)-    } }  // MARK: - V6 Records

diff --git a/Packages/AsterismCore/Sources/AsterismCore/DuplicateReconciler.swift b/Packages/AsterismCore/Sources/AsterismCore/DuplicateReconciler.swiftindex 29dbcf7..f82799f 100644--- a/Packages/AsterismCore/Sources/AsterismCore/DuplicateReconciler.swift+++ b/Packages/AsterismCore/Sources/AsterismCore/DuplicateReconciler.swift@@ -208,19 +208,21 @@ enum DuplicateReconciler {     ///     /// `scan` is derived by the caller inside the same locked context — derived,     /// never remembered, the rule the Site work list follows.+    ///+    /// - Parameter types: one fold for the whole pass, built by the caller and+    ///   shared with the scan. The caller builds it **after** the type phase, so+    ///   the directory this reads is the converged one — which is what lets the+    ///   carrier gate ask whether an entry is *active* (Req 8.4) rather than+    ///   whether it merely exists.     static func run(         scan: DuplicateScanResult,         ledger: inout DuplicateSettlingLedger,         batchSize: Int,         context: ModelContext,-        saveStrategy: any RepositorySaveStrategy+        saveStrategy: any RepositorySaveStrategy,+        types: WorkTypeDirectory     ) throws -> PassResult {         var result = PassResult()-        // One fold for the whole pass. The type phase has already run by the-        // time this does, so the directory this reads is the converged one —-        // which is what lets the carrier gate ask whether an entry is *active*-        // (Req 8.4) rather than whether it merely exists.-        let types = try LibraryRepository.workTypeDirectory(context: context)         // Character keys are retained like every other type's. Without them a         // pass would evict the settled state of every character set it just         // observed, and the next pass would treat each one as a first

diff --git a/Packages/AsterismCore/Sources/AsterismCore/DuplicateScan.swift b/Packages/AsterismCore/Sources/AsterismCore/DuplicateScan.swiftindex 181e6cc..35d501a 100644--- a/Packages/AsterismCore/Sources/AsterismCore/DuplicateScan.swift+++ b/Packages/AsterismCore/Sources/AsterismCore/DuplicateScan.swift@@ -179,17 +179,22 @@ public enum DuplicateScan {     /// inside a candidate component and skips every other row. Only those rows     /// need either: classification is a question about a set, and a row in no     /// set is in no set whatever it holds.+    ///+    /// This overload fetches the type table itself, because its callers run+    /// outside a reconciliation pass with no directory in hand (Q9). The pass+    /// uses the parameterised one below and hands both halves one fold.     public static func run(context: ModelContext) throws -> DuplicateScanResult {-        try run(context: context, ruleRows: nil)+        try run(+            context: context, ruleRows: nil,+            types: try LibraryRepository.workTypeDirectory(context: context))     } +    /// - Parameter types: the (small) type table, folded once by the caller, so+    ///   every `WorkAuthoredContent` this scan builds canonicalizes its+    ///   assignment through the same fold (Req 6.2, 8.5).     static func run(-        context: ModelContext, ruleRows: RuleRowSnapshot?+        context: ModelContext, ruleRows: RuleRowSnapshot?, types: WorkTypeDirectory     ) throws -> DuplicateScanResult {-        // One whole-table fetch of the (small) type table, so every-        // `WorkAuthoredContent` this scan builds canonicalizes its assignment-        // through the same fold (Req 6.2, 8.5).-        let types = try LibraryRepository.workTypeDirectory(context: context)         let entryComponents = try candidateComponents(             FetchDescriptor<Entry>(), context: context, id: \.id,             bucketKey: {

diff --git a/Packages/AsterismCore/Sources/AsterismCore/GroupOrdering.swift b/Packages/AsterismCore/Sources/AsterismCore/GroupOrdering.swiftindex 9e8153f..53e2853 100644--- a/Packages/AsterismCore/Sources/AsterismCore/GroupOrdering.swift+++ b/Packages/AsterismCore/Sources/AsterismCore/GroupOrdering.swift@@ -5,14 +5,19 @@ import SwiftData // group *represents* it, which authored variant *leads* a divergent set, and // which member of a duplicate set *survives* its collapse. //-// They are deliberately not extensions of `RecordResolutionOrder` (Q48). That-// order ends on `PersistentIdentifier`, which the codebase already documents as-// device-local and forbidden as a write basis (`IdentityResolution.swift:91-96`):+// They were deliberately not extensions of the since-deleted+// `RecordResolutionOrder` (Q48). That order ended on `PersistentIdentifier`,+// which the codebase documents as device-local and forbidden as a write basis: // two devices assign different identifiers to the same logical rows, so an // ordering that ends there picks a different winner on each device. A // presentation winner may be chosen that way; a *convergence target* or a // *deletion survivor* may not, or two devices delete each other's rows. //+// `LibraryValidator` was the last caller of the old order, and its verdicts+// were device-dependent for exactly that reason. It orders through these+// comparators now, so a diagnosis is a property of the library rather than of+// the device reading it (Q12 of `specs/data-model-cleanups`).+// // The consequence, accepted as Q36, is that the representative ordering is not // total: rows equal in every synced field tie, and the tie is left standing // rather than broken. It costs nothing — when rows agree on everything synced,

diff --git a/Packages/AsterismCore/Sources/AsterismCore/IdentityResolution.swift b/Packages/AsterismCore/Sources/AsterismCore/IdentityResolution.swiftindex 7a838e5..b31cdef 100644--- a/Packages/AsterismCore/Sources/AsterismCore/IdentityResolution.swift+++ b/Packages/AsterismCore/Sources/AsterismCore/IdentityResolution.swift@@ -1,17 +1,25 @@ import Foundation import SwiftData -// Deterministic orderings for the two identity lookups this milestone makes-// total instead of fatal (Req 2.3, Decision 5): more than one Site row for a-// hostname, and more than one record of one type sharing an application UUID.+// The deterministic ordering for a *presentation* identity lookup this+// milestone makes total instead of fatal (Req 2.3, Decision 5): more than one+// Site row for a hostname. //-// Both orderings are strict total orders. That is not a nicety: `sorted(by:)`-// is undefined for a comparator that is not, and the only guarantee Req 2.3-// asks for — the same store contents resolve to the same winner in every-// process and across relaunches — is exactly what a total order over-// content-derived keys plus the store's own identifier provides.+// The sibling question — which row of a duplicated application UUID represents+// the group — used to live here too, as `RecordResolutionOrder`. It is gone:+// that order led with a timestamp and ended on `PersistentIdentifier`, so two+// devices holding the same rows could diagnose the same library differently.+// Every caller now orders through `GroupOrdering`, which reads only synced+// authored content (Q12 of `specs/data-model-cleanups`, Q48 of+// `specs/duplicate-reconciliation`). //-// Both also return immediately for `count <= 1` **before touching any+// The ordering is a strict total order. That is not a nicety: `sorted(by:)` is+// undefined for a comparator that is not, and the only guarantee Req 2.3 asks+// for — the same store contents resolve to the same winner in every process and+// across relaunches — is exactly what a total order over content-derived keys+// plus the store's own identifier provides.+//+// It also returns immediately for `count <= 1` **before touching any // relationship**. The extension's open-and-validate path has a measured median // near its 1 s budget and is dominated by SwiftData faulting rather than // computation (Decision 10), and `fetchSites` sits on the capture path, so the@@ -194,66 +202,7 @@ private final class SiteOrderKey {     var identifier: PersistentIdentifier { site.persistentModelID } } -/// Orders the records of one type sharing an application UUID, winner first.-/// All four types `validate(graph:)` de-duplicates need one. The loser stays in-/// the store; collapsing it is phase 3.-public enum RecordResolutionOrder {--    public static func sortedEntries(_ entries: [Entry]) -> [Entry] { sortedRecords(entries) }--    public static func sortedWorks(_ works: [Work]) -> [Work] { sortedRecords(works) }--    public static func sortedPatterns(_ patterns: [TitlePattern]) -> [TitlePattern] {-        sortedRecords(patterns)-    }--    public static func sortedURLRules(_ rules: [URLRulePattern]) -> [URLRulePattern] {-        sortedRecords(rules)-    }--    /// Earliest creation timestamp, then the same identifier tiebreak the Site-    /// order ends on. No relationship is read, so duplicates cost one date and-    /// one identifier per row.-    internal static func precedes<Record: IdentityResolvable>(-        _ lhs: Record, _ rhs: Record-    ) -> Bool {-        let lhsTimestamp = lhs.resolutionTimestamp-        let rhsTimestamp = rhs.resolutionTimestamp-        if lhsTimestamp != rhsTimestamp { return lhsTimestamp < rhsTimestamp }-        return IdentityTiebreak.precedes(lhs.persistentModelID, rhs.persistentModelID)-    }--    private static func sortedRecords<Record: IdentityResolvable>(-        _ records: [Record]-    ) -> [Record] {-        guard records.count > 1 else { return records }-        return records.sorted(by: precedes)-    }-}--/// The timestamp each ordered record type is resolved by: `firstCapturedAt` for-/// an Entry, `createdAt` for the rest.-internal protocol IdentityResolvable: PersistentModel {-    var resolutionTimestamp: Date { get }-}--extension Entry: IdentityResolvable {-    internal var resolutionTimestamp: Date { firstCapturedAt }-}--extension Work: IdentityResolvable {-    internal var resolutionTimestamp: Date { createdAt }-}--extension TitlePattern: IdentityResolvable {-    internal var resolutionTimestamp: Date { createdAt }-}--extension URLRulePattern: IdentityResolvable {-    internal var resolutionTimestamp: Date { createdAt }-}--/// The final tiebreak shared by both orderings.+/// The final tiebreak of the Site ordering. internal enum IdentityTiebreak {      /// Q19: `PersistentIdentifier` is declared `Swift.Comparable` in the SDK, so

diff --git a/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+BackupImport.swift b/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+BackupImport.swiftindex ccec90e..86513ac 100644--- a/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+BackupImport.swift+++ b/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+BackupImport.swift@@ -9,6 +9,13 @@ import SwiftData /// import-plan gate, which validates a prospective graph in an in-memory store /// before the reader is asked to confirm anything. ///+/// **Verbatim, and deliberately so** (Decision 1). One row per type record, no+/// folding or minting, no coverage application, no repair pass: the strict gate+/// exists to refuse an archive whose *own* graph fails validation, and running+/// the commit body here would validate the graph after the reconciler repaired+/// it. What preview and commit do share is the per-record construction below —+/// `ArchiveRecordBuilders` — so a field added to one path cannot miss the other.+/// /// The two static commit paths this file used to hold are gone (Q37): /// /// - `confirmImportFillEmpty` and `confirmImportReplace` both opened a second@@ -22,125 +29,49 @@ import SwiftData ///   re-compared it at commit, so on any device receiving sync traffic the ///   confirm step could never succeed (Req 4.5). extension LibraryRepository {-    /// Materializes a complete `BackupV4Payload` into a context. Does NOT save —-    /// the caller validates and saves. The V4 backup omits the M3 interpretation-    /// and site-level trim columns, so those live-store columns are left nil.+    /// Materializes a complete payload into a context. Does NOT save — the+    /// caller validates and saves.     ///     /// Assumes an empty context: it inserts unconditionally. The live path is the     /// upsert, which matches first.-    static func materializeV4Payload(-        _ payload: BackupV4Payload,-        into context: ModelContext-    ) throws {-        try materializeArchive(-            sites: payload.sites, titlePatterns: payload.titlePatterns,-            urlRules: payload.urlRules, works: payload.works, entries: payload.entries,-            workTypes: [], into: context)-    }--    /// The 5/6 counterpart. Everything but the Work records and the type list is-    /// the same records over the same body (Decision 12); what this adds is the-    /// `WorkTypeEntity` rows, so the prospective graph the gate validates is the-    /// whole archive rather than the part 4/4 could express.-    static func materializeV5Payload(-        _ payload: BackupV5Payload,-        into context: ModelContext-    ) throws {-        try materializeArchive(-            sites: payload.sites, titlePatterns: payload.titlePatterns,-            urlRules: payload.urlRules, works: payload.works, entries: payload.entries,-            workTypes: payload.workTypes, into: context)-    }--    /// The 6/7 counterpart. The six frozen arrays are 5/6's, and what this adds-    /// are the `Character` and `CharacterSuppression` rows, so the prospective-    /// graph the gate validates is the whole archive.     ///     /// Coverage is deliberately absent: it is a fingerprint of *reader text*-    /// validated against the live source at commit (Q81), and an in-memory-    /// graph built from the archive alone can only ever agree with itself.-    static func materializeV6Payload(-        _ payload: BackupV6Payload,-        into context: ModelContext-    ) throws {-        try materializeArchive(-            sites: payload.sites, titlePatterns: payload.titlePatterns,-            urlRules: payload.urlRules, works: payload.works, entries: payload.entries,-            workTypes: payload.workTypes, characters: payload.characters,-            suppressions: payload.suppressions, into: context)-    }--    private static func materializeArchive(-        sites: [BackupV4Site],-        titlePatterns: [BackupV4TitlePattern],-        urlRules: [BackupV4URLRule],-        works: [some ArchiveWorkRecord],-        entries: [BackupV4Entry],-        workTypes: [BackupV5WorkTypeRecord],-        characters: [BackupV6Character] = [],-        suppressions: [BackupV6Suppression] = [],+    /// validated against the live source at commit (Q81), and an in-memory graph+    /// built from the archive alone can only ever agree with itself.+    static func materializeArchive(+        _ payload: BackupImportPayload,         into context: ModelContext     ) throws {         var sitesByHostname: [String: Site] = [:]-        for record in sites {-            let site = Site(hostname: record.hostname, displayName: record.displayName)-            site.modeRaw = record.mode.rawValue-            site.junkSuffixRule = record.junkSuffixRule+        for record in payload.sites {+            let site = ArchiveRecordBuilders.makeSite(record)             context.insert(site)             sitesByHostname[record.hostname] = site         } -        for record in titlePatterns {-            let pattern = try TitlePattern(-                id: record.id,-                version: record.version,-                isActive: record.isActive,-                createdAt: record.createdAt,-                definition: record.definition,-                site: sitesByHostname[record.siteHostname]-            )-            pattern.trimPrefix = record.trimPrefix-            pattern.trimSuffix = record.trimSuffix-            context.insert(pattern)+        for record in payload.titlePatterns {+            context.insert(+                try ArchiveRecordBuilders.makeTitlePattern(+                    record, site: sitesByHostname[record.siteHostname]))         } -        for record in urlRules {-            let rule = try URLRulePattern(-                id: record.id,-                version: record.version,-                isCurrent: record.isCurrent,-                createdAt: record.createdAt,-                origin: record.origin,-                definition: record.definition,-                site: sitesByHostname[record.siteHostname]-            )-            context.insert(rule)+        for record in payload.urlRules {+            context.insert(+                try ArchiveRecordBuilders.makeURLRule(+                    record, site: sitesByHostname[record.siteHostname]))         }          // The archive's list verbatim, one row per record: the exporter folds, so         // a record *is* an identity (Q32), and the wire timestamps are what an         // import-created row carries on both fields (Q33).-        for record in workTypes {-            let row = WorkTypeEntity(-                id: record.id, name: record.name,-                state: WorkTypeState(rawValue: record.stateRaw) ?? .active,-                canonicalID: record.canonicalID, timestamp: record.modifiedAt)-            row.createdAt = record.createdAt-            context.insert(row)+        for record in payload.workTypes {+            context.insert(ArchiveRecordBuilders.makeWorkType(record))         }          var worksByID: [UUID: Work] = [:]-        for record in works {-            let work = Work(-                id: record.id,-                displayTitle: record.displayTitle,-                siteHostname: record.siteHostname,-                timestamp: record.createdAt-            )+        for record in payload.works {+            let work = ArchiveRecordBuilders.makeWork(record)             context.insert(work)-            // The same applier the upsert uses, so an inserted record and an-            // updated one cannot drift apart.-            apply(record, to: work)             // Req 2.5: an archive references its Site by hostname, so the             // relationship is derived from exactly that — the same map the rules             // above are wired from.@@ -148,19 +79,9 @@ extension LibraryRepository {             worksByID[record.id] = work         } -        for record in entries {-            let entry = Entry(-                id: record.id,-                captureTitle: record.captureTitle,-                captureTitleSource: record.captureTitleSource,-                rawURLString: record.rawURL,-                canonicalURLString: record.canonicalURL,-                hostname: record.hostname,-                entryIdentityKey: record.entryIdentityKey,-                timestamp: record.firstCapturedAt-            )+        for record in payload.entries {+            let entry = ArchiveRecordBuilders.makeEntry(record)             context.insert(entry)-            apply(record, to: entry)             entry.site = sitesByHostname[record.hostname]             entry.work = record.workID.flatMap { worksByID[$0] }         }@@ -168,23 +89,14 @@ extension LibraryRepository {         // A character whose work reference names nothing the archive carries         // lands unattached — the tolerated in-flight state of Req 6.7, and the         // shape the wire validator lets through as an orphan (Q78).-        for record in characters {-            let character = CharacterRecord(-                id: record.id, name: record.name, nameKey: record.nameKey,-                aliases: record.aliases, note: record.note, facts: record.facts,-                timestamp: record.createdAt)-            character.modifiedAt = record.modifiedAt+        for record in payload.characters {+            let character = ArchiveRecordBuilders.makeCharacter(record)             context.insert(character)             character.work = record.workID.flatMap { worksByID[$0] }         } -        for record in suppressions {-            let row = CharacterSuppression(-                id: record.id, kind: record.kind, nameKey: record.nameKey,-                source: record.source, evidence: record.evidence, status: record.status,-                actionAt: record.actionAt)-            row.kindRaw = record.kindRaw-            row.statusRaw = record.statusRaw+        for record in payload.suppressions {+            let row = ArchiveRecordBuilders.makeSuppression(record)             context.insert(row)             row.work = record.workID.flatMap { worksByID[$0] }         }

diff --git a/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+BackupImportGates.swift b/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+BackupImportGates.swiftindex c7aa2de..9122acf 100644--- a/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+BackupImportGates.swift+++ b/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+BackupImportGates.swift@@ -1,10 +1,10 @@ import Foundation import SwiftData -// MARK: - LibraryRepository backup import gates+// MARK: - LibraryRepository backup import gate  extension LibraryRepository {-    /// Materializes and V4-validates a prospective import graph entirely in an+    /// Materializes and validates a prospective import graph entirely in an     /// in-memory store. Planning calls this before presenting confirmation, so     /// a malformed composed tuple fails before any fixed-path store or readiness     /// marker can be touched (Req 5.2). Per-Site quarantine diagnoses are an@@ -12,46 +12,18 @@ extension LibraryRepository {     ///     /// Strict on purpose: the open paths tolerate three states from this     /// milestone on, and an import must keep refusing all three (Decision 3).-    static func validateImportPlanPayloadV4(-        _ payload: BackupV4Payload-    ) throws -> LibraryRecordCounts {-        try validateImportPlanGraph { context in-            try materializeV4Payload(payload, into: context)-        }-    }--    /// The 5/6 gate. The strictness is the same; what differs is the graph, which-    /// now carries the type list. Duplicate type identities are refused a step-    /// earlier, by the archive's own reference validator — the strict duplicate-    /// arm for the type table lives with the format rather than with the store,-    /// where same-id rows are a normal permanent state (Q32).-    static func validateImportPlanPayloadV5(-        _ payload: BackupV5Payload-    ) throws -> LibraryRecordCounts {-        try validateImportPlanGraph { context in-            try materializeV5Payload(payload, into: context)-        }-    }--    /// The 6/7 gate. Same strictness again; what the graph gains is the-    /// characters, their suppressions and their coverage, so a payload whose-    /// character records contradict the schema fails here rather than at the-    /// commit. Coverage is *not* applied by the materializer — a prospective-    /// graph has no reader text to validate a fingerprint against, and Q81's-    /// rule is a commit-time one.-    static func validateImportPlanPayloadV6(-        _ payload: BackupV6Payload-    ) throws -> LibraryRecordCounts {-        try validateImportPlanGraph { context in-            try materializeV6Payload(payload, into: context)-        }-    }--    private static func validateImportPlanGraph(-        materialize: (ModelContext) throws -> Void+    ///+    /// Duplicate type identities are refused a step earlier, by the archive's own+    /// reference validator — the strict duplicate arm for the type table lives+    /// with the format rather than with the store, where same-id rows are a+    /// normal permanent state (Q32). Coverage is *not* applied by the+    /// materializer either: a prospective graph has no reader text to validate a+    /// fingerprint against, and Q81's rule is a commit-time one.+    static func validateImportPlanPayload(+        _ payload: BackupImportPayload     ) throws -> LibraryRecordCounts {         // The live schema. It is now the only one declared (Req 3.1), but the-        // pinning is deliberate rather than incidental: the materializers insert+        // pinning is deliberate rather than incidental: the materializer inserts         // live classes, so validating against any snapshot schema would validate         // against different entities (Q20).         let schema = Schema(versionedSchema: AsterismSchemaV7.self)@@ -62,7 +34,7 @@ extension LibraryRepository {         )         let container = try ModelContainer(for: schema, configurations: [configuration])         let context = ModelContext(container)-        try materialize(context)+        try materializeArchive(payload, into: context)         let diagnoses = try LibraryValidator.validateStrict(context: context)         guard diagnoses.isEmpty else {             let (hostname, reason) = diagnoses.sorted { $0.key < $1.key }.first!

diff --git a/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+Bootstrap.swift b/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+Bootstrap.swiftindex 9f893aa..8003748 100644--- a/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+Bootstrap.swift+++ b/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+Bootstrap.swift@@ -4,29 +4,26 @@ import SwiftData  /// Runtime opening of the live library, classified then acted on. ///-/// Every store the app can reach is recorded at V5 or above, and the one-/// conversion left is the `.lightweight` V5 → V6 stage `ModelContainer.init`-/// runs: the sidecar, the V3 reader and the completion pass are retired-/// (Decision 1). What survives is the readiness contract. The app populates site-/// relationships where the marker says the data pass has not run, validates with-/// `LibraryValidator`, and only then publishes the readiness marker (containing-/// `"6"`, the only version the extension opens — Q14, and Q26 of-/// `configurable-work-types`) and clears residual evidence. The extension never-/// populates and never republishes — it requires a `"6"` marker plus a store or-/// fails closed.+/// Every store the app can reach is recorded at V5 or above, and the two+/// conversions left are the `.lightweight` V5 → V6 → V7 stages+/// `ModelContainer.init` runs: the sidecar, the V3 reader and the completion pass+/// are retired (Decision 1). What survives is the readiness contract. The app+/// validates with `LibraryValidator` and clears residual evidence; the marker it+/// publishes contains `"7"`, the only version either role opens (Q14). /// /// An *empty* store is marked ready as soon as it exists, so the app either opens /// a ready library or throws — there is no third state for the reader to resolve.-/// It is marked at `"6"`: there is nothing in it for the pass to populate, so it-/// is already in the state the pass produces (Q26).+/// It is marked at `"7"` directly: there is nothing in it to bring forward (Q26). ///-/// Two lagging generations remain openable, and they are different states rather-/// than degrees of one. A populated library still marked `"4"` — one a pre-freeze-/// build certified — runs the relationship pass on its next app open and is-/// republished at `"6"` (Decision 4). One marked `"5"` has already had that pass;-/// what it lacks is the marker generation, so its upgrade is a republication and-/// nothing else. Running the pass over it again would sweep every Entry and Work-/// on the first launch after the update for no change.+/// **There are no lagging generations left.** `"4"`, `"5"` and `"6"` were+/// openable states with upgrade paths — a relationship data pass for `"4"`, a+/// republication for the other two — and `data-model-cleanups` Decision 2 deleted+/// all three: the population is one user whose every device carries `"7"`, so the+/// paths could not fire again. A store found on any other digit is refused,+/// naming it, and the recovery is the backup archive, exactly as for a store+/// recorded below V5. Both roles now accept one digit, and the difference between+/// them is what they may do about it: the app may create and mark a store, the+/// extension may not. public extension LibraryRepository {     /// The result of evaluating the live library's fixed-path state under an     /// exclusive lease.@@ -34,7 +31,7 @@ public extension LibraryRepository {         case ready(LibraryRecordCounts)     } -    /// Extension-only readiness result. The extension opens only a `"6"` marker.+    /// Extension-only readiness result. The extension opens only a `"7"` marker.     enum ExtensionResult: Equatable, Sendable {         case ready(LibraryRecordCounts)     }@@ -42,11 +39,11 @@ public extension LibraryRepository {     /// **The app-role opener — the only one (Req 4.4) — under an EXCLUSIVE     /// cross-process lease.**     ///-    /// It is the sole entry point that may create a store, run the-    /// site-relationship pass, or publish the readiness marker, which is why it-    /// takes the exclusive lock and why the extension has a separate opener rather-    /// than a parameter on this one. Tests open through it too: a test that opened-    /// its own store would be testing a library the app never opens (Q3, Req 4.1).+    /// It is the sole entry point that may create a store or publish the+    /// readiness marker, which is why it takes the exclusive lock and why the+    /// extension has a separate opener rather than a parameter on this one. Tests+    /// open through it too: a test that opened its own store would be testing a+    /// library the app never opens (Q3, Req 4.1).     ///     /// App startup: classifies the on-disk state under one exclusive lease, acts on     /// it, and only then constructs the container the repository keeps. Returns an@@ -62,11 +59,10 @@ public extension LibraryRepository {     ///     /// **The open is two-phase**, and since the migration it was built around is     /// retired, the structure now rests on mirroring alone (Decision 3). Everything-    /// certification does — store creation, the site-relationship pass, validation,-    /// marker publication — runs on a container opened `.none` that is released-    /// when `certifyForApp` returns. Only then is the long-lived container-    /// constructed, mirrored when a container identifier was injected. Two-    /// consequences:+    /// certification does — store creation, validation, marker publication — runs+    /// on a container opened `.none` that is released when `certifyForApp`+    /// returns. Only then is the long-lived container constructed, mirrored when a+    /// container identifier was injected. Two consequences:     ///     /// * Mirroring cannot write into the store before it is marked ready     ///   (Req 2.11), on any path including `.pristine`, because no mirroring@@ -99,8 +95,7 @@ public extension LibraryRepository {             mode: .exclusive, at: configuration.lockURL, timeout: bootstrapLockTimeout)         defer { withExtendedLifetime(lease) {} } -        let certification = try certifyForApp(-            configuration, saveStrategy: saveStrategy, hooks: hooks)+        let certification = try certifyForApp(configuration, hooks: hooks)         // The certification container died with that call's frame. Nothing here         // holds a reference to it, which is what makes the construction below         // the only live container over this store.@@ -120,14 +115,13 @@ public extension LibraryRepository {     /// reference to a second container over the store) into the caller's frame.     internal static func certifyForApp(         _ configuration: LibraryConfiguration,-        saveStrategy: any RepositorySaveStrategy,         hooks: MirroringOpenHooks     ) throws -> Certification {         let state = try classify(configuration, fileManager: .default)         hooks.bootstrapEventObserver?(.classified(state))         bootstrapLogger.debug("Bootstrap state: \(String(describing: state), privacy: .public)") -        return try act(on: state, configuration, saveStrategy: saveStrategy, hooks: hooks)+        return try act(on: state, configuration, hooks: hooks)     }      /// The only code that writes. One case per `BootstrapState`, so the compiler@@ -135,7 +129,7 @@ public extension LibraryRepository {     /// acting case states its own sequence — ordering is the substance of Req 2.8,     /// not a detail of it.     ///-    /// Two rules hold across all five acting cases:+    /// Two rules hold across all four acting cases:     ///     /// * **The marker goes after the work it certifies, and the cleanup after the     ///   marker** (Q36). A failure earlier in a sequence has therefore written@@ -148,7 +142,6 @@ public extension LibraryRepository {     internal static func act(         on state: BootstrapState,         _ configuration: LibraryConfiguration,-        saveStrategy: any RepositorySaveStrategy,         hooks: MirroringOpenHooks     ) throws -> Certification {         switch state {@@ -161,59 +154,14 @@ public extension LibraryRepository {                     + "version this build opens; restore from a backup archive")          case .ready:-            // open → validate → clear residual evidence → counts. The pass ran at-            // this library's certification and does not run again (Q29, Q31),-            // and the marker already records the current generation.+            // open (which converts, V5 → V6 → V7) → validate → clear residual+            // evidence → counts. The marker already records the current+            // generation, so nothing is published: this is the only certification+            // sequence left, and it writes no marker at all.             let container = try openCertificationContainer(configuration, hooks: hooks)             let context = ModelContext(container)-            let diagnostics = try runPassAndCertify(-                configuration, context: context, saveStrategy: saveStrategy,-                sitePass: false, publishMarker: false)-            let counts = try rowCounts(context: context)-            hooks.certificationContainerObserver?(container)-            return Certification(result: .ready(counts), diagnostics: diagnostics)--        case .markerLaggingV4:-            // open → populate relationships → save → validate → publish `"6"` →-            // clear residual evidence (Decision 4). A `"4"` marker means the-            // relationship data pass has not run, not that the schema lags: the-            // conversion is what `ModelContainer.init` performs, and populating-            // the columns it adds is a separate pass this branch runs.-            //-            // The marker is written only once the pass has committed and the-            // store has validated, so a failure here leaves it at `"4"` and the-            // next launch retries the same path rather than opening a library-            // certified on work that did not finish.-            let container = try openCertificationContainer(configuration, hooks: hooks)-            let context = ModelContext(container)-            let diagnostics = try runPassAndCertify(-                configuration, context: context, saveStrategy: saveStrategy,-                sitePass: true, publishMarker: true)-            let counts = try rowCounts(context: context)-            hooks.certificationContainerObserver?(container)-            return Certification(result: .ready(counts), diagnostics: diagnostics)--        case .markerLaggingV5, .markerLaggingV6:-            // open (which converts, V5 → V6 → V7) → validate → publish `"7"` →-            // clear residual evidence. No data pass: the relationship pass ran at-            // this library's own certification, and the schema steps are the-            // `.lightweight` stages the container construction above just-            // performed (Q26, Q37, Q80).-            //-            // One arm for both generations because they owe the same thing. The-            // states stay distinct in `BootstrapState` so the classifier keeps-            // saying which generation a library is on — that is what a-            // diagnostic reads — and so adding a data pass to one of them later-            // is an edit here rather than a re-derivation of the state.-            //-            // The marker still goes last, for the same reason as the `"4"`-            // branch: a validation failure leaves the old digit in place, the-            // extension keeps declining, and the next launch retries.-            let container = try openCertificationContainer(configuration, hooks: hooks)-            let context = ModelContext(container)-            let diagnostics = try runPassAndCertify(-                configuration, context: context, saveStrategy: saveStrategy,-                sitePass: false, publishMarker: true)+            let diagnostics = try validateAndClearResidualEvidence(+                configuration, context: context)             let counts = try rowCounts(context: context)             hooks.certificationContainerObserver?(container)             return Certification(result: .ready(counts), diagnostics: diagnostics)@@ -229,13 +177,14 @@ public extension LibraryRepository {                 reason: kind.orphanedReason)          case .unmarkedStore:-            // open → counts → refuse if nonempty → publish `"6"`.+            // open → counts → refuse if nonempty → publish `"7"`.             //             // An *empty* unmarked store is the state a crash between store             // creation and the marker leaves, or a `publishReadiness` that             // failed on a full disk. It is marked and opened, because the             // alternative — failing closed — bricks a library the app can repair-            // now that the migration recovery is gone (Decision 2).+            // now that the migration recovery is gone+            // (`retire-migration-chain` Decision 2).             //             // A nonempty one is refused. Nothing certified it, so nothing             // establishes what it holds, and the evidence is preserved for a@@ -255,13 +204,11 @@ public extension LibraryRepository {             return Certification(result: .ready(counts), diagnostics: .empty)          case .pristine:-            // open (which creates) → save → counts → publish `"6"`.+            // open (which creates) → save → counts → publish `"7"`.             //-            // Certified at `"6"`, not at a lagging generation: an empty store has-            // nothing for the relationship pass to do, so it is already in the-            // state the pass produces (Q26). Marking it `"4"` or `"5"` would-            // leave the share extension declining a library that will never be-            // migrated.+            // Certified at `"7"`, the only generation there is: an empty store+            // has nothing to bring forward, so it is born in the state a+            // certified library is in (Q26).             let container = try openCertificationContainer(configuration, hooks: hooks)             let context = ModelContext(container)             do { try context.save() } catch {@@ -331,10 +278,10 @@ public extension LibraryRepository {     /// bootstrap one: a share sheet that cannot get in must say so quickly.     ///     /// A shared lease is all it needs and all it may have, because it writes-    /// nothing: it requires the readiness marker recording `"6"` plus a store,-    /// validates, and opens. It never creates a store, never populates-    /// relationships and never republishes the marker (Req 2.13); every-    /// pre-certification state fails closed with the shipped message.+    /// nothing: it requires the readiness marker recording `"7"` plus a store,+    /// validates, and opens. It never creates a store and never republishes the+    /// marker (Req 2.13); every pre-certification state fails closed with the+    /// shipped message.     static func openForExtension(         _ configuration: LibraryConfiguration,         capabilities: AsterismCapabilities = .current,@@ -398,9 +345,8 @@ extension LibraryRepository {     /// closed door rather than a new one.     ///     /// Mirroring defaults to off, and every certification-phase caller takes the-    /// default: the store is opened `.none` for creation, the site-relationship-    /// pass and validation, and only the app's post-certification open passes-    /// `.private` (Q35). The share extension never passes it at all (Req 5.1).+    /// default: the store is opened `.none` for creation and validation, and only+    /// the app's post-certification open passes `.private` (Q35). The share extension never passes it at all (Req 5.1).     // `public` so the app target can open a store for the isolated UI-test     // bootstrap of the composed teaching surface (Req 7.3); production opens via     // `openForApp` (task 25's runtime switch).@@ -428,13 +374,10 @@ extension LibraryRepository {     }      /// Publishes readiness at the current marker generation — the only version-    /// the share extension opens, and the only version production publishes-    /// (Q32): every certification path has either run the relationship pass or-    /// established it has nothing to do, so `"4"`, `"5"` and `"6"` markers can-    /// only come from earlier builds' libraries and the app republishes here.+    /// either role opens, and the only version production publishes (Q32).     ///     /// Unversioned by name on purpose: it always writes the generation the build-    /// certifies at, and the digit has moved twice already.+    /// certifies at, and the digit has moved three times already.     public static func publishReadiness(at url: URL) throws {         do {             try Data("\(extensionOpenableMarkerVersion)\n".utf8).write(to: url, options: .atomic)@@ -479,60 +422,26 @@ extension LibraryRepository {         }     } -    /// The certification tail the acting cases share, in the order Q36 pins: the-    /// site-relationship pass, then store validation, then the `"6"` marker, and-    /// only then the residual evidence the marker replaces.-    ///-    /// The pass runs BEFORE `validateStore`: diagnostics feed the session's-    /// quarantine map, and computed first they would describe the pre-pass graph-    /// — every relationship still nil — leaving the library open under-    /// quarantines the pass had just made obsolete.+    /// The `.ready` tail: validate the store, then clear the evidence the+    /// current marker supersedes.     ///-    /// The marker goes after the work and the cleanup after the marker (Q36).-    /// `"6"` is published only once the pass's one save has committed and the-    /// store validated — the "marker last" Q15 asks for, where "last" means after-    /// the work, not after housekeeping. The historical marker and the migration-    /// artefact are the recovery evidence for the state this call is leaving, so-    /// they go *after* the marker that replaces them, never before. Their-    /// filenames outlive the migration because the classifier reads them for-    /// presence (Q19).+    /// **It publishes nothing.** It once carried a `sitePass` flag and a+    /// `publishMarker` flag, because three states wanted three combinations of+    /// them (Q37 of `configurable-work-types`). Two of those states are gone with+    /// the lagging generations (`data-model-cleanups` Decision 2) and the third,+    /// `.ready`, passed false for both — so what is left is the half that always+    /// ran, and the flags with nothing to select between them are gone too.     ///-    /// **Two flags, not one** (Q37 of `configurable-work-types`). The three-    /// callers want three different combinations, and a single `runPass` boolean-    /// could only express two of them:-    ///-    /// | State | `sitePass` | `publishMarker` |-    /// |---|---|---|-    /// | `.markerLaggingV4` | true | true |-    /// | `.markerLaggingV5`, `.markerLaggingV6` | false | true |-    /// | `.ready` | false | false |-    ///-    /// `sitePass` is false wherever the marker already reports the relationships-    /// as populated: the pass ran at that library's certification and does not-    /// run again (Q29, Q31). `publishMarker` is false only where the marker-    /// already records the current generation.-    static func runPassAndCertify(+    /// The cleanup goes after the validation for the reason Q36 gives about the+    /// marker: the historical marker and the migration artefact are the recovery+    /// evidence for the state this call is leaving, so they are removed only once+    /// the library they belong to has been established as openable. Both are+    /// absent on most calls, which `try?` covers along with a removal that fails.+    static func validateAndClearResidualEvidence(         _ configuration: LibraryConfiguration,-        context: ModelContext,-        saveStrategy: any RepositorySaveStrategy,-        sitePass: Bool,-        publishMarker: Bool+        context: ModelContext     ) throws -> LibraryDiagnostics {-        if sitePass {-            do {-                try SiteRelationshipPopulationPass.run(context: context, saveStrategy: saveStrategy)-            } catch {-                throw LibraryRepositoryError.libraryUnavailable(-                    operation: "populating the site relationships",-                    reason: String(describing: error))-            }-        }         let diagnostics = try validateStore(context: context)-        if publishMarker { try publishReadiness(at: configuration.readinessMarkerURL) }-        // The current marker governs, so a historical one is stale wherever it is-        // left, and so is a migration artefact no path resumes from any more-        // (Req 1.2). Both are absent on most calls, which `try?` covers along-        // with a removal that fails.         try? FileManager.default.removeItem(at: configuration.historicalMarkerURL)         try? FileManager.default.removeItem(at: configuration.migrationSidecarURL)         return diagnostics@@ -568,60 +477,36 @@ extension LibraryRepository {         }     } -    /// Marker generations the app opens: `"4"` is a library the relationship-    /// pass has not run over yet, `"5"` one it has but whose marker predates-    /// `configurable-work-types`, `"6"` one whose marker predates-    /// `character-extraction`, `"7"` a fully certified one.+    /// Marker generations the app opens: one, the current generation.+    ///+    /// **This is the live acceptance test**, not a description of one: the+    /// classifier's ready row is `appOpenableMarkerVersions.contains(version)`+    /// (`classify`, row 2), so a digit added here is a digit the app opens and+    /// there is nowhere else to change.+    ///+    /// It used to hold every generation the project had ever published, because+    /// a device that had not launched the new build yet was on the old marker and+    /// the set is what kept it openable. `data-model-cleanups` Decision 2 retired+    /// that: the population is one user whose every device carries `"7"`, so the+    /// retired digits fail closed naming themselves instead+    /// (`docs/agent-notes/schema-migration.md`).     ///-    /// Every generation the project has ever published stays here. Shipping a-    /// new one without extending the set fails every device still on the old-    /// marker closed (`docs/agent-notes/schema-migration.md`).-    static let appOpenableMarkerVersions: Set<String> = [-        markerVersionAwaitingRelationshipPass, markerVersionAwaitingRepublication,-        markerVersionAwaitingCharacterRepublication, extensionOpenableMarkerVersion,-    ]--    /// The marker a library carries when the relationship data pass has not run-    /// over it. It is *not* a lagging schema version: the schema conversion and-    /// the data pass are separate operations, and this marker distinguishes them-    /// (Decision 4). Frozen persisted state — these are the bytes on disk in an-    /// installed library (Req 3.5).-    static let markerVersionAwaitingRelationshipPass = "4"--    /// The marker a library carries when the relationship pass has run but the-    /// marker generation predates `configurable-work-types` (Q26). Nothing is-    /// owed here but the republication: the V5 → V6 step is the `.lightweight`-    /// stage `ModelContainer.init` runs. Frozen persisted state (Req 3.5).-    static let markerVersionAwaitingRepublication = "5"--    /// The marker a library carries when the relationship pass has run and the-    /// marker generation predates `character-extraction`. Nothing is owed here-    /// but the republication: the V6 -> V7 step is the second `.lightweight`-    /// stage `ModelContainer.init` runs. Frozen persisted state (Req 3.5).-    static let markerVersionAwaitingCharacterRepublication = "6"--    /// The only version the share extension opens (Q14). Frozen persisted state-    /// (Req 3.5).+    /// **A new generation must still be added here, not substituted**, unless the+    /// same population argument is made again at that time — and made about the+    /// population as it is then, not as it was here.+    static let appOpenableMarkerVersions: Set<String> = [extensionOpenableMarkerVersion]++    /// The only version either role opens (Q14). Frozen persisted state — these+    /// are the bytes on disk in an installed library (Req 3.5).     static let extensionOpenableMarkerVersion = "7" -    /// App side: the marker must declare a version the app opens. The upgrade-    /// paths exist precisely for libraries still at `"4"`, `"5"` and `"6"`, so-    /// demanding `"7"` here would throw on every library they exist for. A version outside-    /// the set, or an unreadable marker, fails closed. Returns the validated-    /// version so the bootstrap can tell the lagging generations apart from a-    /// certified one (Q31).-    @discardableResult-    static func validateMarkerContentForApp(at url: URL) throws -> String {-        let version = try readMarkerVersion(at: url)-        guard appOpenableMarkerVersions.contains(version) else {-            throw LibraryRepositoryError.libraryUnavailable(-                operation: "validating readiness",-                reason: "marker declares an unsupported schema version")-        }-        return version-    }+    // The app-side counterpart of `validateMarkerContentForExtension` stood+    // here. It restated the acceptance test the classifier performs, and+    // nothing called it: `classify` reads the marker itself and returns+    // `.unrecognised` naming the digit, so the app's contract is+    // `appOpenableMarkerVersions` consulted from row 2 and nowhere else. -    /// Extension side: only a migrated library opens (Q14, Req 2.3).+    /// Extension side: only a certified library opens (Q14, Req 2.3).     ///     /// `openContainer` is shared with the app, so `ModelContainer.init`     /// performs the lightweight conversions in whichever process opens first.@@ -631,21 +516,33 @@ extension LibraryRepository {     /// extension invocations can hold `LOCK_SH` concurrently and both attempt     /// the conversion, and the extension can be invoked when the app is not     /// running at all. Refusing here, before any container is constructed, is-    /// what keeps the conversion in the app. Accepting `"4"`, `"5"` or `"6"` as-    /// the app-side check does would defeat that entirely — and `"6"` is exactly-    /// the window between the app being updated and first launched, which-    /// `configurable-work-types` Req 8.7 requires to fail safely.+    /// what keeps the conversion in the app.+    ///+    /// **One refusal for every other digit.** The message used to fork on+    /// whether the app would still open the marker — "launch the app" for a+    /// lagging generation, "unsupported" for anything else — and with the app+    /// down to one digit that fork has no second branch to take. The shipped+    /// wording that survives is the actionable one, because the reachable state+    /// is the update window: the generation after this one ships, the app is+    /// updated and not yet launched, the library still records `"7"`, and+    /// `configurable-work-types` Req 8.7 requires that capture to fail safely+    /// rather than convert a store under a shared lock.     static func validateMarkerContentForExtension(at url: URL) throws {         let version = try readMarkerVersion(at: url)         if version == extensionOpenableMarkerVersion { return }-        // A version the app still opens is a library awaiting migration, which-        // launching the app resolves — the shipped message says so. Anything-        // else is a marker no build understands.+        // **The single message is only correct while the app opens exactly one+        // digit.** It says "launch the app", which is the actionable answer for+        // a generation the app *would* still open — and today that is the only+        // non-current digit any real library can carry. The moment+        // `appOpenableMarkerVersions` holds a second digit (T-2230, the V8+        // generation), a marker outside that set is no longer resolvable by+        // launching the app and this message becomes a lie: bring back the+        // two-branch fork — "the app has not initialized the library" for a+        // version the app opens, "unsupported schema version" for anything else.+        // See `data-model-cleanups` Decision 2 for why the fork went away.         throw LibraryRepositoryError.libraryUnavailable(             operation: "opening library from extension",-            reason: appOpenableMarkerVersions.contains(version)-                ? "the containing app has not initialized the current library"-                : "marker declares an unsupported schema version")+            reason: "the containing app has not initialized the current library")     }      /// Reads the schema version the readiness marker declares. An unreadable

diff --git a/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+BootstrapState.swift b/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+BootstrapState.swiftindex d011b55..3241d86 100644--- a/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+BootstrapState.swift+++ b/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+BootstrapState.swift@@ -19,22 +19,6 @@ enum BootstrapState: Equatable, Sendable {     /// A certified library: the readiness marker records `"7"` and a store is     /// present.     case ready-    /// A library whose readiness marker records `"4"`. That is not a lagging-    /// schema version — it means the relationship data pass has not run over it-    /// (Decision 4). The upgrade runs the pass and republishes the marker.-    case markerLaggingV4-    /// A library whose readiness marker records `"5"`: the relationship pass has-    /// run, and only the marker predates `configurable-work-types` (Q26). The-    /// V5 → V6 conversion is the lightweight stage `ModelContainer.init`-    /// performs on the way in, so there is no data pass to run — the upgrade is-    /// a republished marker and nothing else.-    case markerLaggingV5-    /// A library whose readiness marker records `"6"`: the relationship pass has-    /// run, and only the marker predates `character-extraction`. The V6 → V7-    /// conversion is the second lightweight stage `ModelContainer.init`-    /// performs, so as with `"5"` the upgrade is a republished marker and-    /// nothing else (Q80).-    case markerLaggingV6     /// Evidence that a library existed, with no store file of any kind to go with     /// it. Refused so the evidence survives for a restore (Req 2.6).     case orphanedEvidence(kind: EvidenceKind)@@ -43,7 +27,10 @@ enum BootstrapState: Equatable, Sendable {     case unmarkedStore     /// No store, no marker of any generation, no migration artefact: first run.     case pristine-    /// A state no build produces. Refused naming what was found (Req 2.7).+    /// A state no build produces — including a readiness marker recording a+    /// generation this build no longer opens. Refused naming what was found+    /// (Req 2.7); for a marker, the refusal names the digit+    /// (`data-model-cleanups` Decision 2).     case unrecognised(reason: String)      /// Which evidence refused the open, in the order the classifier reports it:@@ -82,22 +69,30 @@ extension LibraryRepository {     ///     /// 1. a positively below-V5 recorded version (Req 2.9)     /// 2. marker `"7"` and a store present (Req 2.2)-    /// 3. marker `"4"`, `"5"` or `"6"` and a store present (Req 2.3, Q26, Q80)-    /// 4. any evidence with no store present (Req 2.6)-    /// 5. a store present with no readiness marker of any generation (Req 2.4)-    /// 6. nothing on disk (Req 2.5)-    /// 7. anything else (Req 2.7)+    /// 3. any evidence with no store present (Req 2.6)+    /// 4. a store present with no readiness marker of any generation (Req 2.4)+    /// 5. nothing on disk (Req 2.5)+    /// 6. anything else, including a marker recording a retired generation+    ///    (Req 2.7)+    ///+    /// **There is no row for a lagging marker generation.** The `"4"`, `"5"` and+    /// `"6"` rows are deleted with the upgrade paths they fed+    /// (`data-model-cleanups` Decision 2: one user, every device on `"7"`), so a+    /// store carrying one falls to the last row and is refused with its digit+    /// named — the same stance as a below-V5 store, and with the same recovery,+    /// the backup archive.     ///     /// Store presence is the disjunction over the SQLite family — `.sqlite`,     /// `-wal`, `-shm` (Req 2.10). A main file that is gone while its companions     /// survive is a *present* store whose version cannot be read, so it lands on-    /// row 5 rather than row 6, which is what stops a partial restore from being+    /// row 4 rather than row 5, which is what stops a partial restore from being     /// certified as a new library.     ///-    /// Row 5 deliberately does not exclude a migration artefact. That state is+    /// Row 4 deliberately does not exclude a migration artefact. That state is     /// reachable — `publishReadiness` can fail between marking and cleanup —     /// and excluding artefacts there would make a converted library permanently-    /// unopenable, which is the failure mode Decision 2 exists to prevent.+    /// unopenable, which is the failure mode `retire-migration-chain`+    /// Decision 2 exists to prevent.     /// Req 1.2 forbids *resuming from* an artefact, not tolerating one.     ///     /// Declared `throws` because probing the file system is fallible in principle;@@ -127,15 +122,16 @@ extension LibraryRepository {          let marker = readinessMarkerPresent ? readReadinessMarker(at: configuration.readinessMarkerURL) : nil -        // 2, 3. A marker the app understands, over a store that exists.-        if storePresent, case .version(let version) = marker {-            if version == extensionOpenableMarkerVersion { return .ready }-            if version == markerVersionAwaitingRelationshipPass { return .markerLaggingV4 }-            if version == markerVersionAwaitingRepublication { return .markerLaggingV5 }-            if version == markerVersionAwaitingCharacterRepublication { return .markerLaggingV6 }+        // 2. A marker generation the app opens, over a store that exists. The+        // acceptance test is `appOpenableMarkerVersions` — one digit today, and+        // the single live source of truth for what the app will open, so adding+        // a generation there is all it takes to make this row admit it.+        if storePresent, case .version(let version) = marker,+           appOpenableMarkerVersions.contains(version) {+            return .ready         } -        // 4. Evidence of a library whose store is gone. Never fabricate a+        // 3. Evidence of a library whose store is gone. Never fabricate a         // replacement: creating one here would certify an empty library and         // delete the last trace of the populated one.         if !storePresent {@@ -144,14 +140,14 @@ extension LibraryRepository {             if artefactPresent { return .orphanedEvidence(kind: .migrationSidecar) }         } -        // 5. A store nothing has certified: this launch's crash between creation+        // 4. A store nothing has certified: this launch's crash between creation         // and the marker, or an older build's.         if storePresent, !readinessMarkerPresent, !historicalMarkerPresent { return .unmarkedStore } -        // 6. First run. Every marker and the artefact are absent by here.+        // 5. First run. Every marker and the artefact are absent by here.         if !storePresent { return .pristine } -        // 7. Everything left, named.+        // 6. Everything left, named — a retired marker generation among it.         return .unrecognised(reason: unrecognisedReason(             marker: marker, historicalMarkerPresent: historicalMarkerPresent))     }@@ -184,6 +180,18 @@ extension LibraryRepository {         return .version(text.trimmingCharacters(in: .whitespacesAndNewlines))     } +    /// The marker's declared version is whatever bytes the file held, trimmed —+    /// a corrupt or truncated write can make that arbitrarily long, and the+    /// reason string built from it reaches a `.public` os_log line and the+    /// reader's screen. Both are capped here rather than at either sink: a+    /// generation digit is one character, so 32 is already far more than any+    /// legitimate value, and anything longer is diagnosed by its prefix.+    private static func abbreviatedMarkerText(_ version: String) -> String {+        let limit = 32+        guard version.count > limit else { return version }+        return String(version.prefix(limit)) + "…"+    }+     private static func unrecognisedReason(         marker: ReadinessMarkerReading?,         historicalMarkerPresent: Bool@@ -191,12 +199,16 @@ extension LibraryRepository {         switch marker {         case .unreadable(let reason):             return reason-        case .version:-            // The shipped wording (`validateMarkerContentForApp`), preserved.-            return "marker declares an unsupported schema version"+        case .version(let version):+            // The shipped wording of the app-side marker check, plus the digit+            // itself: after Decision 2 this arm also catches the retired `"4"`,+            // `"5"` and `"6"` generations, and a refusal that did not say which+            // one it found would leave the reader with nothing to act on.+            return "marker declares an unsupported schema version "+                + "\"\(abbreviatedMarkerText(version))\"; restore from a backup archive"         case nil:             guard historicalMarkerPresent else {-                // Unreachable: rows 5 and 6 cover every marker-less state.+                // Unreachable: rows 4 and 5 cover every marker-less state.                 return "the library is in a state this build does not recognise"             }             return "a historical readiness marker sits beside the store and no current one does; "

diff --git a/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+ComposedTeaching.swift b/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+ComposedTeaching.swiftindex 2b65c31..3d10744 100644--- a/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+ComposedTeaching.swift+++ b/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+ComposedTeaching.swift@@ -472,11 +472,7 @@ extension LibraryRepository {                 operation: "building composed teaching basis",                 reason: "no Site exists for hostname '\(hostname)'")         }-        guard let siteMode = SiteMode(rawValue: site.modeRaw) else {-            throw LibraryRepositoryError.corruptLibrary(-                operation: "building composed teaching basis",-                reason: "Site '\(hostname)' has invalid mode '\(site.modeRaw)'")-        }+        let siteMode = try Self.requireKnownSiteMode(of: site, hostname: hostname)          let currentTitleRule: ComposedTitleRuleBasis?         if let active = site.patternValues.first(where: \.isActive) {

diff --git a/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+ConfirmImport.swift b/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+ConfirmImport.swiftindex 2a2fa6f..3104c93 100644--- a/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+ConfirmImport.swift+++ b/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+ConfirmImport.swift@@ -186,9 +186,7 @@ extension LibraryRepository {                 if existing.junkSuffixRule == nil { existing.junkSuffixRule = record.junkSuffixRule }                 continue             }-            let site = Site(hostname: record.hostname, displayName: record.displayName)-            site.modeRaw = record.mode.rawValue-            site.junkSuffixRule = record.junkSuffixRule+            let site = ArchiveRecordBuilders.makeSite(record)             context.insert(site)             sitesByHostname[record.hostname] = site             rowsByHostname[record.hostname, default: []].append(site)@@ -200,21 +198,15 @@ extension LibraryRepository {         // both histories start at v1 — which the union below is what repairs.         var patternIDs = Set(try context.fetch(FetchDescriptor<TitlePattern>()).map(\.id))         for record in payload.titlePatterns where patternIDs.insert(record.id).inserted {-            let pattern = try TitlePattern(-                id: record.id, version: record.version, isActive: record.isActive,-                createdAt: record.createdAt, definition: record.definition,-                site: sitesByHostname[record.siteHostname])-            pattern.trimPrefix = record.trimPrefix-            pattern.trimSuffix = record.trimSuffix-            context.insert(pattern)+            context.insert(+                try ArchiveRecordBuilders.makeTitlePattern(+                    record, site: sitesByHostname[record.siteHostname]))         }         var ruleIDs = Set(try context.fetch(FetchDescriptor<URLRulePattern>()).map(\.id))         for record in payload.urlRules where ruleIDs.insert(record.id).inserted {-            let rule = try URLRulePattern(-                id: record.id, version: record.version, isCurrent: record.isCurrent,-                createdAt: record.createdAt, origin: record.origin,-                definition: record.definition, site: sitesByHostname[record.siteHostname])-            context.insert(rule)+            context.insert(+                try ArchiveRecordBuilders.makeURLRule(+                    record, site: sitesByHostname[record.siteHostname]))         }         try saveStrategy.save(context) @@ -231,15 +223,14 @@ extension LibraryRepository {             grouping: try context.fetch(FetchDescriptor<Work>()), by: \.id)          // The type list is merged **before** any Work is applied (Reqs 7.3, 7.4,-        // 7.8). A 5/6 or 6/7 work cites its type by identifier, so the alias rows-        // and minted entries that make those citations resolve have to be in the-        // store by the time the assignment is written — otherwise every-        // cross-library import would land as unresolved and heal only if sync-        // happened to deliver another library's rows, which it never will.-        let typeRecords = payload.workTypeRecords-        if !typeRecords.types.isEmpty || !typeRecords.works.isEmpty {+        // 7.8). A work cites its type by identifier, so the alias rows and minted+        // entries that make those citations resolve have to be in the store by+        // the time the assignment is written — otherwise every cross-library+        // import would land as unresolved and heal only if sync happened to+        // deliver another library's rows, which it never will.+        if !payload.workTypes.isEmpty || !payload.works.isEmpty {             try mergeImportedWorkTypes(-                workTypes: typeRecords.types, works: typeRecords.works,+                workTypes: payload.workTypes, works: payload.works,                 exportedAt: exportedAt, importedAt: importedAt,                 context: context, saveStrategy: saveStrategy)         }@@ -247,23 +238,10 @@ extension LibraryRepository {         // Fetched once for the whole import: tornness is an authored-content         // question, and the type table does not move again while this pass runs.         let types = try workTypeDirectory(context: context)-        switch payload {-        case .v4Archive(let archive):-            try commitWorks(-                archive.works, into: &workRows, sitesByHostname: sitesByHostname,-                types: types, context: context, batchSize: batchSize,-                saveStrategy: saveStrategy)-        case .v5Archive(let archive):-            try commitWorks(-                archive.works, into: &workRows, sitesByHostname: sitesByHostname,-                types: types, context: context, batchSize: batchSize,-                saveStrategy: saveStrategy)-        case .v6Archive(let archive):-            try commitWorks(-                archive.works, into: &workRows, sitesByHostname: sitesByHostname,-                types: types, context: context, batchSize: batchSize,-                saveStrategy: saveStrategy)-        }+        try commitWorks(+            payload.works, into: &workRows, sitesByHostname: sitesByHostname,+            types: types, context: context, batchSize: batchSize,+            saveStrategy: saveStrategy)          // The row an Entry's assignment *points* at. Every row of the group is         // the same Work (Req 5.5), so one deterministic target is enough.@@ -300,14 +278,8 @@ extension LibraryRepository {                         existing.work = record.workID.flatMap { workTargets[$0] }                     }                 } else {-                    let entry = Entry(-                        id: record.id, captureTitle: record.captureTitle,-                        captureTitleSource: record.captureTitleSource,-                        rawURLString: record.rawURL, canonicalURLString: record.canonicalURL,-                        hostname: record.hostname, entryIdentityKey: record.entryIdentityKey,-                        timestamp: record.firstCapturedAt)+                    let entry = ArchiveRecordBuilders.makeEntry(record)                     context.insert(entry)-                    apply(record, to: entry)                     entry.site = sitesByHostname[record.hostname]                     entry.work = record.workID.flatMap { workTargets[$0] }                     entryRows[record.id] = [entry]@@ -319,12 +291,12 @@ extension LibraryRepository {         // (4) The characters, their suppressions and their coverage — after the         // Works and Entries they attach to, so a character's work reference and         // a coverage pair's source are both already in the store-        // (`character-extraction` Req 6.1). Only 6/7 carries them; the earlier-        // generations import with no characters created, which is the same-        // requirement's other half.-        if case .v6Archive(let archive) = payload {+        // (`character-extraction` Req 6.1). An archive carrying none of the+        // three skips the step and its save, like the type merge above.+        if !payload.characters.isEmpty || !payload.suppressions.isEmpty+            || !payload.coverage.isEmpty {             try mergeImportedCharacters(-                archive, workTargets: workTargets, workRows: workRows,+                payload, workTargets: workTargets, workRows: workRows,                 entryRows: entryRows, context: context)             try saveStrategy.save(context)         }@@ -392,11 +364,8 @@ extension LibraryRepository {                         existing.site = sitesByHostname[record.siteHostname]                     }                 } else {-                    let work = Work(-                        id: record.id, displayTitle: record.displayTitle,-                        siteHostname: record.siteHostname, timestamp: record.createdAt)+                    let work = ArchiveRecordBuilders.makeWork(record)                     context.insert(work)-                    apply(record, to: work)                     work.site = sitesByHostname[record.siteHostname]                     workRows[record.id] = [work]                 }

diff --git a/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+Contracts.swift b/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+Contracts.swiftindex 8026d07..6723ed3 100644--- a/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+Contracts.swift+++ b/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+Contracts.swift@@ -7,6 +7,26 @@ extension LibraryRepository {      // MARK: - Basis builders (shared) +    /// The Site's mode, or a `.quarantined` refusal when the raw value is+    /// outside the closed set.+    ///+    /// A mode outside the closed set is not coerced (the reasoning is at+    /// `+Sites.swift`'s `siteSnapshot`: every action teaching offers is+    /// mode-dependent, so `.untaught` would offer teaching for a state nothing+    /// here understands). It is refused as a quarantined Site rather than as+    /// library corruption — the row is a per-Site diagnosis, which is what the+    /// validator already records for it, and re-teaching is the repair. In+    /// practice the quarantine gate refuses first.+    internal static func requireKnownSiteMode(of site: Site, hostname: String) throws -> SiteMode {+        guard let mode = SiteMode(rawValue: site.modeRaw) else {+            throw LibraryRepositoryError.quarantined(+                hostname: hostname,+                reason: "Site mode raw value '\(site.modeRaw)' is not one this app defines"+            )+        }+        return mode+    }+     /// Build a TeachingBasis from a fresh context for the given hostname.     /// Validates closed Site/pattern state: no duplicate Sites (handled by fetchSites),     /// valid mode, mode-consistent patterns, positive site-unique versions, valid definitions.@@ -24,12 +44,7 @@ extension LibraryRepository {             )         } -        guard let siteMode = SiteMode(rawValue: site.modeRaw) else {-            throw LibraryRepositoryError.corruptLibrary(-                operation: "building teaching basis",-                reason: "Site '\(hostname)' has invalid mode raw value '\(site.modeRaw)'"-            )-        }+        let siteMode = try Self.requireKnownSiteMode(of: site, hostname: hostname)          // Articles mode is not valid at this gate/path         guard siteMode != .articles else {@@ -121,7 +136,7 @@ extension LibraryRepository {             predicate: #Predicate { $0.siteHostname == hostname }         )         let works = try context.fetch(workDescriptor).map { work -> WorkBasisEntry in-            try Self.workBasisEntry(from: work, operation: "building teaching basis")+            Self.workBasisEntry(from: work)         }.sorted { $0.id.uuidString < $1.id.uuidString }          return TeachingBasis(

diff --git a/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+EntryDetail.swift b/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+EntryDetail.swiftindex d31fcc1..1f05e1f 100644--- a/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+EntryDetail.swift+++ b/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+EntryDetail.swift@@ -40,13 +40,7 @@ extension LibraryRepository {             let site = sites.first             let siteMode: SiteMode             if let site {-                guard let mode = SiteMode(rawValue: site.modeRaw) else {-                    throw LibraryRepositoryError.quarantined(-                        hostname: hostname,-                        reason: "Site mode raw value '\(site.modeRaw)' is not one this app defines"-                    )-                }-                siteMode = mode+                siteMode = try Self.requireKnownSiteMode(of: site, hostname: hostname)             } else {                 siteMode = .untaught             }

diff --git a/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+ReparseCapture.swift b/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+ReparseCapture.swiftindex 2cc4835..3c0e4d4 100644--- a/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+ReparseCapture.swift+++ b/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+ReparseCapture.swift@@ -496,7 +496,7 @@ extension LibraryRepository {         if site != nil, self.quarantineReason(hostname: hostname) != nil {             let workDescriptor = FetchDescriptor<Work>(predicate: #Predicate { $0.siteHostname == hostname })             let worksBasis = try context.fetch(workDescriptor).map { work -> WorkBasisEntry in-                try Self.workBasisEntry(from: work, operation: "building quarantined capture basis")+                Self.workBasisEntry(from: work)             }.sorted { $0.id.uuidString < $1.id.uuidString }             return CaptureBasis(                 siteMode: .untaught, hostname: hostname, activePattern: nil,@@ -505,12 +505,7 @@ extension LibraryRepository {          let siteMode: SiteMode         if let site {-            guard let mode = SiteMode(rawValue: site.modeRaw) else {-                throw LibraryRepositoryError.corruptLibrary(-                    operation: "building capture basis",-                    reason: "Site '\(hostname)' has invalid mode raw value '\(site.modeRaw)'"-                )-            }+            let mode = try Self.requireKnownSiteMode(of: site, hostname: hostname)             if mode == .articles {                 guard capabilities.supportsArticles else {                     throw LibraryRepositoryError.invalidInput(@@ -589,8 +584,8 @@ extension LibraryRepository {             types: try Self.workTypeDirectory(context: context))             .values             .sorted { $0.id.uuidString < $1.id.uuidString }-        let worksBasis = try siteWorks.map { group -> WorkBasisEntry in-            try Self.workBasisEntry(from: group.carrier, operation: "building capture basis")+        let worksBasis = siteWorks.map { group -> WorkBasisEntry in+            Self.workBasisEntry(from: group.carrier)         }         let composedWorks = siteWorks.map { group in             ComposedWorkBasis(

diff --git a/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+WorkMerge.swift b/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+WorkMerge.swiftindex d915328..3cfcb8a 100644--- a/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+WorkMerge.swift+++ b/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+WorkMerge.swift@@ -509,13 +509,12 @@ extension LibraryRepository {         let workSnapshot = try snapshot(             group, canonicalWorkIDs: [:], types: try workTypeDirectory(context: context)) -        // Build identity snapshot-        guard let state = WorkURLIdentityState(rawValue: work.urlIdentityStateRaw) else {-            throw LibraryRepositoryError.corruptLibrary(-                operation: "building Merge Work basis",-                reason: "Work has unknown URL identity state"-            )-        }+        // Build identity snapshot. An identity state this build has no case for+        // reads as `.none` through the tolerant accessor (Q2) rather than+        // refusing the sheet: a value from a newer build is data, not damage.+        // The *partial* rule reference below still refuses — a half-written+        // citation is an invariant about this row's own columns.+        let state = work.urlIdentityState         let reference: URLRuleReference?         if let id = work.urlIdentityRuleID, let version = work.urlIdentityRuleVersion {             reference = try URLRuleReference(id: id, version: version)@@ -562,12 +561,8 @@ extension LibraryRepository {         let work = group.representative         let workContent = group.presentedContent -        guard let state = WorkURLIdentityState(rawValue: work.urlIdentityStateRaw) else {-            throw LibraryRepositoryError.corruptLibrary(-                operation: "building Work URL basis",-                reason: "Work has unknown URL identity state"-            )-        }+        // Tolerated exactly as the Merge basis tolerates it (Q2).+        let state = work.urlIdentityState         let reference: URLRuleReference?         if let id = work.urlIdentityRuleID, let version = work.urlIdentityRuleVersion {             do {

diff --git a/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository.swift b/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository.swiftindex cbf2ae0..3da5478 100644--- a/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository.swift+++ b/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository.swift@@ -387,12 +387,21 @@ public actor LibraryRepository {             // and the Site union has just moved it. Derived here, never             // remembered — the same rule the Site work list follows.             if runsDuplicatePhase {+                // One fold of the type table for the whole phase, built here+                // rather than inside each half: the scan canonicalizes work+                // assignments through it and the reconciler's carrier gate reads+                // it, and both want the *same* answer. Built after+                // `WorkTypeReconciler.run` because that is the pass that moves+                // the table; nothing between there and here writes it again.+                let types = try Self.workTypeDirectory(context: context)                 duplicatePass = try DuplicateReconciler.run(-                    scan: try DuplicateScan.run(context: context, ruleRows: work.ruleRows),+                    scan: try DuplicateScan.run(+                        context: context, ruleRows: work.ruleRows, types: types),                     ledger: &ledger,                     batchSize: Self.bulkOperationBatchSize,                     context: context,-                    saveStrategy: self.saveStrategy)+                    saveStrategy: self.saveStrategy,+                    types: types)             }             return pass         }@@ -1380,8 +1389,8 @@ public actor LibraryRepository {      // The four `map*Record` mappers stood here — `Entry`/`Work`/`Site`/     // `TitlePattern` to the V2 `*Record` structs, for the snapshot-    // `validateStore` validated. They went with it; the live 4/4 export path has-    // its own `mapV4*Record` family in `BackupV4Exporter`, over `BackupV4Entry`+    // `validateStore` validated. They went with it; the live export path has its+    // own `map*Record` family in `BackupArchiveProjection`, over `BackupV4Entry`     // and friends, and never used these.      internal func withLockedContext<Value: Sendable>(@@ -1416,17 +1425,17 @@ public actor LibraryRepository {             modifiedAt: snapshot.modifiedAt)     } -    /// Construct a WorkBasisEntry from a Work model, throwing on invalid raw provenance.-    internal static func workBasisEntry(from work: Work, operation: String) throws -> WorkBasisEntry {-        guard let prov = TitleProvenance(rawValue: work.titleProvenanceRaw) else {-            throw LibraryRepositoryError.corruptLibrary(-                operation: operation,-                reason: "Work \(work.id) has invalid titleProvenanceRaw '\(work.titleProvenanceRaw)'"-            )-        }-        return WorkBasisEntry(+    /// Construct a WorkBasisEntry from a Work model.+    ///+    /// It used to throw `corruptLibrary` naming the raw provenance, and carried+    /// an `operation:` label for that message alone. A raw value this build has+    /// no case for now reads as the column's default through+    /// `Work.titleProvenance` (Q2), so the basis builds for a row a newer build+    /// wrote instead of failing the whole capture over it.+    internal static func workBasisEntry(from work: Work) -> WorkBasisEntry {+        WorkBasisEntry(             id: work.id, displayTitle: work.displayTitle,-            lastParsedTitle: work.lastParsedTitle, titleProvenance: prov,+            lastParsedTitle: work.lastParsedTitle, titleProvenance: work.titleProvenance,             siteHostname: work.siteHostname, createdAt: work.createdAt,             modifiedAt: work.modifiedAt         )@@ -1480,12 +1489,14 @@ public actor LibraryRepository {     /// implies a damaged store — it implies a type authored elsewhere, and     /// refusing the read would make ordinary cross-device use present as     /// corruption.+    ///+    /// The title-provenance refusal is gone for the same reason (Q2): it read+    /// the raw column and threw `corruptLibrary` on a spelling this build has no+    /// case for, which is what a library mid-rollout legitimately carries. The+    /// snapshot now reads `work.titleProvenance`, the tolerant accessor.     internal static func snapshot(         _ work: Work, types: WorkTypeDirectory     ) throws -> WorkSnapshot {-        guard let provenance = TitleProvenance(rawValue: work.titleProvenanceRaw) else {-            throw LibraryRepositoryError.corruptLibrary(operation: "mapping Work", reason: "invalid title provenance")-        }         let entries = try work.entryValues.map(snapshot).sorted(by: entryActivityOrder)         return WorkSnapshot(             id: work.id,@@ -1497,7 +1508,7 @@ public actor LibraryRepository {             genericNotes: work.genericNotes,             typeDisplay: types.display(of: WorkTypeAssignment.assignment(of: work)),             genreTags: work.genreTags,-            titleProvenance: provenance,+            titleProvenance: work.titleProvenance,             createdAt: work.createdAt,             modifiedAt: work.modifiedAt,             entries: entries@@ -1546,43 +1557,32 @@ public actor LibraryRepository {         return true     } +    /// The four raw enum columns are read through the model's tolerant accessors+    /// (Q2): a spelling this build has no case for reads as the column's default+    /// — nil for `ratingRaw`, which is optional — rather than failing the whole+    /// screen with `corruptLibrary`.+    ///+    /// `FieldProvenance`'s throwing init stays. It validates the *combination*+    /// of kind, pattern id and version, which is an invariant about the row's+    /// own columns rather than a spelling from a newer build, and nothing about+    /// enum tolerance makes an id-less `.pattern` provenance legal. The one+    /// thing it must not do is refuse a combination the coercion itself+    /// manufactured — see `toleratedProvenance`.     internal static func snapshot(_ entry: Entry) throws -> EntrySnapshot {-        guard let chapterKind = FieldProvenanceKind(rawValue: entry.chapterTitleProvenanceRaw) else {-            throw LibraryRepositoryError.corruptLibrary(-                operation: "mapping Entry",-                reason: "invalid chapter provenance kind"-            )-        }-        guard let assignmentKind = FieldProvenanceKind(rawValue: entry.workAssignmentProvenanceRaw) else {-            throw LibraryRepositoryError.corruptLibrary(-                operation: "mapping Entry",-                reason: "invalid assignment provenance kind"-            )-        }-        let chapter = try FieldProvenance(-            kind: chapterKind,+        let chapter = try Self.toleratedProvenance(+            raw: entry.chapterTitleProvenanceRaw,             patternID: entry.chapterPatternID,             patternVersion: entry.chapterPatternVersion         )-        let assignment = try FieldProvenance(-            kind: assignmentKind,+        let assignment = try Self.toleratedProvenance(+            raw: entry.workAssignmentProvenanceRaw,             patternID: entry.workPatternID,             patternVersion: entry.workPatternVersion         )-        guard let titleSource = CaptureTitleSource(rawValue: entry.captureTitleSourceRaw) else {-            throw LibraryRepositoryError.corruptLibrary(operation: "mapping Entry", reason: "invalid title source")-        }-        let rating: Rating?-        if let raw = entry.ratingRaw {-            guard let parsed = Rating(rawValue: raw) else {-                throw LibraryRepositoryError.corruptLibrary(operation: "mapping Entry", reason: "invalid rating")-            }-            rating = parsed-        } else { rating = nil }         return EntrySnapshot(             id: entry.id,             captureTitle: entry.captureTitle,-            captureTitleSource: titleSource,+            captureTitleSource: entry.captureTitleSource,             rawURLString: entry.rawURLString,             canonicalURLString: entry.canonicalURLString,             hostname: entry.hostname,@@ -1591,7 +1591,7 @@ public actor LibraryRepository {             chapterTitle: entry.chapterTitle,             chapterTitleProvenance: chapter,             note: entry.note,-            rating: rating,+            rating: entry.rating,             firstCapturedAt: entry.firstCapturedAt,             lastSharedAt: entry.lastSharedAt,             modifiedAt: entry.modifiedAt,@@ -1603,6 +1603,30 @@ public actor LibraryRepository {         )     } +    /// A provenance kind read tolerantly, with the citation columns dropped+    /// where the raw spelling is one this build has no case for.+    ///+    /// The coercion is a presentation choice about the *kind* (Q2), and it+    /// cannot be allowed to invent an illegal row. A newer build's provenance+    /// kind legitimately cites a pattern id and version; coerced to `.none`,+    /// which carries neither, the pair would fail `FieldProvenance`'s+    /// combination check and take the whole snapshot down — exactly the+    /// screen-wide refusal the tolerance exists to remove. So the citation+    /// travels with the kind it belonged to: a coerced row presents as uncited.+    ///+    /// A spelling this build *does* know keeps the check untouched, illegal+    /// combination and all: an id-less `.pattern` is a fault in the row's own+    /// columns, not a message from a newer build.+    private static func toleratedProvenance(+        raw: String, patternID: UUID?, patternVersion: Int?+    ) throws -> FieldProvenance {+        guard let kind = FieldProvenanceKind(rawValue: raw) else {+            return try FieldProvenance(kind: .none)+        }+        return try FieldProvenance(+            kind: kind, patternID: patternID, patternVersion: patternVersion)+    }+     // `validateStore` stood here — the superseded opener's validation, via the     // since-deleted `V2LibraryValidator` over a backup snapshot of the whole     // store. Both went with `openCurrent`; the surviving openers validate

diff --git a/Packages/AsterismCore/Sources/AsterismCore/LibraryValidator.swift b/Packages/AsterismCore/Sources/AsterismCore/LibraryValidator.swiftindex fceba45..9e36ef0 100644--- a/Packages/AsterismCore/Sources/AsterismCore/LibraryValidator.swift+++ b/Packages/AsterismCore/Sources/AsterismCore/LibraryValidator.swift@@ -142,12 +142,16 @@ public enum LibraryValidator {             // Membership indexes accept any row of a duplicated application UUID             // and any record reachable across the hostname boundary; iteration             // stays over this hostname's own records.+            //+            // Rows are ordered through `GroupOrdering`, which reads only synced+            // authored content, so two devices holding the same rows name the+            // same representative and reach the same verdict (Q12).             let entryIndex = index(                 grouping: entries + works.flatMap(\.entryValues),-                by: { $0.id.uuidString }, RecordResolutionOrder.sortedEntries)+                by: { $0.id.uuidString }, GroupOrdering.sortedEntryRows)             let workIndex = index(                 grouping: works + entries.compactMap(\.work),-                by: { $0.id.uuidString }, RecordResolutionOrder.sortedWorks)+                by: { $0.id.uuidString }, GroupOrdering.sortedWorkRows)              for site in rows {                 do { try validate(site: site, allPatterns: allPatterns, allRules: allRules) }@@ -300,8 +304,15 @@ public enum LibraryValidator {         }         // Membership is tested against the whole group, so a duplicate         // application UUID does not also register as a broken Work/Entry inverse.-        let entries = index(entryRows, RecordResolutionOrder.sortedEntries)-        let works = index(workRows, RecordResolutionOrder.sortedWorks)+        //+        // `GroupOrdering` reads only synced authored content, where the retired+        // `RecordResolutionOrder` led with a timestamp and ended on a+        // device-local `PersistentIdentifier`. Wherever a group's rows differ in+        // a synced field the two orders name different rows, and the verdict+        // follows the new one — intended, and pinned by+        // `LibraryValidatorToleranceTests` (Q12).+        let entries = index(entryRows, GroupOrdering.sortedEntryRows)+        let works = index(workRows, GroupOrdering.sortedWorkRows)          // No duplicate-identity diagnoses are produced here (Q57). Rows sharing         // an application UUID are reader workload or benign convergence, and

diff --git a/Packages/AsterismCore/Sources/AsterismCore/M4PerformanceFixture.swift b/Packages/AsterismCore/Sources/AsterismCore/M4PerformanceFixture.swiftindex dca1e81..705560e 100644--- a/Packages/AsterismCore/Sources/AsterismCore/M4PerformanceFixture.swift+++ b/Packages/AsterismCore/Sources/AsterismCore/M4PerformanceFixture.swift@@ -200,10 +200,12 @@ extension LibraryRepository {                 context.delete(taught)              case .duplicateIdentity:-                // A twin of Entry 0 carrying the same application UUID and a-                // later `firstCapturedAt`, so `RecordResolutionOrder` keeps the-                // original as the winner and the graph the validator walks is-                // otherwise the fixture unchanged.+                // A twin of Entry 0 carrying the same application UUID, the same+                // capture title, a longer `rawURLString` (the original's plus a+                // suffix) and a later `firstCapturedAt`. `GroupOrdering` reaches+                // the URL before either timestamp, so the original stays the+                // winner and the graph the validator walks is otherwise the+                // fixture unchanged.                 let twinnedID = Self.m4FixtureUUID(namespace: 11, index: 0)                 let originals = try context.fetch(                     FetchDescriptor<Entry>(predicate: #Predicate { $0.id == twinnedID }))

diff --git a/Packages/AsterismCore/Sources/AsterismCore/Models.swift b/Packages/AsterismCore/Sources/AsterismCore/Models.swiftindex aca8821..7589653 100644--- a/Packages/AsterismCore/Sources/AsterismCore/Models.swift+++ b/Packages/AsterismCore/Sources/AsterismCore/Models.swift@@ -25,6 +25,46 @@ public typealias WorkTypeEntity = AsterismSchemaV7.WorkTypeEntity public typealias CharacterRecord = AsterismSchemaV7.Character public typealias CharacterSuppression = AsterismSchemaV7.CharacterSuppression +/// The presentation-enum tolerance policy for the **model accessors**, in one+/// place (Q2).+///+/// Not the only coercion in the codebase, and not meant to be: the archive+/// paths spell their own `?? .default` — `WorkTypeDirectory`,+/// `ArchiveRecordBuilders`, `BackupV6Types`, `BackupArchiveProjection` — each+/// answering what *that* wire may say rather than what a stored column may+/// hold. Those are deliberately separate policies, not omissions from this one.+///+/// A raw value this build has no case for is **data, not damage**: a+/// CloudKit-mirrored library legitimately carries spellings a newer build+/// wrote during a rollout, and refusing to read the column would turn ordinary+/// cross-device state into "corrupt library". So every presentation enum column+/// reads through one of these two bodies and yields the column's default — nil+/// where the column is optional, which is that column's default.+///+/// Rule *definitions* are deliberately exempt and keep their semantics (Q3):+/// `TitlePattern.definition` and `URLRulePattern.definition` throw, and+/// `URLRulePattern.origin` stays Optional. Substituting a rule the reader never+/// taught did real damage once — see the note on `URLRulePattern.definition`.+///+/// Writing is unaffected, and the export path still reads the raw columns+/// itself and refuses what the wire cannot spell (Q8,+/// `BackupArchiveProjection.requireRepresentableValues`), so tolerance here can+/// never produce a lossy archive.+internal enum ToleratedEnum {+    /// A required column: an unrecognised spelling reads as `fallback`.+    static func read<Value: RawRepresentable>(+        _ raw: Value.RawValue, default fallback: Value+    ) -> Value {+        Value(rawValue: raw) ?? fallback+    }++    /// An optional column: an absent value and an unrecognised spelling both+    /// read as nil.+    static func read<Value: RawRepresentable>(_ raw: Value.RawValue?) -> Value? {+        raw.flatMap(Value.init(rawValue:))+    }+}+ extension AsterismSchemaV7 {  @Model@@ -121,32 +161,32 @@ public final class Entry {     }      public var captureTitleSource: CaptureTitleSource {-        get { CaptureTitleSource(rawValue: captureTitleSourceRaw) ?? .manual }+        get { ToleratedEnum.read(captureTitleSourceRaw, default: .manual) }         set { captureTitleSourceRaw = newValue.rawValue }     }      public var rating: Rating? {-        get { ratingRaw.flatMap(Rating.init(rawValue:)) }+        get { ToleratedEnum.read(ratingRaw) }         set { ratingRaw = newValue?.rawValue }     }      public var identityBasis: EntryIdentityBasis {-        get { EntryIdentityBasis(rawValue: identityBasisRaw) ?? .conservative }+        get { ToleratedEnum.read(identityBasisRaw, default: .conservative) }         set { identityBasisRaw = newValue.rawValue }     }      public var chapterTitleProvenance: FieldProvenanceKind {-        get { FieldProvenanceKind(rawValue: chapterTitleProvenanceRaw) ?? .none }+        get { ToleratedEnum.read(chapterTitleProvenanceRaw, default: .none) }         set { chapterTitleProvenanceRaw = newValue.rawValue }     }      public var workAssignmentProvenance: FieldProvenanceKind {-        get { FieldProvenanceKind(rawValue: workAssignmentProvenanceRaw) ?? .none }+        get { ToleratedEnum.read(workAssignmentProvenanceRaw, default: .none) }         set { workAssignmentProvenanceRaw = newValue.rawValue }     }      public var workURLAssignmentKind: URLWorkAssignmentKind? {-        get { workURLAssignmentKindRaw.flatMap(URLWorkAssignmentKind.init(rawValue:)) }+        get { ToleratedEnum.read(workURLAssignmentKindRaw) }         set { workURLAssignmentKindRaw = newValue?.rawValue }     } }@@ -211,17 +251,17 @@ public final class Work {     }      public var type: WorkType {-        get { WorkType(rawValue: typeRaw) ?? .other }+        get { ToleratedEnum.read(typeRaw, default: .other) }         set { typeRaw = newValue.rawValue }     }      public var titleProvenance: TitleProvenance {-        get { TitleProvenance(rawValue: titleProvenanceRaw) ?? .manual }+        get { ToleratedEnum.read(titleProvenanceRaw, default: .manual) }         set { titleProvenanceRaw = newValue.rawValue }     }      public var urlIdentityState: WorkURLIdentityState {-        get { WorkURLIdentityState(rawValue: urlIdentityStateRaw) ?? .none }+        get { ToleratedEnum.read(urlIdentityStateRaw, default: .none) }         set { urlIdentityStateRaw = newValue.rawValue }     } @@ -265,7 +305,7 @@ public final class Site {     }      public var mode: SiteMode {-        get { SiteMode(rawValue: modeRaw) ?? .untaught }+        get { ToleratedEnum.read(modeRaw, default: .untaught) }         set { modeRaw = newValue.rawValue }     } @@ -623,7 +663,7 @@ public final class WorkTypeEntity {     /// Unknown raw values read as `.active`, matching every other enum column in     /// this schema: an unrecognised state is tolerated data, not corruption.     public var state: WorkTypeState {-        get { WorkTypeState(rawValue: stateRaw) ?? .active }+        get { ToleratedEnum.read(stateRaw, default: .active) }         set { stateRaw = newValue.rawValue }     } }@@ -753,12 +793,12 @@ public final class CharacterSuppression {     /// An unknown raw value reads as `.candidate`, matching every other enum     /// column in this schema: unrecognised data is tolerated, not corruption.     public var kind: CharacterSuppressionKind {-        get { CharacterSuppressionKind(rawValue: kindRaw) ?? .candidate }+        get { ToleratedEnum.read(kindRaw, default: .candidate) }         set { kindRaw = newValue.rawValue }     }      public var status: CharacterSuppressionStatus {-        get { CharacterSuppressionStatus(rawValue: statusRaw) ?? .active }+        get { ToleratedEnum.read(statusRaw, default: .active) }         set { statusRaw = newValue.rawValue }     } 

diff --git a/Packages/AsterismCore/Sources/AsterismCore/SiteRelationshipPopulationPass.swift b/Packages/AsterismCore/Sources/AsterismCore/SiteRelationshipPopulationPass.swiftindex 3a1a473..3a1274a 100644--- a/Packages/AsterismCore/Sources/AsterismCore/SiteRelationshipPopulationPass.swift+++ b/Packages/AsterismCore/Sources/AsterismCore/SiteRelationshipPopulationPass.swift@@ -1,51 +1,46 @@ import Foundation import SwiftData +// Compiled only for Development or explicit Release performance-test builds, as+// the fixtures that call it are: since `data-model-cleanups` Decision 2 retired+// the `"4"` marker generation, this pass has no production caller and must not+// be linked into a shipping build.+#if DEBUG || ASTERISM_PERFORMANCE_TESTING /// Populates `Entry.site` and `Work.site` from their hostname strings, for a-/// library whose relationships are unset (Req 2.1, 2.2).+/// library whose relationships are unset. ///-/// **Named for what it does, not for the migration it served** (Req 1.8). It-/// arrived as the V4 → V5 relationship pass, filling the columns the lightweight-/// conversion had added and left nil, and it outlived that chain because two-/// callers still need it:+/// **Fixture and test support, and nothing else** — hence the guard above,+/// which is the same one the fixtures that call it carry. It arrived as the+/// V4 → V5 relationship pass, filling the columns the lightweight conversion+/// had added and left nil, and its last production caller was `openForApp`'s+/// marker-lagging branch, deleted with the `"4"` generation+/// (`data-model-cleanups` Decision 2). No shipped path populates these columns+/// in bulk any more: every write site sets the relationship as it writes. ///-/// * `openForApp`'s marker-lagging path. A `"4"` readiness marker records that-///   this pass has not run over the library — *not* that the schema lags — so-///   the app runs it, saves, validates and only then republishes `"5"`-///   (Decision 4). The share extension never runs it: it opens a `"5"` marker-///   only, so the state cannot reach it (Q10, Q14, Req 2.13).-/// * `ToleratedStateFixture`, which depends on the re-pinning below to build the-///   graph a capture would (Q17).+/// What kept it rather than inlining the assignment into its callers (Q14's+/// fallback, taken) is the row selection. It resolves each hostname through+/// `SiteResolutionOrder` — the same deterministic rule the rest of the app+/// uses — not a last-write-wins map over an unsorted fetch, as the retired V4+/// completion pass built (Q16). `ToleratedStateFixture` depends on exactly that+/// to pin its duplicate-Site-row kind to the row a capture would have chosen+/// (Q17), and two dozen suites depend on it to reach the graph a certified+/// library holds. Reimplementing that per caller would be the same code, spelt+/// more times and agreeing by luck. /// /// It is not interchangeable with `SiteReconciler.heal`, which only fills a nil /// relationship where this one re-pins a record already pointing at a row that /// is no longer the winner. ///-/// Runs under the exclusive lock, app-only — never as a SwiftData custom stage,-/// which would also run inside the share extension.-///-/// Row selection resolves each hostname through `SiteResolutionOrder` — the-/// same deterministic rule the rest of the app uses — not a last-write-wins-/// map over an unsorted fetch, as the retired V4 completion pass built (Q16).-/// Duplicate Site rows cannot exist when this runs for real (they arise only-/// from mirroring, which ships after), so the determinism is about tests,-/// fixtures, and re-runs — but "arbitrary" would falsify the determinism the-/// milestone claims.-///-/// One save at the end, nothing batched: Req 2.4 rests on the atomicity of-/// this save, with the readiness marker published by the caller only after it-/// returns (Q15). An interruption leaves either no progress or all of it, and-/// the next launch runs the pass again — idempotent by construction (Q12).+/// One save at the end, nothing batched. An interruption leaves either no+/// progress or all of it, and re-running converges — idempotent by construction+/// (Q12). enum SiteRelationshipPopulationPass {     /// Populates both relationships and saves once. A hostname matching no-    /// Site row leaves the relationship nil: that is the tolerated state this-    /// milestone exists to make survivable, not an error (Req 2.1). The caller-    /// publishes the `"5"` marker only after this returns.+    /// Site row leaves the relationship nil: that is a tolerated state, not an+    /// error, and `ToleratedStateFixture.siteMissing` is built from it.     ///-    /// The save goes through the bootstrap's own `RepositorySaveStrategy` — the-    /// default is a plain `context.save()` — so the failure branch the callers-    /// wrap in `libraryUnavailable("populating the site relationships")` is-    /// reachable from a test rather than only from a real disk fault.+    /// The save goes through a `RepositorySaveStrategy` — the default is a+    /// plain `context.save()` — so a caller can inject a refusing one.     static func run(         context: ModelContext,         saveStrategy: any RepositorySaveStrategy = ModelContextSaveStrategy()@@ -70,3 +65,4 @@ enum SiteRelationshipPopulationPass {         try saveStrategy.save(context)     } }+#endif

diff --git a/Packages/AsterismCore/Tests/AsterismCoreTests/BackupExportDegradedRefusalTests.swift b/Packages/AsterismCore/Tests/AsterismCoreTests/BackupExportDegradedRefusalTests.swiftindex 53dd657..2cde9f5 100644--- a/Packages/AsterismCore/Tests/AsterismCoreTests/BackupExportDegradedRefusalTests.swift+++ b/Packages/AsterismCore/Tests/AsterismCoreTests/BackupExportDegradedRefusalTests.swift@@ -34,7 +34,7 @@ struct BackupExportDegradedRefusalTests {         }         let repository = try fixture.diagnosedRepository() -        let payload = try await repository.backupV4Snapshot()+        let payload = try await repository.backupV6Snapshot()          #expect(Set(payload.sites.map(\.hostname)) == ["present.example", "orphan.example"])         let synthesised = try #require(payload.sites.first { $0.hostname == "orphan.example" })@@ -75,11 +75,11 @@ struct BackupExportDegradedRefusalTests {         #expect(await repository.diagnostics.quarantineMap()["quarantined.example"] != nil)          let staging = fixture.directory.appending(path: "staging")-        let exporter = BackupV4Exporter(repository: repository, stagingDirectory: staging)+        let exporter = BackupV6Exporter(repository: repository, stagingDirectory: staging)         let result = try await exporter.export(-            metadata: BackupV4Metadata(appBuild: "1", exportedAt: Date()))+            metadata: BackupV6Metadata(appBuild: "1", exportedAt: Date())) -        let decoded = try BackupV4Codec.decode(try Data(contentsOf: result.fileURL))+        let decoded = try BackupV6Codec.decode(try Data(contentsOf: result.fileURL))         #expect(decoded.payload.entries.count == 1)         #expect(decoded.payload.titlePatterns.count == 2)         // The union demoted one of the two, which is what makes the archive legal@@ -102,7 +102,7 @@ struct BackupExportDegradedRefusalTests {         }         let repository = try fixture.diagnosedRepository() -        let payload = try await repository.backupV4Snapshot()+        let payload = try await repository.backupV6Snapshot()          #expect(payload.sites.count == 1)         let site = try #require(payload.sites.first)@@ -138,7 +138,7 @@ struct BackupExportDegradedRefusalTests {         }         let repository = try fixture.diagnosedRepository() -        let payload = try await repository.backupV4Snapshot()+        let payload = try await repository.backupV6Snapshot()          let pattern = try #require(payload.titlePatterns.first)         #expect(pattern.id == patternID)@@ -168,7 +168,7 @@ struct BackupExportDegradedRefusalTests {         }         let repository = try fixture.diagnosedRepository() -        let payload = try await repository.backupV4Snapshot()+        let payload = try await repository.backupV6Snapshot()          #expect(payload.entries.count == 1)         #expect(payload.entries.first?.id == shared)@@ -193,7 +193,7 @@ struct BackupExportDegradedRefusalTests {         }         let repository = try fixture.diagnosedRepository() -        let error = try await expectRefusal { _ = try await repository.backupV4Snapshot() }+        let error = try await expectRefusal { _ = try await repository.backupV6Snapshot() }          guard case .tornGroups(let payload) = error else {             Issue.record("expected .tornGroups, got \(error)")@@ -216,22 +216,49 @@ struct BackupExportDegradedRefusalTests {             let work = store.insertWork(                 id: workID, hostname: "present.example", title: "A Work", offset: 0)             // The shape a newer app version syncing down produces.-            work.typeRaw = "graphicNovel"+            work.titleProvenanceRaw = "inferred"         }         let repository = try fixture.diagnosedRepository() -        let error = try await expectRefusal { _ = try await repository.backupV4Snapshot() }+        let error = try await expectRefusal { _ = try await repository.backupV6Snapshot() }          guard case .unrepresentableValue(let record, _, let value) = error else {             Issue.record("expected .unrepresentableValue, got \(error)")             return         }         #expect(record.contains(workID.uuidString))-        #expect(value == "graphicNovel")+        #expect(value == "inferred")         // Both halves have to reach the reader: omitting the record is silent         // data loss, so the message must say which record and which value.         #expect(error.description.contains(workID.uuidString))-        #expect(error.description.contains("graphicNovel"))+        #expect(error.description.contains("inferred"))+    }++    /// The counter-case, and the reason the test above no longer uses `typeRaw`.+    ///+    /// A work's stored type is *not* checked for representability: the wire Work+    /// record carries any raw value verbatim (Q34), which is what makes+    /// `configurable-work-types` Req 7.1 — "export succeeds for works of any+    /// type" — true. The check existed for the 4/4 record, which could spell only+    /// the closed set; that record's write path is gone (Decision 2), and the+    /// check went with it rather than being left pinned to a constant.+    @Test("A work type outside the closed set exports verbatim rather than refusing")+    func unrecognisedWorkTypeExportsVerbatim() async throws {+        let fixture = try DegradedExportFixture()+        let workID = UUID()+        try fixture.seed { store in+            store.insertSite(hostname: "present.example")+            let work = store.insertWork(+                id: workID, hostname: "present.example", title: "A Work", offset: 0)+            work.typeRaw = "graphicNovel"+        }+        let repository = try fixture.diagnosedRepository()++        let payload = try await repository.backupV6Snapshot()++        let record = try #require(payload.works.first { $0.id == workID })+        #expect(record.legacyType == "graphicNovel")+        #expect(record.workTypeID == nil)     }      /// The coercing half of the same requirement. `mapV4EntryRecord` read@@ -248,7 +275,7 @@ struct BackupExportDegradedRefusalTests {         }         let repository = try fixture.diagnosedRepository() -        let error = try await expectRefusal { _ = try await repository.backupV4Snapshot() }+        let error = try await expectRefusal { _ = try await repository.backupV6Snapshot() }          guard case .unrepresentableValue(_, _, let value) = error else {             Issue.record("expected .unrepresentableValue, got \(error)")@@ -288,7 +315,7 @@ struct BackupExportDegradedRefusalTests {             works: try context.fetch(FetchDescriptor<Work>()))         #expect(omitted == [staleID]) -        let payload = try await repository.backupV4Snapshot()+        let payload = try await repository.backupV6Snapshot()          #expect(payload.urlRules.map(\.id) == [currentID])         let site = try #require(payload.sites.first)@@ -321,11 +348,11 @@ struct BackupExportDegradedRefusalTests {         }         let repository = try fixture.diagnosedRepository()         let staging = fixture.directory.appending(path: "staging")-        let exporter = BackupV4Exporter(repository: repository, stagingDirectory: staging)+        let exporter = BackupV6Exporter(repository: repository, stagingDirectory: staging)          let error = try await expectRefusal {             _ = try await exporter.export(-                metadata: BackupV4Metadata(appBuild: "1", exportedAt: Date()))+                metadata: BackupV6Metadata(appBuild: "1", exportedAt: Date()))         }          guard case .unrepresentableValue(let record, let field, _) = error else {@@ -356,7 +383,7 @@ struct BackupExportDegradedRefusalTests {         }         let repository = try fixture.diagnosedRepository() -        let error = try await expectRefusal { _ = try await repository.backupV4Snapshot() }+        let error = try await expectRefusal { _ = try await repository.backupV6Snapshot() }          guard case .referencesStillArriving = error else {             Issue.record("expected .referencesStillArriving, got \(error)")@@ -386,7 +413,7 @@ struct BackupExportDegradedRefusalTests {         }         let repository = try fixture.diagnosedRepository() -        let error = try await expectRefusal { _ = try await repository.backupV4Snapshot() }+        let error = try await expectRefusal { _ = try await repository.backupV6Snapshot() }          guard case .referencesStillArriving(let detail) = error else {             Issue.record("expected .referencesStillArriving, got \(error)")@@ -412,11 +439,11 @@ struct BackupExportDegradedRefusalTests {         }         let repository = try fixture.diagnosedRepository()         let staging = fixture.directory.appending(path: "staging")-        let exporter = BackupV4Exporter(repository: repository, stagingDirectory: staging)+        let exporter = BackupV6Exporter(repository: repository, stagingDirectory: staging)          let error = try await expectRefusal {             _ = try await exporter.export(-                metadata: BackupV4Metadata(appBuild: "1", exportedAt: Date()))+                metadata: BackupV6Metadata(appBuild: "1", exportedAt: Date()))         }          guard case .referencesStillArriving = error else {@@ -435,7 +462,7 @@ struct BackupExportDegradedRefusalTests {         }         let repository = try fixture.diagnosedRepository() -        let error = try await expectRefusal { _ = try await repository.backupV4Snapshot() }+        let error = try await expectRefusal { _ = try await repository.backupV6Snapshot() }          guard case .referencesStillArriving = error else {             Issue.record("expected .referencesStillArriving, got \(error)")@@ -460,11 +487,11 @@ struct BackupExportDegradedRefusalTests {         }         let repository = try fixture.diagnosedRepository()         let staging = fixture.directory.appending(path: "staging")-        let exporter = BackupV4Exporter(repository: repository, stagingDirectory: staging)+        let exporter = BackupV6Exporter(repository: repository, stagingDirectory: staging)          let error = try await expectRefusal {             _ = try await exporter.export(-                metadata: BackupV4Metadata(appBuild: "1", exportedAt: Date()))+                metadata: BackupV6Metadata(appBuild: "1", exportedAt: Date()))         }          guard case .tornGroups = error else {@@ -491,7 +518,7 @@ struct BackupExportDegradedRefusalTests {         }         let repository = try fixture.diagnosedRepository() -        let payload = try await repository.backupV4Snapshot()+        let payload = try await repository.backupV6Snapshot()         let target = try Self.importIntoEmptyStore(payload)          // What reconciliation would settle on: one row per hostname holding the@@ -516,7 +543,7 @@ struct BackupExportDegradedRefusalTests {         }         let repository = try fixture.diagnosedRepository() -        let payload = try await repository.backupV4Snapshot()+        let payload = try await repository.backupV6Snapshot()         let target = try Self.importIntoEmptyStore(payload)          let rows = try target.fetch(FetchDescriptor<Site>())@@ -542,12 +569,13 @@ struct BackupExportDegradedRefusalTests {         #expect(await repository.diagnostics.isEmpty)          let staging = fixture.directory.appending(path: "staging")-        let exporter = BackupV4Exporter(repository: repository, stagingDirectory: staging)+        let exporter = BackupV6Exporter(repository: repository, stagingDirectory: staging)         let result = try await exporter.export(-            metadata: BackupV4Metadata(appBuild: "1", exportedAt: Date()))+            metadata: BackupV6Metadata(appBuild: "1", exportedAt: Date())) -        let decoded = try BackupV4Codec.decode(try Data(contentsOf: result.fileURL))-        #expect(decoded.databaseSchemaVersion == 4)+        let decoded = try BackupV6Codec.decode(try Data(contentsOf: result.fileURL))+        #expect(decoded.backupFormatVersion == 6)+        #expect(decoded.databaseSchemaVersion == 7)         #expect(decoded.payload.entries.count == 1)         #expect(decoded.payload.sites.count == 1)         exporter.cleanup(result)@@ -557,12 +585,12 @@ struct BackupExportDegradedRefusalTests {      private func expectRefusal(         _ body: () async throws -> Void-    ) async throws -> BackupV4ExportError {+    ) async throws -> BackupV6ExportError {         do {             try await body()             Issue.record("expected a named refusal, but the export proceeded")             return .snapshotFailed(reason: "no refusal")-        } catch let error as BackupV4ExportError {+        } catch let error as BackupV6ExportError {             return error         }     }@@ -570,18 +598,18 @@ struct BackupExportDegradedRefusalTests {     /// The archive's own import path, into a fresh empty store. Both round-trip     /// tests go through the strict reference validator on the way in, which is     /// what makes "the archive is legal" an assertion rather than a hope.-    private static func importIntoEmptyStore(_ payload: BackupV4Payload) throws -> ModelContext {-        let encoded = try BackupV4Codec.encode(+    private static func importIntoEmptyStore(_ payload: BackupV6Payload) throws -> ModelContext {+        let encoded = try BackupV6Codec.encode(             payload: payload,-            metadata: BackupV4Metadata(appBuild: "1", exportedAt: DegradedExportFixture.epoch))-        let decoded = try BackupV4Codec.decode(encoded)+            metadata: BackupV6Metadata(appBuild: "1", exportedAt: DegradedExportFixture.epoch))+        let decoded = try BackupV6Codec.decode(encoded)          let schema = Schema(versionedSchema: AsterismSchemaV7.self)         let configuration = ModelConfiguration(             schema: schema, isStoredInMemoryOnly: true, cloudKitDatabase: .none)         let container = try ModelContainer(for: schema, configurations: [configuration])         let context = ModelContext(container)-        try LibraryRepository.materializeV4Payload(decoded.payload, into: context)+        try LibraryRepository.materializeArchive(BackupImportPayload(decoded.payload), into: context)         try context.save()         withExtendedLifetime(container) {}         return context

diff --git a/Packages/AsterismCore/Tests/AsterismCoreTests/BackupGoldenExportTests.swift b/Packages/AsterismCore/Tests/AsterismCoreTests/BackupGoldenExportTests.swiftnew file mode 100644index 0000000..ca3bb35--- /dev/null+++ b/Packages/AsterismCore/Tests/AsterismCoreTests/BackupGoldenExportTests.swift@@ -0,0 +1,433 @@+import Foundation+import SwiftData+import Testing++@testable import AsterismCore++/// The byte-for-byte pin on the 6/7 export (`data-model-cleanups`, task 1).+///+/// The backup layer is about to lose two archive generations, three exporters+/// and three error enums, and every one of those deletions touches a body the+/// live export path runs through. Nothing in the existing suites would notice a+/// consolidation that changed a key's spelling, a sort order, or a number's+/// formatting: they assert on decoded *values*, and a payload that re-encodes to+/// different bytes still decodes to the same values.+///+/// So this suite asserts on the bytes. A library populating **every** payload+/// array is built through the real import path, exported through the real+/// projection and codec, and compared to a recorded archive character for+/// character. It was written and made green before the first deletion and is+/// expected to stay green through all of them; a diff here is a change to what a+/// backup file *is*, which is never incidental.+///+/// Determinism comes from the fixture rather than from luck: every UUID and date+/// is a literal, `M5Fixture` runs on a `FixedRepositoryClock`, and the canonical+/// encoder sorts keys while the projection sorts every array by identifier.+@Suite("Backup 6/7 golden export", .serialized)+struct BackupGoldenExportTests {++    /// The recorded archive. Regenerating it is a deliberate act — see the+    /// failure message.+    private static var goldenURL: URL {+        URL(fileURLWithPath: #filePath)+            .deletingLastPathComponent()+            .appending(path: "Fixtures/backup-6-7-golden.json")+    }++    /// Every array the 6/7 payload declares is non-empty, so the golden below is+    /// evidence about the whole projection rather than about the half a smaller+    /// fixture would reach.+    @Test("The golden library populates every payload array")+    func goldenLibraryPopulatesEveryArray() async throws {+        let payload = try await Self.exportedPayload()++        #expect(!payload.entries.isEmpty)+        #expect(!payload.works.isEmpty)+        #expect(!payload.sites.isEmpty)+        #expect(!payload.titlePatterns.isEmpty)+        #expect(!payload.urlRules.isEmpty)+        #expect(!payload.workTypes.isEmpty)+        #expect(!payload.characters.isEmpty)+        #expect(!payload.suppressions.isEmpty)+        #expect(!payload.coverage.isEmpty)++        // The shapes the fixture exists to reach, named so a fixture edit that+        // quietly drops one fails here rather than only moving the golden bytes.+        #expect(payload.works.contains { $0.workTypeID != nil && $0.typeName != nil })+        #expect(payload.workTypes.contains { $0.canonicalID != nil })+        // The optional columns a nil leaves out of the file entirely, so the+        // golden pins their spelling rather than only their absence.+        #expect(payload.sites.contains { $0.junkSuffixRule != nil })+        #expect(payload.sites.contains { $0.mode == .articles })+        #expect(payload.titlePatterns.contains { $0.trimSuffix != nil })+        #expect(payload.entries.contains { $0.canonicalURL != nil })+        #expect(payload.works.contains { $0.legacyType != nil })+        // Req 5.4's rule identity: the shape `mapV5WorkRecord`'s version-rewrite+        // expression only runs over.+        #expect(+            payload.works.contains {+                $0.urlIdentity != nil && $0.urlIdentityRuleID != nil+                    && $0.urlIdentityRuleVersion != nil && $0.workURL != nil+            })+        #expect(payload.characters.contains { $0.workID == nil })+        #expect(payload.characters.contains { !$0.facts.isEmpty })+        #expect(payload.suppressions.contains { $0.sourceEntryID != nil })+        #expect(payload.coverage.contains { $0.sourceKind == .entry })+        #expect(payload.coverage.contains { $0.sourceKind == .genericNotes })+        // The agreeing duplicate rows project to one record each (Req 8.2).+        #expect(payload.works.contains { $0.id == BackupGoldenLibrary.duplicateWorkID })+        #expect(payload.works.count(where: { $0.id == BackupGoldenLibrary.duplicateWorkID }) == 1)+        #expect(+            payload.entries.count(where: { $0.id == BackupGoldenLibrary.duplicateEntryID }) == 1)+    }++    @Test("The 6/7 export of the golden library is byte-identical to the recorded archive")+    func exportIsByteIdenticalToTheRecordedArchive() async throws {+        let payload = try await Self.exportedPayload()+        let encoded = try BackupV6Codec.encode(+            payload: payload, metadata: BackupGoldenLibrary.metadata)++        let golden = try Data(contentsOf: Self.goldenURL)+        #expect(+            encoded == golden,+            """+            the 6/7 export of the golden library no longer produces the recorded \+            bytes. An archive's bytes are its identity — the checksum is taken \+            over them — so this is a wire-format change unless it is a bug. \+            Establish which before re-recording \(Self.goldenURL.lastPathComponent).+            """)+    }++    /// The exported archive still decodes and still plans, so the golden is a+    /// valid archive rather than merely a stable byte string.+    @Test("The recorded archive decodes and plans")+    func recordedArchiveDecodesAndPlans() throws {+        let golden = try Data(contentsOf: Self.goldenURL)+        let plan = try BackupImporter.plan(from: golden)++        #expect(plan.metadata.formatVersion == 6)+        #expect(plan.metadata.schemaVersion == 7)+        #expect(plan.counts.entries == plan.metadata.entryCount)+        #expect(plan.counts.works == plan.metadata.workCount)+    }++    // MARK: - The library++    /// Imports the golden archive into a fresh library, seeds the duplicate rows+    /// no write path produces, and exports what results.+    private static func exportedPayload() async throws -> BackupV6Payload {+        let fixture = try await M5Fixture()+        let plan = try BackupImporter.plan(+            from: try BackupV6Codec.encode(+                payload: BackupGoldenLibrary.payload, metadata: BackupGoldenLibrary.metadata))+        try await fixture.repository.confirmImport(plan: plan)+        try await fixture.repository.seedM5Rows(+            sites: BackupGoldenLibrary.duplicateSites,+            works: BackupGoldenLibrary.duplicateWorks,+            entries: BackupGoldenLibrary.duplicateEntries)+        return try await fixture.repository.backupV6Snapshot()+    }+}++/// The archive the golden library is built from: one record of every kind the+/// 6/7 payload can hold, with literal identifiers and one literal date.+enum BackupGoldenLibrary {+    static let created = Date(timeIntervalSince1970: 1_000_000)++    static let taughtHost = "golden.example"+    static let plainHost = "plain.example"+    static let articlesHost = "articles.example"+    static let duplicateHost = "dupe.example"++    static let patternID = UUID(uuidString: "cccccccc-cccc-cccc-cccc-cccccccccccc")!+    static let articlePatternID = UUID(uuidString: "cccccccc-cccc-cccc-cccc-ccccccccccc2")!+    static let ruleID = UUID(uuidString: "dddddddd-dddd-dddd-dddd-dddddddddddd")!+    static let typedWorkID = UUID(uuidString: "eeeeeeee-eeee-eeee-eeee-eeeeeeeeeeee")!+    static let foldedWorkID = UUID(uuidString: "eeeeeeee-eeee-eeee-eeee-eeeeeeeeeee2")!+    static let legacyWorkID = UUID(uuidString: "eeeeeeee-eeee-eeee-eeee-eeeeeeeeeee3")!+    static let notedEntryID = UUID(uuidString: "22222222-2222-2222-2222-222222222222")!+    static let plainEntryID = UUID(uuidString: "22222222-2222-2222-2222-222222222223")!+    static let articleEntryID = UUID(uuidString: "22222222-2222-2222-2222-222222222224")!++    static let novelTypeID = UUID(uuidString: "00000000-0000-0000-0000-0000000000a1")!+    static let foldedTypeID = UUID(uuidString: "00000000-0000-0000-0000-0000000000a2")!++    static let guideID = UUID(uuidString: "c4a2ace0-0000-4000-8000-000000000001")!+    static let orphanID = UUID(uuidString: "c4a2ace0-0000-4000-8000-000000000002")!+    static let candidateSuppressionID = UUID(uuidString: "5099e5ed-0000-4000-8000-000000000001")!+    static let factSuppressionID = UUID(uuidString: "5099e5ed-0000-4000-8000-000000000002")!++    static let duplicateWorkID = UUID(uuidString: "d0000000-0000-4000-8000-000000000001")!+    static let duplicateEntryID = UUID(uuidString: "d0000000-0000-4000-8000-000000000002")!++    /// The two texts coverage fingerprints describe. They have to be the *live*+    /// text at commit or the pair is dropped (Q81), so the records below carry+    /// them and the fingerprints are taken from them.+    static let entryNote = "Grover promised to guide them home."+    static let genericNotes = "The guide is not what he seems."++    static let workName = "Actual Title"+    static let titlePrefix = "TtH • Story • "+    /// The taught site's Work carries a rule-derived URL identity and a Work+    /// URL, which is the only shape `mapV5WorkRecord`'s version rewrite runs+    /// over.+    static let workIdentity = "golden.example/story/actual-title"+    static let workURL = "https://golden.example/story/actual-title"+    static let articleTitleSuffix = " - Articles Example"++    static var metadata: BackupV6Metadata {+        BackupV6Metadata(appBuild: "golden", exportedAt: created)+    }++    // MARK: The archive++    static var payload: BackupV6Payload {+        BackupV6Payload(+            entries: [notedEntry, plainEntry, articleEntry],+            works: [typedWork, foldedWork, legacyWork],+            sites: [taughtSite, plainSite, articlesSite],+            titlePatterns: [pattern, articlePattern],+            urlRules: [rule],+            workTypes: [+                workType(id: novelTypeID, name: "novel"),+                workType(id: foldedTypeID, name: "novella", state: .merged, canonicalID: novelTypeID),+            ],+            characters: [guide, orphan],+            suppressions: [candidateSuppression, factSuppression],+            coverage: [+                .entry(notedEntryID, fingerprint: CharacterCoverageFingerprint.of(entryNote)),+                .genericNotes(+                    work: typedWorkID, fingerprint: CharacterCoverageFingerprint.of(genericNotes)),+            ])+    }++    /// The whole-title rule names the Work by trimming the boilerplate prefix.+    private static var pattern: BackupV4TitlePattern {+        BackupV4TitlePattern(+            id: patternID, version: 1, isActive: true, createdAt: created,+            definition: .wholeTitle, trimPrefix: titlePrefix, trimSuffix: nil,+            siteHostname: taughtHost)+    }++    /// The articles site's retained history, and the fixture's only `trimSuffix`.+    private static var articlePattern: BackupV4TitlePattern {+        BackupV4TitlePattern(+            id: articlePatternID, version: 1, isActive: false, createdAt: created,+            definition: .wholeTitle, trimPrefix: nil, trimSuffix: articleTitleSuffix,+            siteHostname: articlesHost)+    }++    /// A sequence-only query rule extracts "94" from the raw URL.+    private static var rule: BackupV4URLRule {+        BackupV4URLRule(+            id: ruleID, version: 1, isCurrent: true, createdAt: created,+            origin: .readerTaught,+            definition: .sequence(locator: .query(name: ExactScalarString("chapter"))),+            siteHostname: taughtHost)+    }++    /// Carries the `junkSuffixRule` column, which no other site in the fixture+    /// sets and which is therefore absent from the file altogether without it.+    private static var taughtSite: BackupV4Site {+        BackupV4Site(+            hostname: taughtHost, displayName: "Golden", mode: .taught,+            patternIDs: [patternID], urlRuleIDs: [ruleID],+            junkSuffixRule: try! JunkSuffixRule(+                version: 1, anchors: [try! SegmentPositionSpec(origin: .end, offset: 0)]))+    }++    private static var plainSite: BackupV4Site {+        BackupV4Site(+            hostname: plainHost, displayName: "Plain", mode: .untaught,+            patternIDs: [], urlRuleIDs: [], junkSuffixRule: nil)+    }++    /// The third site mode. `.articles` may hold neither an active title rule+    /// nor a current URL rule, so its retained pattern is inactive — which is+    /// also where the fixture's `trimSuffix` lives.+    private static var articlesSite: BackupV4Site {+        BackupV4Site(+            hostname: articlesHost, displayName: "Articles", mode: .articles,+            patternIDs: [articlePatternID], urlRuleIDs: [], junkSuffixRule: nil)+    }++    private static func workType(+        id: UUID, name: String, state: WorkTypeState = .active, canonicalID: UUID? = nil+    ) -> BackupV5WorkTypeRecord {+        BackupV5WorkTypeRecord(+            id: id, name: name, stateRaw: state.rawValue, canonicalID: canonicalID,+            createdAt: created, modifiedAt: created)+    }++    /// The configured-type work, and the one whose generic notes a coverage pair+    /// describes. It also carries the rule-derived URL identity triple and a+    /// Work URL — the identity is what makes the export's version rewrite have+    /// a rule id to look up at all.+    private static var typedWork: BackupV5Work {+        BackupV5Work(+            id: typedWorkID, displayTitle: workName, lastParsedTitle: workName,+            siteHostname: taughtHost, urlIdentity: workIdentity, urlIdentityState: .rule,+            urlIdentityRuleID: ruleID, urlIdentityRuleVersion: 1, workURL: workURL,+            genericNotes: genericNotes, workTypeID: novelTypeID, legacyType: nil,+            typeName: "novel", genreTags: ["fantasy"], titleProvenance: .parsed,+            createdAt: created, modifiedAt: created, entryIDs: [notedEntryID])+    }++    /// The work citing the **folded** type row, so the import's canonical chase+    /// and the export's directory both have something to resolve.+    private static var foldedWork: BackupV5Work {+        BackupV5Work(+            id: foldedWorkID, displayTitle: "Plain Work", lastParsedTitle: nil,+            siteHostname: plainHost, urlIdentity: nil, urlIdentityState: .none,+            urlIdentityRuleID: nil, urlIdentityRuleVersion: nil, workURL: nil,+            genericNotes: "", workTypeID: foldedTypeID, legacyType: nil,+            typeName: "novella", genreTags: [], titleProvenance: .manual,+            createdAt: created, modifiedAt: created, entryIDs: [plainEntryID])+    }++    /// The pre-feature type column: a raw value that *is* its own label, which+    /// travels in `legacyType` with no identifier and no `typeName`.+    private static var legacyWork: BackupV5Work {+        BackupV5Work(+            id: legacyWorkID, displayTitle: "An Article", lastParsedTitle: nil,+            siteHostname: articlesHost, urlIdentity: nil, urlIdentityState: .none,+            urlIdentityRuleID: nil, urlIdentityRuleVersion: nil, workURL: nil,+            genericNotes: "", workTypeID: nil, legacyType: WorkType.article.rawValue,+            typeName: nil, genreTags: [], titleProvenance: .manual,+            createdAt: created, modifiedAt: created, entryIDs: [articleEntryID])+    }++    /// The v3 key embeds host + resolved Work name + sequence.+    private static var notedEntry: BackupV4Entry {+        let rawURL = "https://\(taughtHost)/read?chapter=94&x=1"+        let key = EntryIdentityKeyV3Codec.encode(+            try! URLSequenceNameIdentity(+                hostname: ExactScalarString(taughtHost),+                workName: ExactScalarString(workName),+                chapterSequence: ExactScalarString("94")))+        return BackupV4Entry(+            id: notedEntryID, captureTitle: titlePrefix + workName, captureTitleSource: .host,+            rawURL: rawURL, canonicalURL: nil, hostname: taughtHost,+            entryIdentityKey: key, identityKeyVersion: 3, conservativeIdentityKey: rawURL,+            identityBasis: .urlRule,+            identityURLRuleID: ruleID, identityURLRuleVersion: 1,+            identityNameTitleRuleID: patternID, identityNameTitleRuleVersion: 1,+            urlWorkIdentity: nil, urlWorkRuleID: nil, urlWorkRuleVersion: nil,+            chapterSequence: "94", chapterSequenceRuleID: ruleID, chapterSequenceRuleVersion: 1,+            chapterTitle: nil, chapterTitleProvenance: try! FieldProvenance(kind: .none),+            note: entryNote, rating: .up, firstCapturedAt: created, lastSharedAt: created,+            modifiedAt: created, workID: typedWorkID,+            workAssignmentProvenance: try! FieldProvenance(+                kind: .pattern, patternID: patternID, patternVersion: 1),+            workURLRuleID: nil, workURLRuleVersion: nil, workURLAssignmentKind: nil,+            workPatternID: patternID, workPatternVersion: 1, intentionallyUnattached: false)+    }++    /// The untaught site's Entry: a conservative key, which is what capture+    /// writes where no rule has been taught.+    private static var plainEntry: BackupV4Entry {+        let rawURL = "https://\(plainHost)/read/7"+        return BackupV4Entry(+            id: plainEntryID, captureTitle: "Plain Work", captureTitleSource: .manual,+            rawURL: rawURL, canonicalURL: nil, hostname: plainHost,+            entryIdentityKey: rawURL, identityKeyVersion: 1, conservativeIdentityKey: rawURL,+            identityBasis: .conservative,+            identityURLRuleID: nil, identityURLRuleVersion: nil,+            identityNameTitleRuleID: nil, identityNameTitleRuleVersion: nil,+            urlWorkIdentity: nil, urlWorkRuleID: nil, urlWorkRuleVersion: nil,+            chapterSequence: nil, chapterSequenceRuleID: nil, chapterSequenceRuleVersion: nil,+            chapterTitle: "A Plain Chapter",+            chapterTitleProvenance: try! FieldProvenance(kind: .manual),+            note: "", rating: nil, firstCapturedAt: created, lastSharedAt: created,+            modifiedAt: created, workID: foldedWorkID,+            workAssignmentProvenance: try! FieldProvenance(kind: .manual),+            workURLRuleID: nil, workURLRuleVersion: nil, workURLAssignmentKind: nil,+            workPatternID: nil, workPatternVersion: nil, intentionallyUnattached: false)+    }++    /// The articles site's Entry, and the fixture's only `canonicalURL`: a+    /// capture whose raw URL carried a tracking parameter the canonical form+    /// drops.+    private static var articleEntry: BackupV4Entry {+        let rawURL = "https://\(articlesHost)/posts/hello?utm_source=share"+        return BackupV4Entry(+            id: articleEntryID, captureTitle: "An Article" + articleTitleSuffix,+            captureTitleSource: .host,+            rawURL: rawURL, canonicalURL: "https://\(articlesHost)/posts/hello",+            hostname: articlesHost,+            entryIdentityKey: rawURL, identityKeyVersion: 1, conservativeIdentityKey: rawURL,+            identityBasis: .conservative,+            identityURLRuleID: nil, identityURLRuleVersion: nil,+            identityNameTitleRuleID: nil, identityNameTitleRuleVersion: nil,+            urlWorkIdentity: nil, urlWorkRuleID: nil, urlWorkRuleVersion: nil,+            chapterSequence: nil, chapterSequenceRuleID: nil, chapterSequenceRuleVersion: nil,+            chapterTitle: nil, chapterTitleProvenance: try! FieldProvenance(kind: .none),+            note: "", rating: nil, firstCapturedAt: created, lastSharedAt: created,+            modifiedAt: created, workID: legacyWorkID,+            workAssignmentProvenance: try! FieldProvenance(kind: .manual),+            workURLRuleID: nil, workURLRuleVersion: nil, workURLAssignmentKind: nil,+            workPatternID: nil, workPatternVersion: nil, intentionallyUnattached: false)+    }++    private static var guide: BackupV6Character {+        BackupV6Character(+            id: guideID, workID: typedWorkID, name: "Grover", nameKey: "grover",+            aliases: ["Klar"], note: "The guide.",+            facts: [+                CharacterFact(+                    statement: "Promised to guide them home.",+                    quote: "promised to guide them home",+                    nameKey: "grover", source: .entry(notedEntryID))+            ],+            createdAt: created, modifiedAt: created)+    }++    /// The sync orphan of Req 6.7: a character whose work has not arrived.+    private static var orphan: BackupV6Character {+        BackupV6Character(+            id: orphanID, workID: nil, name: "The Stranger", nameKey: "the stranger",+            aliases: [], note: "", facts: [], createdAt: created, modifiedAt: created)+    }++    private static var candidateSuppression: BackupV6Suppression {+        BackupV6Suppression(+            id: candidateSuppressionID, workID: typedWorkID,+            kindRaw: CharacterSuppressionKind.candidate.rawValue, nameKey: "the crowned one",+            sourceKindRaw: nil, sourceEntryID: nil, evidence: nil,+            statusRaw: CharacterSuppressionStatus.active.rawValue, actionAt: created)+    }++    /// A fact suppression, which is the shape that carries a source and evidence.+    private static var factSuppression: BackupV6Suppression {+        BackupV6Suppression(+            id: factSuppressionID, workID: typedWorkID,+            kindRaw: CharacterSuppressionKind.fact.rawValue, nameKey: "grover",+            sourceKindRaw: SourceRef.entry(notedEntryID).kindRaw, sourceEntryID: notedEntryID,+            evidence: "promised to guide them home",+            statusRaw: CharacterSuppressionStatus.active.rawValue, actionAt: created)+    }++    // MARK: The duplicate rows++    /// Two rows per application UUID, agreeing about everything the reader+    /// wrote. No write path produces them, and the projection has to fold them+    /// to one record each (Req 8.2) — which the golden bytes then pin.+    static var duplicateSites: [M5SeedSite] {+        [M5SeedSite(hostname: duplicateHost, displayName: "Dupe")]+    }++    static var duplicateWorks: [M5SeedWork] {+        let row = M5SeedWork(+            id: duplicateWorkID, displayTitle: "Twice Over", hostname: duplicateHost,+            titleProvenance: .manual, createdAt: created)+        return [row, row]+    }++    static var duplicateEntries: [M5SeedEntry] {+        let row = M5SeedEntry(+            id: duplicateEntryID, captureTitle: "Twice Over", hostname: duplicateHost,+            path: "read/1", firstCapturedAt: created, lastSharedAt: created,+            workID: duplicateWorkID)+        return [row, row]+    }+}

diff --git a/Packages/AsterismCore/Tests/AsterismCoreTests/BackupGroupProjectionTests.swift b/Packages/AsterismCore/Tests/AsterismCoreTests/BackupGroupProjectionTests.swiftindex 2b0c444..e571fed 100644--- a/Packages/AsterismCore/Tests/AsterismCoreTests/BackupGroupProjectionTests.swift+++ b/Packages/AsterismCore/Tests/AsterismCoreTests/BackupGroupProjectionTests.swift@@ -36,7 +36,7 @@ struct BackupGroupProjectionTests {         store.addEntry(id: shared, key: "chapter-1", capturedAt: 40, sharedAt: 90, title: "Chapter 1")         try store.commit() -        let payload = try store.read { try LibraryRepository.projectV4Payload(context: $0) }+        let payload = try store.read { try LibraryRepository.projectV6Payload(context: $0) }          #expect(payload.entries.count == 1)         let entry = try #require(payload.entries.first)@@ -58,15 +58,15 @@ struct BackupGroupProjectionTests {         store.addEntry(id: shared, key: "chapter-1", capturedAt: 40)         try store.commit() -        let payload = try store.read { try LibraryRepository.projectV4Payload(context: $0) }-        let encoded = try BackupV4Codec.encode(+        let payload = try store.read { try LibraryRepository.projectV6Payload(context: $0) }+        let encoded = try BackupV6Codec.encode(             payload: payload,-            metadata: BackupV4Metadata(appBuild: "1", exportedAt: DuplicateStore.epoch))+            metadata: BackupV6Metadata(appBuild: "1", exportedAt: DuplicateStore.epoch))          // The decode gate is the reference validator, which refuses a payload         // holding one UUID twice — the shape the projection exists to prevent         // reaching it.-        let decoded = try BackupV4Codec.decode(encoded)+        let decoded = try BackupV6Codec.decode(encoded)         #expect(decoded.payload.entries.count == 1)     } @@ -86,7 +86,7 @@ struct BackupGroupProjectionTests {         store.addEntry(key: "chapter-2", capturedAt: 20, work: second, site: site)         try store.commit() -        let payload = try store.read { try LibraryRepository.projectV4Payload(context: $0) }+        let payload = try store.read { try LibraryRepository.projectV6Payload(context: $0) }          #expect(payload.works.count == 1)         let work = try #require(payload.works.first)@@ -113,7 +113,7 @@ struct BackupGroupProjectionTests {         store.addEntry(id: entryID, key: "chapter-1", capturedAt: 30, work: second, site: site)         try store.commit() -        let payload = try store.read { try LibraryRepository.projectV4Payload(context: $0) }+        let payload = try store.read { try LibraryRepository.projectV6Payload(context: $0) }          #expect(payload.entries.count == 1)         let work = try #require(payload.works.first)@@ -144,7 +144,7 @@ struct BackupGroupProjectionTests {         store.addEntry(id: shared, key: "chapter-1", capturedAt: 40, work: work, site: site)         try store.commit() -        let payload = try store.read { try LibraryRepository.projectV4Payload(context: $0) }+        let payload = try store.read { try LibraryRepository.projectV6Payload(context: $0) }          let entry = try #require(payload.entries.first)         let archivedWork = try #require(payload.works.first)@@ -152,10 +152,10 @@ struct BackupGroupProjectionTests {         #expect(archivedWork.entryIDs == [shared])         // It is a legal 4/4 document: the reference validator checks that a         // Work's Entries exist, never that they name it back.-        let encoded = try BackupV4Codec.encode(+        let encoded = try BackupV6Codec.encode(             payload: payload,-            metadata: BackupV4Metadata(appBuild: "1", exportedAt: DuplicateStore.epoch))-        _ = try BackupV4Codec.decode(encoded)+            metadata: BackupV6Metadata(appBuild: "1", exportedAt: DuplicateStore.epoch))+        _ = try BackupV6Codec.decode(encoded)     }      /// The Definitions' assignment normalisation, in the export (Q106): rows@@ -190,16 +190,16 @@ struct BackupGroupProjectionTests {         rowB.workAssignmentProvenanceRaw = FieldProvenanceKind.manual.rawValue         try store.commit() -        let payload = try store.read { try LibraryRepository.projectV4Payload(context: $0) }+        let payload = try store.read { try LibraryRepository.projectV6Payload(context: $0) }          #expect(payload.entries.count == 1)         let entry = try #require(payload.entries.first)         #expect(entry.workID == DuplicateStore.rankedID(1))         #expect(payload.works.allSatisfy { $0.entryIDs == [shared] })-        let encoded = try BackupV4Codec.encode(+        let encoded = try BackupV6Codec.encode(             payload: payload,-            metadata: BackupV4Metadata(appBuild: "1", exportedAt: DuplicateStore.epoch))-        _ = try BackupV4Codec.decode(encoded)+            metadata: BackupV6Metadata(appBuild: "1", exportedAt: DuplicateStore.epoch))+        _ = try BackupV6Codec.decode(encoded)     }      // MARK: - Req 8.3: unique-UUID set members never block export@@ -215,7 +215,7 @@ struct BackupGroupProjectionTests {         store.addEntry(key: "chapter-1", capturedAt: 20, note: "from the laptop")         try store.commit() -        let payload = try store.read { try LibraryRepository.projectV4Payload(context: $0) }+        let payload = try store.read { try LibraryRepository.projectV6Payload(context: $0) }          #expect(payload.entries.count == 2)         #expect(Set(payload.entries.map(\.note)) == ["from the phone", "from the laptop"])@@ -233,7 +233,7 @@ struct BackupGroupProjectionTests {         try store.commit()          let payload = try expectTornRefusal {-            _ = try store.read { try LibraryRepository.projectV4Payload(context: $0) }+            _ = try store.read { try LibraryRepository.projectV6Payload(context: $0) }         }          #expect(payload.count == 1)@@ -259,7 +259,7 @@ struct BackupGroupProjectionTests {         try store.commit()          let payload = try expectTornRefusal {-            _ = try store.read { try LibraryRepository.projectV4Payload(context: $0) }+            _ = try store.read { try LibraryRepository.projectV6Payload(context: $0) }         }          #expect(payload.count == 2)@@ -279,7 +279,7 @@ struct BackupGroupProjectionTests {         try store.commit()          let payload = try expectTornRefusal {-            _ = try store.read { try LibraryRepository.projectV4Payload(context: $0) }+            _ = try store.read { try LibraryRepository.projectV6Payload(context: $0) }         }          #expect(payload.count == 1)@@ -312,7 +312,7 @@ struct BackupGroupProjectionTests {         try store.commit()          let payload = try expectTornRefusal {-            _ = try store.read { try LibraryRepository.projectV4Payload(context: $0) }+            _ = try store.read { try LibraryRepository.projectV6Payload(context: $0) }         }          #expect(payload.count == 1)@@ -348,7 +348,7 @@ struct BackupGroupProjectionTests {         try store.commit()          let payload = try expectTornRefusal {-            _ = try store.read { try LibraryRepository.projectV4Payload(context: $0) }+            _ = try store.read { try LibraryRepository.projectV6Payload(context: $0) }         }          #expect(payload.count == 2)@@ -384,7 +384,7 @@ struct BackupGroupProjectionTests {         try store.commit()          let payload = try expectTornRefusal {-            _ = try store.read { try LibraryRepository.projectV4Payload(context: $0) }+            _ = try store.read { try LibraryRepository.projectV6Payload(context: $0) }         }          #expect(payload.count == 2)@@ -405,7 +405,7 @@ struct BackupGroupProjectionTests {         try store.commit()          _ = try expectTornRefusal {-            _ = try store.read { try LibraryRepository.projectV4Payload(context: $0) }+            _ = try store.read { try LibraryRepository.projectV6Payload(context: $0) }         }          // The resolution outcome: both rows carry the chosen variant (Req@@ -414,7 +414,7 @@ struct BackupGroupProjectionTests {         second.note = "from the phone"         try store.commit() -        let payload = try store.read { try LibraryRepository.projectV4Payload(context: $0) }+        let payload = try store.read { try LibraryRepository.projectV6Payload(context: $0) }         #expect(payload.entries.count == 1)         #expect(payload.entries.first?.note == "from the phone")     }@@ -432,7 +432,7 @@ struct BackupGroupProjectionTests {         store.addEntry(key: "chapter-1", capturedAt: 10, site: first)         try store.commit() -        let payload = try store.read { try LibraryRepository.projectV4Payload(context: $0) }+        let payload = try store.read { try LibraryRepository.projectV6Payload(context: $0) }          #expect(payload.titlePatterns.count == 1)         #expect(payload.sites.count == 1)@@ -440,10 +440,10 @@ struct BackupGroupProjectionTests {         // The archive re-decodes: a payload holding one rule UUID twice is what         // the reference validator refuses, and what the store validates it must         // be able to export (task 20.4).-        let encoded = try BackupV4Codec.encode(+        let encoded = try BackupV6Codec.encode(             payload: payload,-            metadata: BackupV4Metadata(appBuild: "1", exportedAt: DuplicateStore.epoch))-        _ = try BackupV4Codec.decode(encoded)+            metadata: BackupV6Metadata(appBuild: "1", exportedAt: DuplicateStore.epoch))+        _ = try BackupV6Codec.decode(encoded)     }      /// The dedup must not cost a hostname its active title rule.@@ -466,14 +466,14 @@ struct BackupGroupProjectionTests {         store.addEntry(key: "chapter-1", capturedAt: 10, site: site)         try store.commit() -        let payload = try store.read { try LibraryRepository.projectV4Payload(context: $0) }+        let payload = try store.read { try LibraryRepository.projectV6Payload(context: $0) }          #expect(payload.titlePatterns.count == 1)         #expect(payload.titlePatterns.first?.isActive == true)-        let encoded = try BackupV4Codec.encode(+        let encoded = try BackupV6Codec.encode(             payload: payload,-            metadata: BackupV4Metadata(appBuild: "1", exportedAt: DuplicateStore.epoch))-        _ = try BackupV4Codec.decode(encoded)+            metadata: BackupV6Metadata(appBuild: "1", exportedAt: DuplicateStore.epoch))+        _ = try BackupV6Codec.decode(encoded)     }      /// The URL-rule half, which fails *silently* rather than refusing: nothing@@ -492,7 +492,7 @@ struct BackupGroupProjectionTests {         store.addEntry(key: "chapter-1", capturedAt: 10, site: site)         try store.commit() -        let payload = try store.read { try LibraryRepository.projectV4Payload(context: $0) }+        let payload = try store.read { try LibraryRepository.projectV6Payload(context: $0) }          #expect(payload.urlRules.count == 1)         #expect(payload.urlRules.first?.isCurrent == true)@@ -526,7 +526,7 @@ struct BackupGroupProjectionTests {         #expect(facts.first(where: \.isActive)?.version == 3)         #expect(try store.diagnose().quarantineMap().isEmpty) -        let payload = try store.read { try LibraryRepository.projectV4Payload(context: $0) }+        let payload = try store.read { try LibraryRepository.projectV6Payload(context: $0) }          #expect(payload.titlePatterns.count == 1)         #expect(payload.titlePatterns.first?.isActive == true)@@ -546,7 +546,7 @@ struct BackupGroupProjectionTests {         store.addEntry(key: "chapter-1", capturedAt: 10, site: site)         try store.commit() -        let payload = try store.read { try LibraryRepository.projectV4Payload(context: $0) }+        let payload = try store.read { try LibraryRepository.projectV6Payload(context: $0) }          #expect(payload.titlePatterns.count == 1)         #expect(payload.titlePatterns.first?.isActive == true)@@ -571,7 +571,7 @@ struct BackupGroupProjectionTests {         entry.chapterPatternVersion = 3         try store.commit() -        let payload = try store.read { try LibraryRepository.projectV4Payload(context: $0) }+        let payload = try store.read { try LibraryRepository.projectV6Payload(context: $0) }          let pattern = try #require(payload.titlePatterns.first)         let archived = try #require(payload.entries.first)@@ -601,7 +601,7 @@ struct BackupGroupProjectionTests {         losing.chapterPatternVersion = 1         try store.commit() -        let payload = try store.read { try LibraryRepository.projectV4Payload(context: $0) }+        let payload = try store.read { try LibraryRepository.projectV6Payload(context: $0) }          let pattern = try #require(payload.titlePatterns.first)         #expect(pattern.id == ruleID)@@ -615,7 +615,7 @@ struct BackupGroupProjectionTests {             try body()             Issue.record("expected a torn-groups refusal, but the export proceeded")             return TornGroupsPayload(count: 0, blockingWorkSet: nil)-        } catch let error as BackupV4ExportError {+        } catch let error as BackupV6ExportError {             guard case .tornGroups(let payload) = error else {                 Issue.record("expected .tornGroups, got \(error)")                 return TornGroupsPayload(count: 0, blockingWorkSet: nil)

diff --git a/Packages/AsterismCore/Tests/AsterismCoreTests/BackupGroupRoundTripTests.swift b/Packages/AsterismCore/Tests/AsterismCoreTests/BackupGroupRoundTripTests.swiftindex 80d7bd7..48e341c 100644--- a/Packages/AsterismCore/Tests/AsterismCoreTests/BackupGroupRoundTripTests.swift+++ b/Packages/AsterismCore/Tests/AsterismCoreTests/BackupGroupRoundTripTests.swift@@ -38,7 +38,7 @@ struct BackupGroupRoundTripTests {         let entryID = UUID()         try await repository.seedSplitEntryGroup(id: entryID) -        let payload = try await repository.backupV4Snapshot()+        let payload = try await repository.backupV6Snapshot()         let record = try #require(payload.entries.first)         let before = try await repository.entryRows(id: entryID)         #expect(before.count == 2)@@ -63,7 +63,7 @@ struct BackupGroupRoundTripTests {         let sourceRepository = try await source.open()         let entryID = UUID()         try await sourceRepository.seedSplitEntryGroup(id: entryID)-        let payload = try await sourceRepository.backupV4Snapshot()+        let payload = try await sourceRepository.backupV6Snapshot()          let target = try RoundTripEnvironment()         let targetRepository = try await target.open()@@ -87,7 +87,7 @@ struct BackupGroupRoundTripTests {         let workID = UUID()         try await repository.seedSplitWorkGroup(id: workID) -        let payload = try await repository.backupV4Snapshot()+        let payload = try await repository.backupV6Snapshot()         let record = try #require(payload.works.first)         let before = try await repository.workRows(id: workID)         #expect(before.count == 2)@@ -115,7 +115,7 @@ struct BackupGroupRoundTripTests {         let sourceRepository = try await source.open()         let workID = UUID()         try await sourceRepository.seedSplitWorkGroup(id: workID)-        let payload = try await sourceRepository.backupV4Snapshot()+        let payload = try await sourceRepository.backupV6Snapshot()          let target = try RoundTripEnvironment()         let targetRepository = try await target.open()@@ -152,7 +152,7 @@ private struct RoundTripEnvironment {      /// The plan `confirmImport` takes, straight off a payload the export just     /// produced — which is what a reader restoring their own backup hands it.-    static func plan(_ payload: BackupV4Payload) -> BackupImportPlan {+    static func plan(_ payload: BackupV6Payload) -> BackupImportPlan {         BackupImportPlan(             metadata: BackupImportMetadata(                 formatVersion: 4, schemaVersion: 4, appBuild: "test-1.0",

diff --git a/Packages/AsterismCore/Tests/AsterismCoreTests/BackupImportTransactionTests.swift b/Packages/AsterismCore/Tests/AsterismCoreTests/BackupImportTransactionTests.swiftindex 76663ee..8fa7f75 100644--- a/Packages/AsterismCore/Tests/AsterismCoreTests/BackupImportTransactionTests.swift+++ b/Packages/AsterismCore/Tests/AsterismCoreTests/BackupImportTransactionTests.swift@@ -232,11 +232,8 @@ struct BackupImportTransactionTests {     @Test("Validated import inventory includes URL-rule records")     func validatedImportInventoryCountsURLRules() throws {         let plan = try makeMinimalImportPlan(includeURLRule: true)-        guard case .v4Archive(let payload) = plan.payload else {-            Issue.record("the minimal plan is a 4/4 one")-            return-        }-        let counts = try LibraryRepository.validateImportPlanPayloadV4(payload)+        let payload = plan.payload+        let counts = try LibraryRepository.validateImportPlanPayload(payload)         #expect(counts.urlRulePatterns == 1)         #expect(counts.titlePatterns == 1)     }@@ -245,7 +242,7 @@ struct BackupImportTransactionTests {     // used to spell it the second way, which meant they only ever reached the     // missing-key branch and never the version-pair logic they name. -    @Test("BackupImporter rejects a format/schema pair other than 4/4")+    @Test("BackupImporter rejects a format/schema pair other than 6/7")     func importerRejectsUnsupportedFormats() {         let data = try! JSONSerialization.data(             withJSONObject: ["backupFormatVersion": 9, "databaseSchemaVersion": 9],@@ -298,13 +295,10 @@ struct BackupImportTransactionTests {         arguments: ImportIncoherence.allCases)     func planningGateRefusesIncoherentArchive(_ incoherence: ImportIncoherence) throws {         let plan = try makeMinimalImportPlan(incoherence: incoherence)-        guard case .v4Archive(let payload) = plan.payload else {-            Issue.record("the minimal plan is a 4/4 one")-            return-        }+        let payload = plan.payload          #expect(throws: LibraryValidationError.self) {-            _ = try LibraryRepository.validateImportPlanPayloadV4(payload)+            _ = try LibraryRepository.validateImportPlanPayload(payload)         }     } }@@ -364,7 +358,7 @@ private func createReadyEmptyV3Store(at configuration: LibraryConfiguration) thr     )     let context = ModelContext(container)     try context.save()-    try Data("4\n".utf8).write(to: configuration.readinessMarkerURL, options: .atomic)+    try Data("7\n".utf8).write(to: configuration.readinessMarkerURL, options: .atomic) }  private func createReadyPopulatedV3Store(at configuration: LibraryConfiguration) throws {@@ -400,8 +394,13 @@ private func createReadyPopulatedV3Store(at configuration: LibraryConfiguration)         work: work     )     context.insert(entry)+    // Linked here rather than by the open: the bootstrap's relationship pass is+    // gone with the marker generation that ran it, so a certified library is+    // seeded already linked.+    entry.site = site+    work.site = site     try context.save()-    try Data("4\n".utf8).write(to: configuration.readinessMarkerURL, options: .atomic)+    try Data("7\n".utf8).write(to: configuration.readinessMarkerURL, options: .atomic) }  /// An archive with `entryCount` Entries on one untaught Site, for the chunking@@ -432,7 +431,7 @@ private func makeBulkImportPlan(entryCount: Int) throws -> BackupImportPlan {             workURLRuleID: nil, workURLRuleVersion: nil, workURLAssignmentKind: nil,             workPatternID: nil, workPatternVersion: nil, intentionallyUnattached: false)     }-    let payload = BackupV4Payload(+    let payload = BackupImportPayload(         entries: entries, works: [], sites: [site], titlePatterns: [], urlRules: [])     let metadata = BackupImportMetadata(         formatVersion: 4, schemaVersion: 4, appBuild: "test-1.0", exportedAt: epoch,@@ -511,7 +510,7 @@ private func makeMinimalImportPlan(         intentionallyUnattached: false     ) -    let work = BackupV4Work(+    let work = BackupV5Work(         id: workID,         displayTitle: "Imported Work",         lastParsedTitle: "Imported Work",@@ -522,7 +521,9 @@ private func makeMinimalImportPlan(         urlIdentityRuleVersion: nil,         workURL: nil,         genericNotes: "",-        type: .novel,+        workTypeID: nil,+        legacyType: WorkType.novel.rawValue,+        typeName: nil,         genreTags: ["fantasy"],         titleProvenance: .parsed,         createdAt: epoch,@@ -580,7 +581,7 @@ private func makeMinimalImportPlan(         workCount: 1     ) -    var v4Payload = BackupV4Payload(+    var v4Payload = BackupImportPayload(         entries: [entry],         works: [work],         sites: [site],@@ -589,14 +590,14 @@ private func makeMinimalImportPlan(     )     switch incoherence {     case .duplicateApplicationUUID:-        v4Payload = BackupV4Payload(+        v4Payload = BackupImportPayload(             entries: v4Payload.entries + v4Payload.entries,             works: v4Payload.works,             sites: v4Payload.sites,             titlePatterns: v4Payload.titlePatterns,             urlRules: v4Payload.urlRules)     case .duplicateSiteRows:-        v4Payload = BackupV4Payload(+        v4Payload = BackupImportPayload(             entries: v4Payload.entries,             works: v4Payload.works,             sites: v4Payload.sites + v4Payload.sites,@@ -605,7 +606,7 @@ private func makeMinimalImportPlan(     case .missingSiteRow:         // Drop the Site the Entry and the Work both name. The title pattern         // stays, unowned, exactly as an archive written mid-sync would carry it.-        v4Payload = BackupV4Payload(+        v4Payload = BackupImportPayload(             entries: v4Payload.entries,             works: v4Payload.works,             sites: [],

diff --git a/Packages/AsterismCore/Tests/AsterismCoreTests/BackupV4CodecTests.swift b/Packages/AsterismCore/Tests/AsterismCoreTests/BackupV4CodecTests.swiftdeleted file mode 100644index e2316f3..0000000--- a/Packages/AsterismCore/Tests/AsterismCoreTests/BackupV4CodecTests.swift+++ /dev/null@@ -1,235 +0,0 @@-import Foundation-import Testing--@testable import AsterismCore--// MARK: - Backup V4 Codec Tests--@Suite("Backup V4 codec")-struct BackupV4CodecTests {-    private let timestamp = Date(timeIntervalSince1970: 1_000_000)--    // MARK: - Round Trip--    @Test("V4 encode/decode round-trip declares 4/4 and the literal m4 gate")-    func roundTrip() throws {-        let payload = BackupV4Fixtures.minimalTaughtPayload()-        let metadata = BackupV4Metadata(appBuild: "test-42", exportedAt: timestamp)--        let encoded = try BackupV4Codec.encode(payload: payload, metadata: metadata)-        let decoded = try BackupV4Codec.decode(encoded)--        #expect(decoded.backupFormatVersion == 4)-        #expect(decoded.databaseSchemaVersion == 4)-        #expect(decoded.capabilityGate == "m4")-        #expect(decoded.entryCount == payload.entries.count)-        #expect(decoded.workCount == payload.works.count)-        #expect(decoded.payload == payload)-    }--    @Test("V4 round-trip carries composed forms: whole-title trims, sequence rule, v3 key")-    func roundTripComposedForms() throws {-        let payload = BackupV4Fixtures.composedPayload()-        let metadata = BackupV4Metadata(appBuild: "test-composed", exportedAt: timestamp)--        let encoded = try BackupV4Codec.encode(payload: payload, metadata: metadata)-        let decoded = try BackupV4Codec.decode(encoded)--        #expect(decoded.payload == payload)-        let pattern = decoded.payload.titlePatterns[0]-        #expect(try pattern.definition == .wholeTitle)-        #expect(pattern.trimPrefix == "TtH • Story • ")-        let rule = decoded.payload.urlRules[0]-        if case .sequence = rule.definition {} else { Issue.record("expected a .sequence URL rule") }-        #expect(decoded.payload.entries[0].identityKeyVersion == 3)-        #expect(decoded.payload.entries[0].identityNameTitleRuleID == pattern.id)-    }--    // MARK: - Envelope strict shape--    @Test("Unknown root key is rejected (root-strict envelope)")-    func unknownRootKeyRejected() throws {-        let encoded = try encodedMinimal()-        let tampered = try mutatingRoot(encoded) { $0["surpriseField"] = 1 }-        #expect(throws: BackupCodecError.self) { try BackupV4Codec.decode(tampered) }-    }--    @Test("Missing root key is rejected")-    func missingRootKeyRejected() throws {-        let encoded = try encodedMinimal()-        let tampered = try mutatingRoot(encoded) { $0.removeValue(forKey: "checksum") }-        #expect(throws: BackupCodecError.self) { try BackupV4Codec.decode(tampered) }-    }--    // MARK: - Envelope invariants--    @Test("A non-m4 capability gate is rejected")-    func wrongGateRejected() throws {-        let encoded = try encodedMinimal()-        let tampered = try mutatingRoot(encoded) { $0["capabilityGate"] = "m3" }-        #expect(throws: BackupV4CodecError.self) { try BackupV4Codec.decode(tampered) }-    }--    @Test("An entry-count mismatch is rejected")-    func countMismatchRejected() throws {-        let encoded = try encodedMinimal()-        let tampered = try mutatingRoot(encoded) { $0["entryCount"] = 99 }-        #expect(throws: BackupV4CodecError.self) { try BackupV4Codec.decode(tampered) }-    }--    @Test("A tampered checksum is rejected")-    func checksumTamperRejected() throws {-        let encoded = try encodedMinimal()-        let tampered = try mutatingRoot(encoded) { $0["checksum"] = String(repeating: "0", count: 64) }-        #expect(throws: BackupV4CodecError.self) { try BackupV4Codec.decode(tampered) }-    }--    // MARK: - Reference validation: duplicates--    @Test("A duplicate Entry ID is rejected")-    func duplicateEntryRejected() throws {-        var payload = BackupV4Fixtures.minimalTaughtPayload()-        payload = BackupV4Payload(-            entries: payload.entries + payload.entries,-            works: payload.works, sites: payload.sites,-            titlePatterns: payload.titlePatterns, urlRules: payload.urlRules)-        let encoded = try BackupV4Codec.encode(-            payload: payload, metadata: BackupV4Metadata(appBuild: "x", exportedAt: timestamp))-        #expect(throws: BackupV4CodecError.self) { try BackupV4Codec.decode(encoded) }-    }--    // MARK: - Reference validation: closed Site tuple--    @Test("A taught Site with no active title rule is rejected (Decision 5)")-    func taughtWithoutActiveTitleRuleRejected() throws {-        let payload = BackupV4Fixtures.minimalTaughtPayload(activePattern: false)-        let encoded = try BackupV4Codec.encode(-            payload: payload, metadata: BackupV4Metadata(appBuild: "x", exportedAt: timestamp))-        #expect(throws: BackupV4CodecError.self) { try BackupV4Codec.decode(encoded) }-    }--    @Test("A locator with both sides unanchored is rejected on import (Req 1.3)")-    func bothUnanchoredLocatorRejectedOnImport() throws {-        // Selection would resolve this locator on a single-component path, so-        // the refusal must come from `validate` at the import gate, not from-        // selection failing downstream.-        let payload = BackupV4Fixtures.unanchoredRulePayload(leftAnchored: false)-        let encoded = try BackupV4Codec.encode(-            payload: payload, metadata: BackupV4Metadata(appBuild: "x", exportedAt: timestamp))-        #expect(throws: BackupV4CodecError.self) { try BackupV4Codec.decode(encoded) }-    }--    @Test("A locator with one unanchored side imports cleanly")-    func singleUnanchoredLocatorImports() throws {-        let payload = BackupV4Fixtures.unanchoredRulePayload(leftAnchored: true)-        let encoded = try BackupV4Codec.encode(-            payload: payload, metadata: BackupV4Metadata(appBuild: "x", exportedAt: timestamp))-        let decoded = try BackupV4Codec.decode(encoded)-        #expect(decoded.payload.urlRules.count == 1)-    }--    @Test("Two current URL rules on one Site are rejected")-    func twoCurrentRulesRejected() throws {-        let payload = BackupV4Fixtures.twoCurrentRulePayload()-        let encoded = try BackupV4Codec.encode(-            payload: payload, metadata: BackupV4Metadata(appBuild: "x", exportedAt: timestamp))-        #expect(throws: BackupV4CodecError.self) { try BackupV4Codec.decode(encoded) }-    }--    // MARK: - Reference validation: Entry-state enumeration--    @Test("A conservative alias that is not the raw URL is rejected")-    func conservativeAliasMismatchRejected() throws {-        let payload = BackupV4Fixtures.minimalTaughtPayload(brokenAlias: true)-        let encoded = try BackupV4Codec.encode(-            payload: payload, metadata: BackupV4Metadata(appBuild: "x", exportedAt: timestamp))-        #expect(throws: BackupV4CodecError.self) { try BackupV4Codec.decode(encoded) }-    }--    @Test("A v3 basis Entry without a resolving name contributor is rejected")-    func v3WithoutNameContributorRejected() throws {-        let payload = BackupV4Fixtures.composedPayload(dropNameContributor: true)-        let encoded = try BackupV4Codec.encode(-            payload: payload, metadata: BackupV4Metadata(appBuild: "x", exportedAt: timestamp))-        #expect(throws: BackupV4CodecError.self) { try BackupV4Codec.decode(encoded) }-    }--    // MARK: - Helpers--    // MARK: - Raw-byte strictness-    //-    // These three cannot go through `mutatingRoot`: it round-trips the document-    // through `JSONSerialization`, which collapses a duplicate key to the last-    // one and cannot represent trailing bytes at all. They edit the encoded-    // bytes directly, which is the only way to reach `DuplicateJSONKeyValidator`-    // — the sole guard for both properties on the live decode path-    // (`BackupV4Codec.decode`). They previously lived in the format-2 and-    // format-3 codec suites; those went with the old import paths, and without-    // this port a stubbed validator would pass every remaining backup test while-    // decoding silently reverted to last-key-wins.--    @Test("A duplicate root key is rejected rather than resolved last-wins")-    func duplicateRootKeyRejected() throws {-        let encoded = try encodedMinimal()-        let text = try #require(String(data: encoded, encoding: .utf8))-        #expect(text.hasPrefix("{"))-        // Inject a second `appBuild` ahead of the original.-        let duplicated = try #require(("{\"appBuild\":\"shadow\"," + text.dropFirst()).data(using: .utf8))--        #expect(throws: BackupCodecError.self) { try BackupV4Codec.decode(duplicated) }-    }--    @Test("A duplicate nested key is rejected")-    func duplicateNestedKeyRejected() throws {-        let encoded = try encodedMinimal()-        let text = try #require(String(data: encoded, encoding: .utf8))-        let marker = "\"payload\":{"-        let range = try #require(text.range(of: marker))-        let injected = text.replacingCharacters(-            in: range, with: marker + "\"entries\":[],")--        #expect(throws: BackupCodecError.self) {-            try BackupV4Codec.decode(try #require(injected.data(using: .utf8)))-        }-    }--    @Test("Trailing bytes after the document are rejected")-    func trailingBytesRejected() throws {-        let encoded = try encodedMinimal()-        var withTrailer = encoded-        withTrailer.append(contentsOf: Array("}".utf8))--        #expect(throws: BackupCodecError.self) { try BackupV4Codec.decode(withTrailer) }-    }--    // MARK: - Timestamps--    /// The archive's date format carries fractional seconds and quantizes to-    /// whole milliseconds. Every other test here uses a whole-second timestamp,-    /// so without this one a dropped `.withFractionalSeconds` would round-trip-    /// cleanly and only fail by luck elsewhere.-    @Test("A sub-second timestamp survives the round-trip to the millisecond")-    func fractionalSecondsRoundTrip() throws {-        let fractional = Date(timeIntervalSince1970: 1_721_000_000.123)-        let encoded = try BackupV4Codec.encode(-            payload: BackupV4Fixtures.minimalTaughtPayload(),-            metadata: BackupV4Metadata(appBuild: "fractional", exportedAt: fractional))--        let decoded = try BackupV4Codec.decode(encoded)--        #expect(abs(decoded.exportedAt.timeIntervalSince(fractional)) < 0.001)-        #expect(decoded.exportedAt != Date(timeIntervalSince1970: 1_721_000_000))-    }--    private func encodedMinimal() throws -> Data {-        try BackupV4Codec.encode(-            payload: BackupV4Fixtures.minimalTaughtPayload(),-            metadata: BackupV4Metadata(appBuild: "x", exportedAt: timestamp))-    }--    private func mutatingRoot(_ data: Data, _ mutate: (inout [String: Any]) -> Void) throws -> Data {-        var root = try #require(try JSONSerialization.jsonObject(with: data) as? [String: Any])-        mutate(&root)-        return try JSONSerialization.data(withJSONObject: root)-    }-}

diff --git a/Packages/AsterismCore/Tests/AsterismCoreTests/BackupV4ExportTests.swift b/Packages/AsterismCore/Tests/AsterismCoreTests/BackupV4ExportTests.swiftdeleted file mode 100644index 9ecef42..0000000--- a/Packages/AsterismCore/Tests/AsterismCoreTests/BackupV4ExportTests.swift+++ /dev/null@@ -1,148 +0,0 @@-import Foundation-import SwiftData-import Testing--@testable import AsterismCore--@Suite("Backup V4 export", .serialized)-struct BackupV4ExportTests {--    // MARK: - Decode-validate own bytes--    @Test("Exporter produces a v4 filename and a valid, decodable 4/4 document")-    func exporterProducesValidV4() async throws {-        let tempDir = FileManager.default.temporaryDirectory.appending(path: UUID().uuidString)-        try FileManager.default.createDirectory(at: tempDir, withIntermediateDirectories: true)-        defer { try? FileManager.default.removeItem(at: tempDir) }--        let repo = MockV4SnapshotProvider(payload: BackupV4Fixtures.minimalTaughtPayload())-        let exporter = BackupV4Exporter(repository: repo, stagingDirectory: tempDir)-        let result = try await exporter.export(-            metadata: BackupV4Metadata(appBuild: "1", exportedAt: Date()))--        #expect(result.fileURL.lastPathComponent.contains("v4"))-        let data = try Data(contentsOf: result.fileURL)-        let decoded = try BackupV4Codec.decode(data)-        #expect(decoded.backupFormatVersion == 4)-        #expect(decoded.databaseSchemaVersion == 4)-        #expect(decoded.payload == BackupV4Fixtures.minimalTaughtPayload())-        exporter.cleanup(result)-    }--    @Test("Export fails when its own bytes would not re-decode (snapshot/codec mismatch surfaces)")-    func exportSurfacesInvalidSnapshot() async throws {-        let tempDir = FileManager.default.temporaryDirectory.appending(path: UUID().uuidString)-        try FileManager.default.createDirectory(at: tempDir, withIntermediateDirectories: true)-        defer { try? FileManager.default.removeItem(at: tempDir) }--        // A structurally-invalid snapshot (taught Site with no active title rule)-        // must not produce a shareable file: the decode-validate step rejects it.-        let repo = MockV4SnapshotProvider(payload: BackupV4Fixtures.minimalTaughtPayload(activePattern: false))-        let exporter = BackupV4Exporter(repository: repo, stagingDirectory: tempDir)-        await #expect(throws: BackupV4ExportError.self) {-            _ = try await exporter.export(metadata: BackupV4Metadata(appBuild: "1", exportedAt: Date()))-        }-    }--    // MARK: - A quarantined library still exports (Req 3.1)--    @Test("The snapshot produces a payload for a library carrying a quarantined hostname")-    func snapshotProducesAPayloadUnderQuarantine() async throws {-        let (repository, _, directory) = try await openWithQuarantine()-        defer { try? FileManager.default.removeItem(at: directory) }--        // The gate this replaces refused here, at the one moment an archive is-        // most wanted (Q14).-        #expect(await repository.quarantineReason(hostname: quarantinedHost) != nil)--        let payload = try await repository.backupV4Snapshot()--        #expect(Set(payload.sites.map(\.hostname)) == [quarantinedHost, validHost])-        #expect(payload.entries.count == 1)-        // The offending row claimed `.taught` while holding no title rule, which-        // no mode in the 4/4 tuple table admits. The projection archives what the-        // row actually holds — nothing — rather than a mode the file could not-        // carry. There is no teaching to lose.-        let quarantined = try #require(payload.sites.first { $0.hostname == quarantinedHost })-        #expect(quarantined.mode == .untaught)-    }--    @Test("The exporter writes a file for a library carrying a quarantined hostname")-    func exporterWritesUnderQuarantine() async throws {-        let (repository, _, directory) = try await openWithQuarantine()-        defer { try? FileManager.default.removeItem(at: directory) }--        let stagingDir = directory.appending(path: "staging")-        let exporter = BackupV4Exporter(repository: repository, stagingDirectory: stagingDir)-        let result = try await exporter.export(-            metadata: BackupV4Metadata(appBuild: "1", exportedAt: Date()))--        // Req 3.4: the file decodes as a strict 4/4 document, which is the whole-        // reason the projection has to produce a legal shape rather than a-        // faithful-but-illegal one.-        let decoded = try BackupV4Codec.decode(try Data(contentsOf: result.fileURL))-        #expect(decoded.databaseSchemaVersion == 4)-        #expect(decoded.payload.entries.count == 1)-        exporter.cleanup(result)-    }--    // MARK: - Quarantined store construction--    private let quarantinedHost = "quarantined.example"-    private let validHost = "valid.example"--    private func openWithQuarantine() async throws -> (LibraryRepository, LibraryConfiguration, URL) {-        let directory = FileManager.default.temporaryDirectory-            .appending(path: "AsterismV4ExportTests-\(UUID())", directoryHint: .isDirectory)-        try FileManager.default.createDirectory(at: directory, withIntermediateDirectories: true)-        let configuration = LibraryConfiguration(rootDirectory: directory)-        try FileManager.default.createDirectory(-            at: configuration.storeURL.deletingLastPathComponent(), withIntermediateDirectories: true)--        do {-            let container = try LibraryRepository.openContainer(at: configuration.storeURL)-            let context = ModelContext(container)--            // Invalid: a taught Site with no active title rule (violates Decision 5).-            let bad = Site(hostname: quarantinedHost)-            bad.mode = .taught-            context.insert(bad)-            let url = "https://\(quarantinedHost)/read?chapter=1"-            let entry = Entry(-                captureTitle: "Solo Story", captureTitleSource: .host, rawURLString: url,-                hostname: quarantinedHost, entryIdentityKey: url,-                timestamp: Date(timeIntervalSince1970: 10))-            entry.conservativeIdentityKey = url-            context.insert(entry)--            let good = Site(hostname: validHost)-            good.mode = .untaught-            context.insert(good)--            try context.save()-            // Task 19: the marker published below says the relationship pass has-            // run, so the seeded graph must look as though it did — every record-            // pinned to the row `SiteResolutionOrder` picks, and nil only where the-            // hostname carries no Site row at all.-            try SiteRelationshipPopulationPass.run(context: context)-            withExtendedLifetime(container) {}-        }--        // Seeded at the current schema, so it is marked migrated (Q14, Q26);-        // nothing here simulates a library awaiting the relationship pass.-        try LibraryRepository.publishReadiness(at: configuration.readinessMarkerURL)--        let (_, repository) = try await LibraryRepository.openForApp(-            configuration, capabilities: .m4, saveStrategy: ModelContextSaveStrategy())-        return (repository, configuration, directory)-    }--}--// MARK: - Test Doubles--private final class MockV4SnapshotProvider: BackupV4SnapshotProviding, @unchecked Sendable {-    let payload: BackupV4Payload-    init(payload: BackupV4Payload) { self.payload = payload }-    func backupV4Snapshot() async throws -> BackupV4Payload { payload }-}

diff --git a/Packages/AsterismCore/Tests/AsterismCoreTests/BackupV4Fixtures.swift b/Packages/AsterismCore/Tests/AsterismCoreTests/BackupV4Fixtures.swiftdeleted file mode 100644index d4f8ffa..0000000--- a/Packages/AsterismCore/Tests/AsterismCoreTests/BackupV4Fixtures.swift+++ /dev/null@@ -1,274 +0,0 @@-import CryptoKit-import Foundation--@testable import AsterismCore--/// Shared builders for valid and deliberately-invalid Backup V4 payloads used by-/// the codec, export, and import-mapping suites.-enum BackupV4Fixtures {-    static let created = Date(timeIntervalSince1970: 1_000_000)--    // MARK: - Minimal taught (conservative Entry)--    /// A taught Site with one segment title rule and one conservative-basis-    /// Entry. `activePattern: false` breaks the closed tuple; `brokenAlias: true`-    /// breaks the conservative-key alias invariant.-    static func minimalTaughtPayload(-        activePattern: Bool = true,-        brokenAlias: Bool = false-    ) -> BackupV4Payload {-        let host = "example.com"-        let patternID = UUID(uuidString: "bbbbbbbb-bbbb-bbbb-bbbb-bbbbbbbbbbbb")!-        let workID = UUID(uuidString: "aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa")!-        let entryID = UUID(uuidString: "11111111-1111-1111-1111-111111111111")!-        let rawURL = "https://example.com/read/7"--        let pattern = BackupV4TitlePattern(-            id: patternID, version: 1, isActive: activePattern, createdAt: created,-            definition: .segment(work: try! SegmentRangeSpec(origin: .start, offset: 0, length: 1), ignored: []),-            trimPrefix: nil, trimSuffix: nil, siteHostname: host)--        let site = BackupV4Site(-            hostname: host, displayName: "Example", mode: .taught,-            patternIDs: [patternID], urlRuleIDs: [], junkSuffixRule: nil)--        let work = BackupV4Work(-            id: workID, displayTitle: "Constellation", lastParsedTitle: "Constellation",-            siteHostname: host, urlIdentity: nil, urlIdentityState: .none,-            urlIdentityRuleID: nil, urlIdentityRuleVersion: nil, workURL: nil,-            genericNotes: "", type: .novel, genreTags: [], titleProvenance: .parsed,-            createdAt: created, modifiedAt: created, entryIDs: [entryID])--        let entry = BackupV4Entry(-            id: entryID, captureTitle: "Chapter 7", captureTitleSource: .host,-            rawURL: rawURL, canonicalURL: nil, hostname: host,-            entryIdentityKey: rawURL, identityKeyVersion: 1,-            conservativeIdentityKey: brokenAlias ? "not-the-url" : rawURL,-            identityBasis: .conservative,-            identityURLRuleID: nil, identityURLRuleVersion: nil,-            identityNameTitleRuleID: nil, identityNameTitleRuleVersion: nil,-            urlWorkIdentity: nil, urlWorkRuleID: nil, urlWorkRuleVersion: nil,-            chapterSequence: nil, chapterSequenceRuleID: nil, chapterSequenceRuleVersion: nil,-            chapterTitle: nil, chapterTitleProvenance: try! FieldProvenance(kind: .none),-            note: "", rating: nil, firstCapturedAt: created, lastSharedAt: created,-            modifiedAt: created, workID: workID,-            workAssignmentProvenance: try! FieldProvenance(kind: .manual),-            workURLRuleID: nil, workURLRuleVersion: nil, workURLAssignmentKind: nil,-            workPatternID: nil, workPatternVersion: nil, intentionallyUnattached: false)--        return BackupV4Payload(-            entries: [entry], works: [work], sites: [site],-            titlePatterns: [pattern], urlRules: [])-    }--    // MARK: - Composed (whole-title trims + sequence rule + v3 key)--    /// A taught Site whose title rule is a trimmed whole-title rule and whose URL-    /// rule is sequence-only, with one v3-basis (sequence+name) Entry. The URL-    /// extraction, whole-title naming, and v3 key are mutually consistent so the-    /// payload passes the full store-level `LibraryValidator`, not only the-    /// codec-level reference validator. `dropNameContributor: true` removes the-    /// required name contributor.-    static func composedPayload(dropNameContributor: Bool = false) -> BackupV4Payload {-        let host = "example.com"-        let patternID = UUID(uuidString: "cccccccc-cccc-cccc-cccc-cccccccccccc")!-        let ruleID = UUID(uuidString: "dddddddd-dddd-dddd-dddd-dddddddddddd")!-        let workID = UUID(uuidString: "eeeeeeee-eeee-eeee-eeee-eeeeeeeeeeee")!-        let entryID = UUID(uuidString: "22222222-2222-2222-2222-222222222222")!-        let rawURL = "https://example.com/read?chapter=94&x=1"-        let workName = "Actual Title"--        // The whole-title rule names the Work by trimming the boilerplate prefix.-        let pattern = BackupV4TitlePattern(-            id: patternID, version: 1, isActive: true, createdAt: created,-            definition: .wholeTitle, trimPrefix: "TtH • Story • ", trimSuffix: nil,-            siteHostname: host)--        // A sequence-only query rule extracts "94" from the raw URL.-        let rule = BackupV4URLRule(-            id: ruleID, version: 1, isCurrent: true, createdAt: created,-            origin: .readerTaught,-            definition: .sequence(locator: .query(name: ExactScalarString("chapter"))),-            siteHostname: host)--        let site = BackupV4Site(-            hostname: host, displayName: "Example", mode: .taught,-            patternIDs: [patternID], urlRuleIDs: [ruleID], junkSuffixRule: nil)--        let work = BackupV4Work(-            id: workID, displayTitle: workName, lastParsedTitle: workName,-            siteHostname: host, urlIdentity: nil, urlIdentityState: .none,-            urlIdentityRuleID: nil, urlIdentityRuleVersion: nil, workURL: nil,-            genericNotes: "", type: .novel, genreTags: [], titleProvenance: .parsed,-            createdAt: created, modifiedAt: created, entryIDs: [entryID])--        // The v3 key embeds host + resolved Work name + sequence (Req 4.2).-        let v3Key = EntryIdentityKeyV3Codec.encode(try! URLSequenceNameIdentity(-            hostname: ExactScalarString(host), workName: ExactScalarString(workName),-            chapterSequence: ExactScalarString("94")))--        let entry = BackupV4Entry(-            id: entryID, captureTitle: "TtH • Story • Actual Title", captureTitleSource: .host,-            rawURL: rawURL, canonicalURL: nil, hostname: host,-            entryIdentityKey: v3Key, identityKeyVersion: 3, conservativeIdentityKey: rawURL,-            identityBasis: .urlRule,-            identityURLRuleID: ruleID, identityURLRuleVersion: 1,-            identityNameTitleRuleID: dropNameContributor ? nil : patternID,-            identityNameTitleRuleVersion: dropNameContributor ? nil : 1,-            urlWorkIdentity: nil, urlWorkRuleID: nil, urlWorkRuleVersion: nil,-            chapterSequence: "94", chapterSequenceRuleID: ruleID, chapterSequenceRuleVersion: 1,-            chapterTitle: nil, chapterTitleProvenance: try! FieldProvenance(kind: .none),-            note: "", rating: nil, firstCapturedAt: created, lastSharedAt: created,-            modifiedAt: created, workID: workID,-            workAssignmentProvenance: try! FieldProvenance(-                kind: .pattern, patternID: patternID, patternVersion: 1),-            workURLRuleID: nil, workURLRuleVersion: nil, workURLAssignmentKind: nil,-            workPatternID: patternID, workPatternVersion: 1, intentionallyUnattached: false)--        return BackupV4Payload(-            entries: [entry], works: [work], sites: [site],-            titlePatterns: [pattern], urlRules: [rule])-    }--    // MARK: - Unanchored locators (Req 1.3)--    /// A taught Site whose current rule brackets a path component with the given-    /// anchoring. With `leftAnchored: false` the locator leaves **both** sides-    /// unanchored — which selection would happily resolve on a single-component-    /// path, so the import gate's `validate` call is the only thing standing-    /// between such an archive and the store (Req 1.3, Q5/Q7).-    static func unanchoredRulePayload(leftAnchored: Bool) -> BackupV4Payload {-        let host = "unanchored.example"-        let patternID = UUID(uuidString: "ffffffff-ffff-ffff-ffff-fffffffffff1")!-        let ruleID = UUID(uuidString: "ffffffff-ffff-ffff-ffff-fffffffffff2")!--        let pattern = BackupV4TitlePattern(-            id: patternID, version: 1, isActive: true, createdAt: created,-            definition: .segment(work: try! SegmentRangeSpec(origin: .start, offset: 0, length: 1), ignored: []),-            trimPrefix: nil, trimSuffix: nil, siteHostname: host)--        let left: PathAnchor = leftAnchored ? .literal(ExactScalarString("series")) : .unanchored-        let rule = BackupV4URLRule(-            id: ruleID, version: 1, isCurrent: true, createdAt: created,-            origin: .readerTaught,-            definition: .work(locator: .pathBracketed(left: left, right: .unanchored)),-            siteHostname: host)--        let site = BackupV4Site(-            hostname: host, displayName: "Unanchored", mode: .taught,-            patternIDs: [patternID], urlRuleIDs: [ruleID], junkSuffixRule: nil)--        return BackupV4Payload(-            entries: [], works: [], sites: [site],-            titlePatterns: [pattern], urlRules: [rule])-    }--    // MARK: - Combined rule, both presence states (Reqs 5.3–5.5)--    /// A taught Site whose current rule is the tthfanfic-shaped combined rule,-    /// with the chapter sequence declared optional or not.-    ///-    /// Fixed UUIDs and a fixed date, so the encoded bytes are stable and can be-    /// asserted on directly — which a fixture generated by a teaching commit-    /// cannot be (it mints random UUIDs and wall-clock timestamps).-    static func combinedRulePayload(presence: URLSequencePresence) -> BackupV4Payload {-        let patternID = UUID(uuidString: "ffffffff-ffff-ffff-ffff-fffffffffff3")!-        let ruleID = UUID(uuidString: "ffffffff-ffff-ffff-ffff-fffffffffff4")!--        let pattern = BackupV4TitlePattern(-            id: patternID, version: 1, isActive: true, createdAt: created,-            definition: .wholeTitle, trimPrefix: nil, trimSuffix: nil,-            siteHostname: combinedRuleHost)--        let rule = BackupV4URLRule(-            id: ruleID, version: 1, isCurrent: true, createdAt: created,-            origin: .readerTaught,-            definition: .combined(-                locator: .pathBracketed(left: .start, right: .unanchored),-                template: URLTwoFieldTemplate(-                    prefix: ExactScalarString("Story-"),-                    separator: ExactScalarString("-"),-                    suffix: ExactScalarString(""),-                    order: .workThenSequence,-                    sequencePresence: presence)),-            siteHostname: combinedRuleHost)--        let site = BackupV4Site(-            hostname: combinedRuleHost, displayName: "Combined", mode: .taught,-            patternIDs: [patternID], urlRuleIDs: [ruleID], junkSuffixRule: nil)--        return BackupV4Payload(-            entries: [], works: [], sites: [site],-            titlePatterns: [pattern], urlRules: [rule])-    }--    static let combinedRuleHost = "combined.example"--    /// The payload bytes a build **without** this feature writes for-    /// `combinedRulePayload(presence: .required)`: the same records, hand-written-    /// in the codec's canonical `.sortedKeys` layout, and carrying no-    /// `sequencePresence` key anywhere. Req 5.3's pre-feature archive is exactly-    /// this text.-    static let preFeatureCombinedPayloadJSON =-        #"{"entries":[],"sites":[{"displayName":"Combined","hostname":"combined.example","#-        + #""mode":"taught","patternIDs":["FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFF3"],"#-        + #""urlRuleIDs":["FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFF4"]}],"titlePatterns":"#-        + #"[{"createdAt":"1970-01-12T13:46:40.000Z","definition":{"wholeTitle":{}},"#-        + #""id":"FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFF3","isActive":true,"#-        + #""siteHostname":"combined.example","version":1}],"urlRules":"#-        + #"[{"createdAt":"1970-01-12T13:46:40.000Z","definition":{"combined":"#-        + #"{"locator":{"pathBracketed":{"left":{"start":{}},"right":{"unanchored":{}}}},"#-        + #""template":{"order":"workThenSequence","prefix":"Story-","separator":"-","#-        + #""suffix":""}}},"id":"FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFF4","isCurrent":true,"#-        + #""origin":"readerTaught","siteHostname":"combined.example","version":1}],"works":[]}"#--    /// `preFeatureCombinedPayloadJSON` wrapped in a 4/4 envelope, with the-    /// checksum taken over that literal text.-    ///-    /// The checksum is what makes the fixture a test rather than a restatement:-    /// `BackupV4Codec.decode` re-encodes the payload it decoded and compares a-    /// SHA-256 (`BackupV4Codec.swift:86-97`), so a build that dropped the-    /// pre-feature spelling — or added a key of its own — fails with-    /// `checksumMismatch` (Decision 1).-    static func preFeatureCombinedDocument(appBuild: String = "pre-feature") -> Data {-        let payload = preFeatureCombinedPayloadJSON-        let checksum = SHA256.hash(data: Data(payload.utf8))-            .map { String(format: "%02x", $0) }.joined()-        return Data(-            (#"{"appBuild":"\#(appBuild)","backupFormatVersion":4,"capabilityGate":"m4","#-                + #""checksum":"\#(checksum)","databaseSchemaVersion":4,"entryCount":0,"#-                + #""exportedAt":"1970-01-12T13:46:40.000Z","payload":\#(payload),"#-                + #""workCount":0}"#).utf8)-    }--    // MARK: - Two current URL rules (illegal)--    static func twoCurrentRulePayload() -> BackupV4Payload {-        let host = "dup.example"-        let patternID = UUID()-        let ruleA = UUID()-        let ruleB = UUID()--        let pattern = BackupV4TitlePattern(-            id: patternID, version: 1, isActive: true, createdAt: created,-            definition: .segment(work: try! SegmentRangeSpec(origin: .start, offset: 0, length: 1), ignored: []),-            trimPrefix: nil, trimSuffix: nil, siteHostname: host)--        func rule(_ id: UUID, _ version: Int) -> BackupV4URLRule {-            BackupV4URLRule(-                id: id, version: version, isCurrent: true, createdAt: created,-                origin: .readerTaught,-                definition: .sequence(locator: .pathBracketed(-                    left: .literal(ExactScalarString("c")), right: .end)),-                siteHostname: host)-        }--        let site = BackupV4Site(-            hostname: host, displayName: "Dup", mode: .taught,-            patternIDs: [patternID], urlRuleIDs: [ruleA, ruleB], junkSuffixRule: nil)--        return BackupV4Payload(-            entries: [], works: [], sites: [site],-            titlePatterns: [pattern], urlRules: [rule(ruleA, 1), rule(ruleB, 2)])-    }-}