Pre-push review: T-2280/drop-superseded-columns

diff --git a/Asterism/AsterismTests/StatsDerivationTests.swift b/Asterism/AsterismTests/StatsDerivationTests.swiftindex 98a3ac0..02a012b 100644--- a/Asterism/AsterismTests/StatsDerivationTests.swift+++ b/Asterism/AsterismTests/StatsDerivationTests.swift@@ -1683,21 +1683,21 @@ private struct StatsStoreFixture {             // simplification and is wrong; the presentation has already             // collapsed the group to its carrier's assignment.             splitRows[0].work = target-            splitRows[0].workAssignmentProvenance = .manual+            splitRows[0].editCitations { $0.workAssignment = .manual }             splitRows[1].work = source-            splitRows[1].workAssignmentProvenance = .manual+            splitRows[1].editCitations { $0.workAssignment = .manual }              let blank = work(id: UUID(), title: "", in: context)             let blankEntry = entry(title: "Untitled Work Chapter", path: "blank-1", day: 6)             context.insert(blankEntry)             blankEntry.work = blank-            blankEntry.workAssignmentProvenance = .manual+            blankEntry.editCitations { $0.workAssignment = .manual }         }          let keptEntry = entry(title: "Kept Chapter", path: "kept-1", day: 7)         context.insert(keptEntry)         keptEntry.work = target-        keptEntry.workAssignmentProvenance = .manual+        keptEntry.editCitations { $0.workAssignment = .manual }         // Decision 6's unhydrated row: it counts in the notes total and appears         // in no bar.         let foldedEntry = entry(@@ -1705,7 +1705,7 @@ private struct StatsStoreFixture {             capturedAt: Date(timeIntervalSince1970: 0))         context.insert(foldedEntry)         foldedEntry.work = source-        foldedEntry.workAssignmentProvenance = .manual+        foldedEntry.editCitations { $0.workAssignment = .manual }          try context.save()     }

diff --git a/CHANGELOG.md b/CHANGELOG.mdindex b5bc55f..51ec479 100644--- a/CHANGELOG.md+++ b/CHANGELOG.md@@ -8,6 +8,60 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).  ### Changed +- **Deletions and verification (drop-superseded-columns, phase 3,+  T-2280).** The V7-shaped test facade (`MembershipTestSupport`'s column+  doors, `WorkMergeOutcome.workURL/identityEvidence/identityDisposition`)+  and the dead `validateStoreStrictly` gate are gone. The 7/8 golden+  archive exported by the V8 build imports into a V9 library and+  re-exports byte-identical. `make test-performance-m4` re-measured on+  V9 (`specs/drop-superseded-columns/verification-run.md`): the+  full-tier no-op reconcile fell from ~1.08 s to ~0.030 s and its+  regression floor is 100 ms (Q33); the observation-pass known issue is+  retired at 1.01 s; eight known issues remain, all with ceilings. Ten+  labels fell 14–27% with Entry seventeen columns lighter;+  `backup-projection-duplicate-free` rose 14% from the Q18 membership+  fault (recorded on T-2280, no budget). Agent notes, `CLAUDE.md`,+  `prerequisites.md` (rollback to V8 needs a wiped store plus the pre-V9+  archive; read the nil-blob count before any post-V9 export) and the+  specs overview describe V9.++- **Schema V9 (drop-superseded-columns, phase 2, T-2280).** The live+  schema is `AsterismSchemaV9` (9.0.0) and the plan is `[V8, V9]`, one+  lightweight stage dropping the 36 columns V8 retained unread plus the+  `Work.site` / `Site.works` pair — 38 names in all+  (`ModelContractTests.droppedColumns`). `AsterismSchemaV8` is the frozen+  snapshot (verified byte-for-byte against the pre-feature shape);+  `AsterismSchemaV5/V6/V7`, their recorded-store fixtures, `LegacyColumns`+  and `V8Shape` are deleted. `V8RecordedStoreTests` takes a real+  8.0.0-recorded store — composites, identity keys, a `WorkDistinctPair`+  and a nil-blob Entry included — through the stage and pins that the+  extension refuses `"8"` before the container can drop a column.+  `SiteRelationshipPopulationPass` survives minus its `Work.site` loop+  (Q27); the backup-import scratch container is built over the live+  schema (Q29 — over V8 it aborted the process once the stage removed+  columns); a nil-blob Entry that kept its Work link no longer trips+  the validator's `.none` arm (Q32). Graph baseline re-recorded as+  format 5 (Q30).++- **Blob-only write paths (drop-superseded-columns, phase 1, T-2280).**+  Every Entry citation is written to the blob and only the blob:+  `Entry.init` seeds the default blob (Q13), the provenance properties+  are read-only views over it with `editCitations` as the single+  read-modify-write door (Q14), and `LegacyColumns.refreshCitations` /+  `refreshMembership` have no callers. A nil blob reads as the default,+  is counted by `entriesWithoutCitationBlobCount` and never quarantines+  its hostname (Q25); a no-op edit leaves it nil so a consolidation+  cannot zero the count (Q23); undecodable bytes are repaired from the+  default on the next write (Q24). `GroupOrdering` reads memberships+  and blobs only, faulting one primary membership per Work (Q18), and a+  TitlePattern with no definition orders under the Q11 constant key.+  The app opens markers `"8"` and `"9"` and publishes `"9"` after+  validation with no data pass; the extension opens `"9"` only.+  `V8PopulationPass` and the conversion phases are deleted;+  `reconcileAfterSync` heals memberships only when the diagnosis counts+  a Work without one (Q20). The columns still exist and are written by+  nothing; they go at V9 in phase 2.+ - **Membership-scale measurements and tiered reconciliation   (multi-site-works, phase 6: Performance, T-2230).** New   `M4MembershipScalePerformanceTests` (in `make test-performance-m4`,

diff --git a/CLAUDE.md b/CLAUDE.mdindex 5cb0c89..3b83d3a 100644--- a/CLAUDE.md+++ b/CLAUDE.md@@ -43,7 +43,7 @@ invocations where a target exists. - `make test-core` — AsterismCore package tests (host, fast, safe). Since `rule-suggestion` the package has a second product, `AsterismIntelligence` (linked by the app and `AsterismTests` only — never the share extension), and its tests include **two live Apple Intelligence calls** — one per pipeline, decoding into `RuleProposal` and (since `character-extraction`) into `ExtractionResult` — both of which degrade to a `withKnownIssue` when the host has no model available. On a host that does have the model, a transient `GenerationError` (rate limited, assets unavailable) is also a known issue — only a response that will not decode into the expected structure fails the target, so the pre-commit bar stays deterministic either way. - `make test-quick` — unit-test bundle only (simulator) - `make test` / `make test-ui` — full suites (simulator)-- `make test-performance-m4` — M4 Core budgets, host only, no device, safe to run. **~25 minutes** (1,494 s measured 2026-08-26, including a ~190 s release build): 62% of it is the worst-case single-hostname consolidation in `M4ScalePerformanceTests` (5 samples, each paying its own ~40 s divert before a ~40 s measurement) and the Req 10.1 settling pass (10 samples, each re-seeding 1,350 duplicate rows plus an untimed observation pass). The V4→V5 migration measurement is **gone** — `retire-migration-chain` deleted the pass it timed along with the suite. **The target exits 0**, with the accepted breaches reported as `withKnownIssue` known issues rather than failures — **nine** since `multi-site-works` (it was four, plus an intermittent fifth). Four are long-standing: Req 10.1's settling pass and Req 5.5's three diagnosis re-derivations. Five joined with `multi-site-works` and are recorded, with their causes and the decisions they are waiting on, in `specs/multi-site-works/verification-run.md` §4 and §7: the **full**-tier no-op reconcile (1.82–2.00 ms → ~1.07 s, since `reconcileAfterSync` gained two whole-library conversion passes), Req 10.1's observation pass (~0.94 s → ~2.69 s, derivative of it), and Req 5.4's three capture-projection arms (0.093–0.102 s → 0.166–0.178 s, the one on a path the reader waits on). Task 22's review halved the capture arms and gated the conversion passes off the **arrival** tier (Decision 5 of that spec), so the debounce measures 0.030 s; the three that remain are full-tier passes — launch and the duplicate follow-up — and go with the columns at V9 (T-2272). Every one has a regression ceiling asserted *outside* its known-issue block, so a run that drifts further still fails; `RUNS=3` completes all three runs. See `specs/multi-site-works/verification-run.md` for the current numbers, `specs/retire-migration-chain/verification-run.md` for the previous ones, and `docs/agent-notes/testing.md` for recording a band.+- `make test-performance-m4` — M4 Core budgets, host only, no device, safe to run. **~21 minutes** (1,093 s of test time measured 2026-08-28, plus a ~190 s release build): most of it is the worst-case single-hostname consolidation in `M4ScalePerformanceTests` (5 samples, each paying its own ~40 s divert before a ~40 s measurement) and the Req 10.1 settling pass (10 samples, each re-seeding 1,350 duplicate rows plus an untimed observation pass). The V4→V5 migration measurement is **gone** — `retire-migration-chain` deleted the pass it timed along with the suite. **The target exits 0**, with the accepted breaches reported as `withKnownIssue` known issues rather than failures — **eight** since `drop-superseded-columns` (four before `multi-site-works`, nine after it). Four are long-standing: Req 10.1's settling pass and Req 5.5's three diagnosis re-derivations. Three are Req 5.4's capture-projection arms (0.093–0.102 s pre-V8 → 0.160–0.170 s, the one on a path the reader waits on). The eighth is the **full**-tier no-op reconcile, and V9 recovered most of it: 1.07 s → **0.0296–0.0302 s** once `V8PopulationPass` was deleted with the columns and `MembershipReconciler.heal` was gated on the diagnosis, which is still 3.0× a 10 ms ceiling drawn before the library had a membership table. Req 10.1's *observation* pass **retired** with that fall (2.69 s → 1.01 s, back inside its 2 s budget). Every one has a regression ceiling asserted *outside* its known-issue block, so a run that drifts further still fails; `RUNS=3` completes all three runs. See `specs/drop-superseded-columns/verification-run.md` for the current numbers, `specs/multi-site-works/verification-run.md` §4 and §7 for the previous ones, and `docs/agent-notes/testing.md` for recording a band. - `make test-performance-chunks` — host-only calibration sweep of the shared bulk chunk constant (import commits and the reconciler re-pin). No device, safe to run, but gated on `ASTERISM_RUN_CHUNK_SWEEP=1` and **~20 minutes per run**, so it is deliberately *not* part of `make test-performance-m4`. It asserts nothing — a calibration is reported, not budgeted. Re-run it when the bulk write paths change (Q53 and the task 25 section of `specs/cloudkit-mirroring/implementation.md`). - `make test-performance-m4-recent` — **physical device, see above** 

diff --git a/Packages/AsterismCore/Sources/AsterismCore/ArchiveRecordBuilders.swift b/Packages/AsterismCore/Sources/AsterismCore/ArchiveRecordBuilders.swiftindex ce027c3..c8ae59f 100644--- a/Packages/AsterismCore/Sources/AsterismCore/ArchiveRecordBuilders.swift+++ b/Packages/AsterismCore/Sources/AsterismCore/ArchiveRecordBuilders.swift@@ -87,17 +87,14 @@ internal enum ArchiveRecordBuilders {         return row     } -    /// The Work row alone. A 7/8 record names no site (Req 9.1), so the-    /// superseded `siteHostname` column starts empty and-    /// `LegacyColumns.refreshMembership` fills it from the membership records-    /// once they are wired — the same mirror every other Work writer keeps-    /// (Decision 4), **until V9 (T-2272)** drops the columns and the mirror-    /// with them.+    /// The Work row alone. A 7/8 record names no site (Req 9.1), and since V9 a+    /// Work has no site column to name: its site presence is its+    /// `WorkSiteMembership`, which `makeMembership` below builds from the+    /// archive's own records.     static func makeWork(_ record: BackupV7Work) -> Work {         let work = Work(             id: record.id,             displayTitle: record.displayTitle,-            siteHostname: "",             timestamp: record.createdAt         )         LibraryRepository.apply(record, to: work)

diff --git a/Packages/AsterismCore/Sources/AsterismCore/AsterismSchemaV5.swift b/Packages/AsterismCore/Sources/AsterismCore/AsterismSchemaV5.swiftdeleted file mode 100644index 60d0290..0000000--- a/Packages/AsterismCore/Sources/AsterismCore/AsterismSchemaV5.swift+++ /dev/null@@ -1,175 +0,0 @@-import Foundation-import SwiftData--/// The frozen M4a schema — the shape every installed library was written by-/// before `configurable-work-types`, and the `from` version of the V5 → V6-/// lightweight stage.-///-/// V5 carries the two relational references M4a exists for: `Entry.site` and-/// `Work.site`, both optional, with the `.nullify` inverses `Site.entries` and-/// `Site.works`. The hostname strings stay beside them as capture-time evidence-/// (Q3). It does **not** carry `Work.workTypeID` or `WorkTypeEntity`; those are-/// V6's additions.-///-/// V5 is frozen because *any* edit to its body makes a V5-recorded store refuse-/// to open: `addPersistentStore` fails with `NSCocoaErrorDomain` 134504,-/// "Cannot use staged migration with an unknown model version" (measured for the-/// V4 snapshot this file is modelled on, Q20 of `retire-migration-chain`). The-/// live classes therefore moved on, and this declaration exists only to give-/// `AsterismV8MigrationPlan` the `from` version of its first stage.-///-/// The classes are nested here so they can carry the same SwiftData entity names-/// ("Entry", "Site", …) as the live V6 classes without a top-level collision:-/// the only top-level references are typealiases, and two *top-level* `@Model`s-/// sharing an entity name crash `ModelContext` (`docs/agent-notes/schema-migration.md`).-/// Nothing reads a V5-shaped object at runtime, so these carry stored columns-/// only — no accessors, no business logic.-///-/// # These snapshots are frozen *by reference*, not only by file-///-/// The nesting freezes the class bodies; it does **not** freeze the value types-/// they store. `SegmentRangeSpec`, `SegmentPositionSpec`, `URLIdentityRule` and-/// `JunkSuffixRule` are live top-level types in `ValueObjects.swift`, shared with-/// the live V6 classes. Editing any of them changes the stored shape of this-/// frozen schema silently — and that is exactly what makes a recorded store-/// refuse to open (134504).-///-/// So: **any change to the stored shape of those four types requires new-/// versioned copies of them**, nested beside these classes and repointed here,-/// rather than an edit in place. Adding a computed member or a method to them is-/// safe; adding, removing or retyping a stored property is not.-public enum AsterismSchemaV5: VersionedSchema {-    public static let versionIdentifier = Schema.Version(5, 0, 0)--    public static var models: [any PersistentModel.Type] {-        [Entry.self, Work.self, Site.self, TitlePattern.self, URLRulePattern.self]-    }-}--extension AsterismSchemaV5 {-    @Model-    public final class Entry {-        public var id: UUID = UUID()-        public var captureTitle: String = ""-        public var captureTitleSourceRaw: String = CaptureTitleSource.manual.rawValue-        public var rawURLString: String = ""-        public var canonicalURLString: String?-        public var hostname: String = ""-        public var site: Site?-        public var entryIdentityKey: String = ""-        public var identityKeyVersion: Int = 1-        public var conservativeIdentityKey: String = ""-        public var identityBasisRaw: String = EntryIdentityBasis.conservative.rawValue-        public var identityURLRuleID: UUID?-        public var identityURLRuleVersion: Int?-        public var identityNameTitleRuleID: UUID?-        public var identityNameTitleRuleVersion: Int?-        public var urlWorkIdentity: String?-        public var urlWorkRuleID: UUID?-        public var urlWorkRuleVersion: Int?-        public var chapterSequence: String?-        public var chapterSequenceRuleID: UUID?-        public var chapterSequenceRuleVersion: Int?-        public var chapterTitle: String?-        public var chapterTitleProvenanceRaw: String = FieldProvenanceKind.none.rawValue-        public var chapterPatternID: UUID?-        public var chapterPatternVersion: Int?-        public var note: String = ""-        public var ratingRaw: String?-        public var firstCapturedAt: Date = Date(timeIntervalSince1970: 0)-        public var lastSharedAt: Date = Date(timeIntervalSince1970: 0)-        public var modifiedAt: Date = Date(timeIntervalSince1970: 0)-        public var work: Work?-        public var workAssignmentProvenanceRaw: String = FieldProvenanceKind.none.rawValue-        public var workPatternID: UUID?-        public var workPatternVersion: Int?-        public var workURLRuleID: UUID?-        public var workURLRuleVersion: Int?-        public var workURLAssignmentKindRaw: String?-        public var intentionallyUnattached: Bool = false--        public init() {}-    }--    @Model-    public final class Work {-        public var id: UUID = UUID()-        public var displayTitle: String = ""-        public var lastParsedTitle: String?-        public var siteHostname: String = ""-        public var site: Site?-        public var urlIdentity: String?-        public var urlIdentityStateRaw: String = WorkURLIdentityState.none.rawValue-        public var urlIdentityRuleID: UUID?-        public var urlIdentityRuleVersion: Int?-        public var workURLString: String?-        public var genericNotes: String = ""-        public var typeRaw: String = WorkType.other.rawValue-        public var genreTags: [String] = []-        public var titleProvenanceRaw: String = TitleProvenance.manual.rawValue-        public var createdAt: Date = Date(timeIntervalSince1970: 0)-        public var modifiedAt: Date = Date(timeIntervalSince1970: 0)-        @Relationship(deleteRule: .nullify, inverse: \Entry.work)-        public var entries: [Entry]?--        public init() {}-    }--    @Model-    public final class Site {-        public var hostname: String = ""-        public var displayName: String = ""-        public var modeRaw: String = SiteMode.untaught.rawValue-        @Relationship(deleteRule: .cascade, inverse: \TitlePattern.site)-        public var patterns: [TitlePattern]?-        @Relationship(deleteRule: .cascade, inverse: \URLRulePattern.site)-        public var urlRules: [URLRulePattern]?-        /// Inverse of `Entry.site`, present only because CloudKit requires every-        /// relationship to have one. Internal for the same reason the live class-        /// keeps it internal (Q17): traversing it faults every Entry for a-        /// hostname.-        @Relationship(deleteRule: .nullify, inverse: \Entry.site)-        var entries: [Entry]?-        /// Inverse of `Work.site`. Same reasoning as `entries`.-        @Relationship(deleteRule: .nullify, inverse: \Work.site)-        var works: [Work]?-        public var urlIdentityRule: URLIdentityRule?-        public var junkSuffixRule: JunkSuffixRule?--        public init() {}-    }--    @Model-    public final class TitlePattern {-        public var id: UUID = UUID()-        public var version: Int = 1-        public var isActive: Bool = false-        public var createdAt: Date = Date(timeIntervalSince1970: 0)-        public var formRaw: String = PatternForm.segment.rawValue-        public var segmentWorkAnchor: SegmentRangeSpec?-        public var segmentIgnoredAnchors: [SegmentPositionSpec]?-        public var phrasePrefix: String?-        public var phraseSeparator: String?-        public var phraseSuffix: String?-        public var fieldOrderRaw: String?-        public var trimPrefix: String?-        public var trimSuffix: String?-        public var chapterless: Bool = false-        public var site: Site?--        public init() {}-    }--    @Model-    public final class URLRulePattern {-        public var id: UUID = UUID()-        public var version: Int = 1-        public var isCurrent: Bool = false-        public var createdAt: Date = Date(timeIntervalSince1970: 0)-        public var originRaw: String = URLRuleOrigin.readerTaught.rawValue-        public var definitionData: Data = Data()-        public var site: Site?--        public init() {}-    }-}

diff --git a/Packages/AsterismCore/Sources/AsterismCore/AsterismSchemaV6.swift b/Packages/AsterismCore/Sources/AsterismCore/AsterismSchemaV6.swiftdeleted file mode 100644index a3da2b7..0000000--- a/Packages/AsterismCore/Sources/AsterismCore/AsterismSchemaV6.swift+++ /dev/null@@ -1,186 +0,0 @@-import Foundation-import SwiftData--/// The frozen `configurable-work-types` schema — the shape every installed-/// library was written by before `character-extraction`, and the `from` version-/// of the V6 → V7 lightweight stage.-///-/// V6 is V5 plus the `WorkTypeEntity` table and `Work.workTypeID`. It does-/// **not** carry `Character`, `CharacterSuppression`, or the two extraction-/// fingerprint columns; those are V7's additions.-///-/// V6 is frozen for the same reason V5 is: *any* edit to its body makes a-/// V6-recorded store refuse to open with `NSCocoaErrorDomain` 134504, "Cannot-/// use staged migration with an unknown model version". The live classes-/// therefore moved on (V7 is frozen beside this file and V8 is live), and this-/// declaration exists only to give `AsterismV8MigrationPlan` a `from` version —-/// and to let `V6RecordedStoreFixture` seed a genuinely 6.0.0-recorded store-/// in-process.-///-/// The classes are nested so they can carry the same SwiftData entity names-/// ("Entry", "Site", …) as the live V7 classes without a top-level collision:-/// the only top-level references are typealiases, and two *top-level* `@Model`s-/// sharing an entity name crash `ModelContext`-/// (`docs/agent-notes/schema-migration.md`). Nothing reads a V6-shaped object at-/// runtime, so these carry stored columns only — no accessors, no business-/// logic.-///-/// # These snapshots are frozen *by reference*, not only by file-///-/// The nesting freezes the class bodies; it does **not** freeze the value types-/// they store. `SegmentRangeSpec`, `SegmentPositionSpec`, `URLIdentityRule` and-/// `JunkSuffixRule` are live top-level types in `ValueObjects.swift`, shared-/// with the live classes. Editing any of them changes the stored shape of this-/// frozen schema silently — and that is exactly what makes a recorded store-/// refuse to open (134504).-public enum AsterismSchemaV6: VersionedSchema {-    public static let versionIdentifier = Schema.Version(6, 0, 0)--    public static var models: [any PersistentModel.Type] {-        [Entry.self, Work.self, Site.self, TitlePattern.self, URLRulePattern.self,-         WorkTypeEntity.self]-    }-}--extension AsterismSchemaV6 {-    @Model-    public final class Entry {-        public var id: UUID = UUID()-        public var captureTitle: String = ""-        public var captureTitleSourceRaw: String = CaptureTitleSource.manual.rawValue-        public var rawURLString: String = ""-        public var canonicalURLString: String?-        public var hostname: String = ""-        public var site: Site?-        public var entryIdentityKey: String = ""-        public var identityKeyVersion: Int = 1-        public var conservativeIdentityKey: String = ""-        public var identityBasisRaw: String = EntryIdentityBasis.conservative.rawValue-        public var identityURLRuleID: UUID?-        public var identityURLRuleVersion: Int?-        public var identityNameTitleRuleID: UUID?-        public var identityNameTitleRuleVersion: Int?-        public var urlWorkIdentity: String?-        public var urlWorkRuleID: UUID?-        public var urlWorkRuleVersion: Int?-        public var chapterSequence: String?-        public var chapterSequenceRuleID: UUID?-        public var chapterSequenceRuleVersion: Int?-        public var chapterTitle: String?-        public var chapterTitleProvenanceRaw: String = FieldProvenanceKind.none.rawValue-        public var chapterPatternID: UUID?-        public var chapterPatternVersion: Int?-        public var note: String = ""-        public var ratingRaw: String?-        public var firstCapturedAt: Date = Date(timeIntervalSince1970: 0)-        public var lastSharedAt: Date = Date(timeIntervalSince1970: 0)-        public var modifiedAt: Date = Date(timeIntervalSince1970: 0)-        public var work: Work?-        public var workAssignmentProvenanceRaw: String = FieldProvenanceKind.none.rawValue-        public var workPatternID: UUID?-        public var workPatternVersion: Int?-        public var workURLRuleID: UUID?-        public var workURLRuleVersion: Int?-        public var workURLAssignmentKindRaw: String?-        public var intentionallyUnattached: Bool = false--        public init() {}-    }--    @Model-    public final class Work {-        public var id: UUID = UUID()-        public var displayTitle: String = ""-        public var lastParsedTitle: String?-        public var siteHostname: String = ""-        public var site: Site?-        public var urlIdentity: String?-        public var urlIdentityStateRaw: String = WorkURLIdentityState.none.rawValue-        public var urlIdentityRuleID: UUID?-        public var urlIdentityRuleVersion: Int?-        public var workURLString: String?-        public var genericNotes: String = ""-        public var typeRaw: String = WorkType.other.rawValue-        public var workTypeID: UUID?-        public var genreTags: [String] = []-        public var titleProvenanceRaw: String = TitleProvenance.manual.rawValue-        public var createdAt: Date = Date(timeIntervalSince1970: 0)-        public var modifiedAt: Date = Date(timeIntervalSince1970: 0)-        @Relationship(deleteRule: .nullify, inverse: \Entry.work)-        public var entries: [Entry]?--        public init() {}-    }--    @Model-    public final class Site {-        public var hostname: String = ""-        public var displayName: String = ""-        public var modeRaw: String = SiteMode.untaught.rawValue-        @Relationship(deleteRule: .cascade, inverse: \TitlePattern.site)-        public var patterns: [TitlePattern]?-        @Relationship(deleteRule: .cascade, inverse: \URLRulePattern.site)-        public var urlRules: [URLRulePattern]?-        /// Inverse of `Entry.site`, present only because CloudKit requires every-        /// relationship to have one. Internal for the same reason the live class-        /// keeps it internal (Q17): traversing it faults every Entry for a-        /// hostname.-        @Relationship(deleteRule: .nullify, inverse: \Entry.site)-        var entries: [Entry]?-        /// Inverse of `Work.site`. Same reasoning as `entries`.-        @Relationship(deleteRule: .nullify, inverse: \Work.site)-        var works: [Work]?-        public var urlIdentityRule: URLIdentityRule?-        public var junkSuffixRule: JunkSuffixRule?--        public init() {}-    }--    @Model-    public final class TitlePattern {-        public var id: UUID = UUID()-        public var version: Int = 1-        public var isActive: Bool = false-        public var createdAt: Date = Date(timeIntervalSince1970: 0)-        public var formRaw: String = PatternForm.segment.rawValue-        public var segmentWorkAnchor: SegmentRangeSpec?-        public var segmentIgnoredAnchors: [SegmentPositionSpec]?-        public var phrasePrefix: String?-        public var phraseSeparator: String?-        public var phraseSuffix: String?-        public var fieldOrderRaw: String?-        public var trimPrefix: String?-        public var trimSuffix: String?-        public var chapterless: Bool = false-        public var site: Site?--        public init() {}-    }--    @Model-    public final class URLRulePattern {-        public var id: UUID = UUID()-        public var version: Int = 1-        public var isCurrent: Bool = false-        public var createdAt: Date = Date(timeIntervalSince1970: 0)-        public var originRaw: String = URLRuleOrigin.readerTaught.rawValue-        public var definitionData: Data = Data()-        public var site: Site?--        public init() {}-    }--    @Model-    public final class WorkTypeEntity {-        public var id: UUID = UUID()-        public var name: String = ""-        public var nameModifiedAt: Date = Date(timeIntervalSince1970: 0)-        public var stateRaw: String = WorkTypeState.active.rawValue-        public var stateModifiedAt: Date = Date(timeIntervalSince1970: 0)-        public var canonicalID: UUID?-        public var createdAt: Date = Date(timeIntervalSince1970: 0)-        public var modifiedAt: Date = Date(timeIntervalSince1970: 0)--        public init() {}-    }-}

diff --git a/Packages/AsterismCore/Sources/AsterismCore/AsterismSchemaV7.swift b/Packages/AsterismCore/Sources/AsterismCore/AsterismSchemaV7.swiftdeleted file mode 100644index 9fd3f01..0000000--- a/Packages/AsterismCore/Sources/AsterismCore/AsterismSchemaV7.swift+++ /dev/null@@ -1,222 +0,0 @@-import Foundation-import SwiftData--/// The frozen `character-extraction` schema — the shape every installed library-/// was written by before `multi-site-works`, and the `from` version of the-/// V7 → V8 lightweight stage.-///-/// V7 is V6 plus the `Character` and `CharacterSuppression` tables and the two-/// extraction fingerprint columns. It does **not** carry `WorkSiteMembership`,-/// `WorkDistinctPair`, `Entry.citationsData` or `TitlePattern.definitionData`;-/// those are V8's additions.-///-/// V7 is frozen for the same reason V5 and V6 are: *any* edit to its body makes-/// a V7-recorded store refuse to open with `NSCocoaErrorDomain` 134504, "Cannot-/// use staged migration with an unknown model version". The live classes-/// therefore moved to `AsterismSchemaV8`, and this declaration exists only to-/// give `AsterismV8MigrationPlan` a `from` version — and to let-/// `V7RecordedStoreFixture` seed a genuinely 7.0.0-recorded store in-process.-///-/// The classes are nested so they can carry the same SwiftData entity names-/// ("Entry", "Site", …) as the live V8 classes without a top-level collision:-/// the only top-level references are typealiases, and two *top-level* `@Model`s-/// sharing an entity name crash `ModelContext`-/// (`docs/agent-notes/schema-migration.md`). Nothing reads a V7-shaped object at-/// runtime, so these carry stored columns only — no accessors, no business-/// logic.-///-/// # These snapshots are frozen *by reference*, not only by file-///-/// The nesting freezes the class bodies; it does **not** freeze the value types-/// they store. `SegmentRangeSpec`, `SegmentPositionSpec`, `URLIdentityRule` and-/// `JunkSuffixRule` are live top-level types in `ValueObjects.swift`, shared-/// with the live classes. Editing any of them changes the stored shape of this-/// frozen schema silently — and that is exactly what makes a recorded store-/// refuse to open (134504).-public enum AsterismSchemaV7: VersionedSchema {-    public static let versionIdentifier = Schema.Version(7, 0, 0)--    public static var models: [any PersistentModel.Type] {-        [Entry.self, Work.self, Site.self, TitlePattern.self, URLRulePattern.self,-         WorkTypeEntity.self, Character.self, CharacterSuppression.self]-    }-}--extension AsterismSchemaV7 {-    @Model-    public final class Entry {-        public var id: UUID = UUID()-        public var captureTitle: String = ""-        public var captureTitleSourceRaw: String = CaptureTitleSource.manual.rawValue-        public var rawURLString: String = ""-        public var canonicalURLString: String?-        public var hostname: String = ""-        public var site: Site?-        public var entryIdentityKey: String = ""-        public var identityKeyVersion: Int = 1-        public var conservativeIdentityKey: String = ""-        public var identityBasisRaw: String = EntryIdentityBasis.conservative.rawValue-        public var identityURLRuleID: UUID?-        public var identityURLRuleVersion: Int?-        public var identityNameTitleRuleID: UUID?-        public var identityNameTitleRuleVersion: Int?-        public var urlWorkIdentity: String?-        public var urlWorkRuleID: UUID?-        public var urlWorkRuleVersion: Int?-        public var chapterSequence: String?-        public var chapterSequenceRuleID: UUID?-        public var chapterSequenceRuleVersion: Int?-        public var chapterTitle: String?-        public var chapterTitleProvenanceRaw: String = FieldProvenanceKind.none.rawValue-        public var chapterPatternID: UUID?-        public var chapterPatternVersion: Int?-        public var note: String = ""-        public var ratingRaw: String?-        public var firstCapturedAt: Date = Date(timeIntervalSince1970: 0)-        public var lastSharedAt: Date = Date(timeIntervalSince1970: 0)-        public var modifiedAt: Date = Date(timeIntervalSince1970: 0)-        public var work: Work?-        public var workAssignmentProvenanceRaw: String = FieldProvenanceKind.none.rawValue-        public var workPatternID: UUID?-        public var workPatternVersion: Int?-        public var workURLRuleID: UUID?-        public var workURLRuleVersion: Int?-        public var workURLAssignmentKindRaw: String?-        public var intentionallyUnattached: Bool = false-        public var characterExtractionFingerprint: String?--        public init() {}-    }--    @Model-    public final class Work {-        public var id: UUID = UUID()-        public var displayTitle: String = ""-        public var lastParsedTitle: String?-        public var siteHostname: String = ""-        public var site: Site?-        public var urlIdentity: String?-        public var urlIdentityStateRaw: String = WorkURLIdentityState.none.rawValue-        public var urlIdentityRuleID: UUID?-        public var urlIdentityRuleVersion: Int?-        public var workURLString: String?-        public var genericNotes: String = ""-        public var typeRaw: String = WorkType.other.rawValue-        public var workTypeID: UUID?-        public var genreTags: [String] = []-        public var titleProvenanceRaw: String = TitleProvenance.manual.rawValue-        public var createdAt: Date = Date(timeIntervalSince1970: 0)-        public var modifiedAt: Date = Date(timeIntervalSince1970: 0)-        public var genericNotesExtractionFingerprint: String?-        @Relationship(deleteRule: .nullify, inverse: \Entry.work)-        public var entries: [Entry]?-        @Relationship(deleteRule: .nullify, inverse: \Character.work)-        public var characters: [Character]?-        @Relationship(deleteRule: .nullify, inverse: \CharacterSuppression.work)-        public var characterSuppressions: [CharacterSuppression]?--        public init() {}-    }--    @Model-    public final class Site {-        public var hostname: String = ""-        public var displayName: String = ""-        public var modeRaw: String = SiteMode.untaught.rawValue-        @Relationship(deleteRule: .cascade, inverse: \TitlePattern.site)-        public var patterns: [TitlePattern]?-        @Relationship(deleteRule: .cascade, inverse: \URLRulePattern.site)-        public var urlRules: [URLRulePattern]?-        /// Inverse of `Entry.site`, present only because CloudKit requires every-        /// relationship to have one. Internal for the same reason the live class-        /// keeps it internal (Q17): traversing it faults every Entry for a-        /// hostname.-        @Relationship(deleteRule: .nullify, inverse: \Entry.site)-        var entries: [Entry]?-        /// Inverse of `Work.site`. Same reasoning as `entries`.-        @Relationship(deleteRule: .nullify, inverse: \Work.site)-        var works: [Work]?-        public var urlIdentityRule: URLIdentityRule?-        public var junkSuffixRule: JunkSuffixRule?--        public init() {}-    }--    @Model-    public final class TitlePattern {-        public var id: UUID = UUID()-        public var version: Int = 1-        public var isActive: Bool = false-        public var createdAt: Date = Date(timeIntervalSince1970: 0)-        public var formRaw: String = PatternForm.segment.rawValue-        public var segmentWorkAnchor: SegmentRangeSpec?-        public var segmentIgnoredAnchors: [SegmentPositionSpec]?-        public var phrasePrefix: String?-        public var phraseSeparator: String?-        public var phraseSuffix: String?-        public var fieldOrderRaw: String?-        public var trimPrefix: String?-        public var trimSuffix: String?-        public var chapterless: Bool = false-        public var site: Site?--        public init() {}-    }--    @Model-    public final class URLRulePattern {-        public var id: UUID = UUID()-        public var version: Int = 1-        public var isCurrent: Bool = false-        public var createdAt: Date = Date(timeIntervalSince1970: 0)-        public var originRaw: String = URLRuleOrigin.readerTaught.rawValue-        public var definitionData: Data = Data()-        public var site: Site?--        public init() {}-    }--    @Model-    public final class WorkTypeEntity {-        public var id: UUID = UUID()-        public var name: String = ""-        public var nameModifiedAt: Date = Date(timeIntervalSince1970: 0)-        public var stateRaw: String = WorkTypeState.active.rawValue-        public var stateModifiedAt: Date = Date(timeIntervalSince1970: 0)-        public var canonicalID: UUID?-        public var createdAt: Date = Date(timeIntervalSince1970: 0)-        public var modifiedAt: Date = Date(timeIntervalSince1970: 0)--        public init() {}-    }--    @Model-    public final class Character {-        public var id: UUID = UUID()-        public var name: String = ""-        public var nameKey: String = ""-        public var aliases: [String] = []-        public var note: String = ""-        public var factsData: Data?-        public var createdAt: Date = Date(timeIntervalSince1970: 0)-        public var modifiedAt: Date = Date(timeIntervalSince1970: 0)-        public var work: Work?--        public init() {}-    }--    @Model-    public final class CharacterSuppression {-        public var id: UUID = UUID()-        public var work: Work?-        public var kindRaw: String = CharacterSuppressionKind.candidate.rawValue-        public var nameKey: String = ""-        public var sourceKindRaw: String?-        public var sourceEntryID: UUID?-        public var evidence: String?-        public var statusRaw: String = CharacterSuppressionStatus.active.rawValue-        public var actionAt: Date = Date(timeIntervalSince1970: 0)--        public init() {}-    }-}

diff --git a/Packages/AsterismCore/Sources/AsterismCore/AsterismSchemaV8.swift b/Packages/AsterismCore/Sources/AsterismCore/AsterismSchemaV8.swiftindex fb9411c..fdf9fc8 100644--- a/Packages/AsterismCore/Sources/AsterismCore/AsterismSchemaV8.swift+++ b/Packages/AsterismCore/Sources/AsterismCore/AsterismSchemaV8.swift@@ -1,26 +1,65 @@ import Foundation import SwiftData -/// The runtime schema. Its body is `Models.swift`, which opens-/// `extension AsterismSchemaV8`.+/// The frozen `multi-site-works` schema — the shape every installed library was+/// written by before `drop-superseded-columns`, and the `from` version of the+/// V8 → V9 lightweight stage. ///-/// V8 is V7 plus what `multi-site-works` needs: the `WorkSiteMembership` table-/// (Q3 — a Work's site presence becomes a row per hostname), the-/// `WorkDistinctPair` table (Q20/Q27 — a dismissed cross-site duplicate-/// candidate), and the two Codable blob columns `Entry.citationsData` and-/// `TitlePattern.definitionData` (Q25).+/// V8 is V7 plus the `WorkSiteMembership` and `WorkDistinctPair` tables and the+/// two Codable blob columns `Entry.citationsData` and+/// `TitlePattern.definitionData`. **It only added**: the columns those three+/// superseded stayed in the stored shape, because the lightweight stage runs+/// inside `ModelContainer.init` and a stage that dropped them would have+/// destroyed the source before `V8PopulationPass` could copy it. This snapshot+/// is what that shape looked like — `Work`'s six site/identity/URL columns and+/// `typeRaw`, `Entry.identityKeyVersion` and its seventeen citation columns,+/// `TitlePattern`'s ten definition columns, `Site.urlIdentityRule`, and the+/// `Work.site` ↔ `Site.works` inverse pair — all of which V9 drops. ///-/// **V8 only adds** (Decision 3). Every superseded column — `Work`'s six-/// site/identity/URL columns and `typeRaw`, `Entry.identityKeyVersion` and its-/// citation columns, `TitlePattern`'s ten definition columns,-/// `Site.urlIdentityRule` — stays in the stored shape with no live accessor and-/// no writer, because the lightweight stage runs inside `ModelContainer.init`-/// and a stage that dropped them would destroy the source before-/// `V8PopulationPass` could read it. V9 (T-2272) inherits the drop.+/// V8 is frozen for the same reason V5, V6 and V7 were: *any* edit to its body+/// makes a V8-recorded store refuse to open with `NSCocoaErrorDomain` 134504,+/// "Cannot use staged migration with an unknown model version". The live classes+/// therefore moved to `AsterismSchemaV9`, and this declaration exists only to+/// give `AsterismV9MigrationPlan` a `from` version — and to let+/// `V8RecordedStoreFixture` seed a genuinely 8.0.0-recorded store in-process. ///-/// Every addition is CloudKit-legal by construction: every property is defaulted-/// or optional, nothing is unique, and every new relationship is `.nullify` with-/// its inverse declared on the to-many side.+/// The classes are nested so they can carry the same SwiftData entity names+/// ("Entry", "Site", …) as the live V9 classes without a top-level collision:+/// the only top-level references are typealiases, and two *top-level* `@Model`s+/// sharing an entity name crash `ModelContext`+/// (`docs/agent-notes/schema-migration.md`). Nothing reads a V8-shaped object at+/// runtime, so these carry stored columns only — no accessors, no business+/// logic.+///+/// # These snapshots are frozen *by reference*, not only by file+///+/// The nesting freezes the class bodies; it does **not** freeze anything a body+/// *names*. Editing one of those changes the stored shape of this frozen schema+/// silently — and that is exactly what makes a recorded store refuse to open+/// (134504). Two families of referent, both live and both shared with V9:+///+/// * **The stored value types.** `SegmentRangeSpec`, `SegmentPositionSpec`,+///   `URLIdentityRule` and `JunkSuffixRule` are top-level types in+///   `ValueObjects.swift`. Their stored properties are this schema's stored+///   properties.+/// * **Every enum whose raw value is baked into a default.** A default is part+///   of the shape, so `WorkType.other.rawValue`, `PatternForm.segment.rawValue`,+///   `FieldProvenanceKind.none.rawValue`, `WorkURLIdentityState.none.rawValue`,+///   `SiteMode.untaught.rawValue`, `CaptureTitleSource.manual.rawValue`,+///   `EntryIdentityBasis.conservative.rawValue`, `TitleProvenance.manual`,+///   `URLRuleOrigin.readerTaught`, `WorkTypeState.active`,+///   `CharacterSuppressionKind.candidate` and+///   `CharacterSuppressionStatus.active` are all frozen *spellings* here, not+///   merely frozen references. Renaming a case, or reordering one whose raw+///   value is derived rather than written out, edits this file without touching+///   it.+///+///   `WorkType` is the one to watch: V9 dropped `Work.typeRaw`, so this+///   snapshot's default is the enum's **only** live referent. Nothing else in+///   the package reads it, which makes it look unused to every tool and to+///   every reader who has not read this paragraph. It is not — it is a frozen+///   persisted default, and it may not be edited or deleted while a store+///   recorded at 8.0.0 can still exist. public enum AsterismSchemaV8: VersionedSchema {     public static let versionIdentifier = Schema.Version(8, 0, 0) @@ -31,33 +70,216 @@ public enum AsterismSchemaV8: VersionedSchema {     } } -/// The migration plan: `[V5, V6, V7, V8]`, three lightweight stages.-///-/// **The V5 stage stays** (Q80 of `character-extraction`). Retiring it would-/// carry `retire-migration-chain` Decision 6's population precondition — every-/// device verified past the migration — for no gain here, and dropping it would-/// make every V5-seeded fixture unopenable, because declaring a plan makes a-/// store older than the plan's oldest schema fail closed rather than convert-/// implicitly (`docs/agent-notes/schema-migration.md`).-///-/// All three stages are `.lightweight`. V7 → V8 adds two tables and two columns-/// and changes nothing that exists, so `ModelContainer.init` runs the whole-/// conversion; the *data* pass that fills the new rows is `V8PopulationPass`,-/// run by the bootstrap's marker-lagging arm after the open (Decision 3, Q13).-/// None is `.custom`: a custom stage never fires between structurally identical-/// models, and it would also run inside the share extension, which must never-/// migrate.-public enum AsterismV8MigrationPlan: SchemaMigrationPlan {-    public static var schemas: [any VersionedSchema.Type] {-        [AsterismSchemaV5.self, AsterismSchemaV6.self, AsterismSchemaV7.self,-         AsterismSchemaV8.self]-    }--    public static var stages: [MigrationStage] {-        [-            .lightweight(fromVersion: AsterismSchemaV5.self, toVersion: AsterismSchemaV6.self),-            .lightweight(fromVersion: AsterismSchemaV6.self, toVersion: AsterismSchemaV7.self),-            .lightweight(fromVersion: AsterismSchemaV7.self, toVersion: AsterismSchemaV8.self),-        ]+extension AsterismSchemaV8 {+    @Model+    public final class Entry {+        public var id: UUID = UUID()+        public var captureTitle: String = ""+        public var captureTitleSourceRaw: String = CaptureTitleSource.manual.rawValue+        public var rawURLString: String = ""+        public var canonicalURLString: String?+        public var hostname: String = ""+        public var site: Site?+        public var entryIdentityKey: String = ""+        public var identityKeyVersion: Int = 1+        public var conservativeIdentityKey: String = ""+        public var identityBasisRaw: String = EntryIdentityBasis.conservative.rawValue+        public var identityURLRuleID: UUID?+        public var identityURLRuleVersion: Int?+        public var identityNameTitleRuleID: UUID?+        public var identityNameTitleRuleVersion: Int?+        public var urlWorkIdentity: String?+        public var urlWorkRuleID: UUID?+        public var urlWorkRuleVersion: Int?+        public var chapterSequence: String?+        public var chapterSequenceRuleID: UUID?+        public var chapterSequenceRuleVersion: Int?+        public var chapterTitle: String?+        public var chapterTitleProvenanceRaw: String = FieldProvenanceKind.none.rawValue+        public var chapterPatternID: UUID?+        public var chapterPatternVersion: Int?+        public var note: String = ""+        public var ratingRaw: String?+        public var firstCapturedAt: Date = Date(timeIntervalSince1970: 0)+        public var lastSharedAt: Date = Date(timeIntervalSince1970: 0)+        public var modifiedAt: Date = Date(timeIntervalSince1970: 0)+        public var work: Work?+        public var workAssignmentProvenanceRaw: String = FieldProvenanceKind.none.rawValue+        public var workPatternID: UUID?+        public var workPatternVersion: Int?+        public var workURLRuleID: UUID?+        public var workURLRuleVersion: Int?+        public var workURLAssignmentKindRaw: String?+        public var intentionallyUnattached: Bool = false+        public var characterExtractionFingerprint: String?+        public var citationsData: Data?++        public init() {}+    }++    @Model+    public final class Work {+        public var id: UUID = UUID()+        public var displayTitle: String = ""+        public var lastParsedTitle: String?+        public var siteHostname: String = ""+        public var site: Site?+        public var urlIdentity: String?+        public var urlIdentityStateRaw: String = WorkURLIdentityState.none.rawValue+        public var urlIdentityRuleID: UUID?+        public var urlIdentityRuleVersion: Int?+        public var workURLString: String?+        public var genericNotes: String = ""+        public var typeRaw: String = WorkType.other.rawValue+        public var workTypeID: UUID?+        public var genreTags: [String] = []+        public var titleProvenanceRaw: String = TitleProvenance.manual.rawValue+        public var createdAt: Date = Date(timeIntervalSince1970: 0)+        public var modifiedAt: Date = Date(timeIntervalSince1970: 0)+        public var genericNotesExtractionFingerprint: String?+        @Relationship(deleteRule: .nullify, inverse: \Entry.work)+        public var entries: [Entry]?+        @Relationship(deleteRule: .nullify, inverse: \Character.work)+        public var characters: [Character]?+        @Relationship(deleteRule: .nullify, inverse: \CharacterSuppression.work)+        public var characterSuppressions: [CharacterSuppression]?+        @Relationship(deleteRule: .nullify, inverse: \WorkSiteMembership.work)+        public var siteMemberships: [WorkSiteMembership]? = []++        public init() {}+    }++    @Model+    public final class Site {+        public var hostname: String = ""+        public var displayName: String = ""+        public var modeRaw: String = SiteMode.untaught.rawValue+        @Relationship(deleteRule: .cascade, inverse: \TitlePattern.site)+        public var patterns: [TitlePattern]?+        @Relationship(deleteRule: .cascade, inverse: \URLRulePattern.site)+        public var urlRules: [URLRulePattern]?+        /// Inverse of `Entry.site`, present only because CloudKit requires every+        /// relationship to have one. Internal for the same reason the live class+        /// keeps it internal (Q17): traversing it faults every Entry for a+        /// hostname.+        @Relationship(deleteRule: .nullify, inverse: \Entry.site)+        var entries: [Entry]?+        /// Inverse of `Work.site`. Same reasoning as `entries`. **V9 drops both+        /// halves of this pair**, which is the one relationship change the+        /// V8 → V9 stage makes.+        @Relationship(deleteRule: .nullify, inverse: \Work.site)+        var works: [Work]?+        /// Inverse of `WorkSiteMembership.site`. Same reasoning again.+        @Relationship(deleteRule: .nullify, inverse: \WorkSiteMembership.site)+        var workMemberships: [WorkSiteMembership]?+        public var urlIdentityRule: URLIdentityRule?+        public var junkSuffixRule: JunkSuffixRule?++        public init() {}+    }++    @Model+    public final class TitlePattern {+        public var id: UUID = UUID()+        public var version: Int = 1+        public var isActive: Bool = false+        public var createdAt: Date = Date(timeIntervalSince1970: 0)+        public var formRaw: String = PatternForm.segment.rawValue+        public var segmentWorkAnchor: SegmentRangeSpec?+        public var segmentIgnoredAnchors: [SegmentPositionSpec]?+        public var phrasePrefix: String?+        public var phraseSeparator: String?+        public var phraseSuffix: String?+        public var fieldOrderRaw: String?+        public var trimPrefix: String?+        public var trimSuffix: String?+        public var chapterless: Bool = false+        public var definitionData: Data?+        public var site: Site?++        public init() {}+    }++    @Model+    public final class URLRulePattern {+        public var id: UUID = UUID()+        public var version: Int = 1+        public var isCurrent: Bool = false+        public var createdAt: Date = Date(timeIntervalSince1970: 0)+        public var originRaw: String = URLRuleOrigin.readerTaught.rawValue+        public var definitionData: Data = Data()+        public var site: Site?++        public init() {}+    }++    @Model+    public final class WorkTypeEntity {+        public var id: UUID = UUID()+        public var name: String = ""+        public var nameModifiedAt: Date = Date(timeIntervalSince1970: 0)+        public var stateRaw: String = WorkTypeState.active.rawValue+        public var stateModifiedAt: Date = Date(timeIntervalSince1970: 0)+        public var canonicalID: UUID?+        public var createdAt: Date = Date(timeIntervalSince1970: 0)+        public var modifiedAt: Date = Date(timeIntervalSince1970: 0)++        public init() {}+    }++    @Model+    public final class Character {+        public var id: UUID = UUID()+        public var name: String = ""+        public var nameKey: String = ""+        public var aliases: [String] = []+        public var note: String = ""+        public var factsData: Data?+        public var createdAt: Date = Date(timeIntervalSince1970: 0)+        public var modifiedAt: Date = Date(timeIntervalSince1970: 0)+        public var work: Work?++        public init() {}+    }++    @Model+    public final class CharacterSuppression {+        public var id: UUID = UUID()+        public var work: Work?+        public var kindRaw: String = CharacterSuppressionKind.candidate.rawValue+        public var nameKey: String = ""+        public var sourceKindRaw: String?+        public var sourceEntryID: UUID?+        public var evidence: String?+        public var statusRaw: String = CharacterSuppressionStatus.active.rawValue+        public var actionAt: Date = Date(timeIntervalSince1970: 0)++        public init() {}+    }++    @Model+    public final class WorkSiteMembership {+        public var id: UUID = UUID()+        public var hostname: String = ""+        public var createdAt: Date = Date(timeIntervalSince1970: 0)+        public var urlIdentity: String?+        public var urlIdentityStateRaw: String = WorkURLIdentityState.none.rawValue+        public var urlIdentityRuleID: UUID?+        public var workURLString: String?+        public var workID: UUID?+        public var work: Work?+        public var site: Site?++        public init() {}+    }++    @Model+    public final class WorkDistinctPair {+        public var id: UUID = UUID()+        public var lowerWorkID: UUID = UUID()+        public var higherWorkID: UUID = UUID()+        public var recordedAt: Date = Date(timeIntervalSince1970: 0)++        public init() {}     } }

diff --git a/Packages/AsterismCore/Sources/AsterismCore/AsterismSchemaV9.swift b/Packages/AsterismCore/Sources/AsterismCore/AsterismSchemaV9.swiftnew file mode 100644index 0000000..a733c74--- /dev/null+++ b/Packages/AsterismCore/Sources/AsterismCore/AsterismSchemaV9.swift@@ -0,0 +1,59 @@+import Foundation+import SwiftData++/// The runtime schema. Its body is `Models.swift`, which opens+/// `extension AsterismSchemaV9`.+///+/// V9 is V8 **minus** everything V8 superseded but could not drop. The+/// `WorkSiteMembership` row is a Work's site presence, the `Entry.citationsData`+/// blob is its citations and `TitlePattern.definitionData` is a pattern's+/// definition surface — so `Work`'s six site/identity/URL columns and its+/// `typeRaw`, `Entry.identityKeyVersion` and its seventeen citation columns,+/// `TitlePattern`'s ten definition columns and `Site.urlIdentityRule` are gone,+/// along with the `Work.site` ↔ `Site.works` inverse pair.+///+/// The drop is safe only because the population it undoes is finished: the+/// readiness marker read `"8"` on every device before this schema shipped, which+/// is `V8PopulationPass`'s completion certificate (decision_log.md Q2 of+/// `drop-superseded-columns`). The pass itself is deleted — it had nothing left+/// to convert from.+///+/// The entity *list* is unchanged: V9 adds no table and removes none.+public enum AsterismSchemaV9: VersionedSchema {+    public static let versionIdentifier = Schema.Version(9, 0, 0)++    public static var models: [any PersistentModel.Type] {+        [Entry.self, Work.self, Site.self, TitlePattern.self, URLRulePattern.self,+         WorkTypeEntity.self, Character.self, CharacterSuppression.self,+         WorkSiteMembership.self, WorkDistinctPair.self]+    }+}++/// The migration plan: `[V8, V9]`, one lightweight stage.+///+/// **Every stage below V8 is retired** (decision_log.md Q2 of+/// `drop-superseded-columns`). Every device is confirmed at marker `"8"`, which+/// is `retire-migration-chain` Decision 6's population precondition for each of+/// them, so `AsterismSchemaV5`, `AsterismSchemaV6` and `AsterismSchemaV7` went+/// with the stages that named them. A store older than V8 fails closed —+/// `NSCocoaErrorDomain` 134504, "Cannot use staged migration with an unknown+/// model version" — and the recovery is the backup archive, which is what+/// `V4RecordedStoreTests` pins.+///+/// The single stage is `.lightweight`. **This is the first stage that removes+/// anything**: 35 attributes and one inverse relationship pair. It runs inside+/// `ModelContainer.init`, which is why the columns had to be unwritten and every+/// reader moved onto the blob and the membership *before* this schema existed —+/// the conversion has no chance to read what it is about to destroy. `.custom`+/// is not an option: a custom stage would also run inside the share extension,+/// which must never migrate, and the extension is kept out by the marker instead+/// (Q3).+public enum AsterismV9MigrationPlan: SchemaMigrationPlan {+    public static var schemas: [any VersionedSchema.Type] {+        [AsterismSchemaV8.self, AsterismSchemaV9.self]+    }++    public static var stages: [MigrationStage] {+        [.lightweight(fromVersion: AsterismSchemaV8.self, toVersion: AsterismSchemaV9.self)]+    }+}

diff --git a/Packages/AsterismCore/Sources/AsterismCore/BackupArchiveProjection.swift b/Packages/AsterismCore/Sources/AsterismCore/BackupArchiveProjection.swiftindex dd1284e..16a5264 100644--- a/Packages/AsterismCore/Sources/AsterismCore/BackupArchiveProjection.swift+++ b/Packages/AsterismCore/Sources/AsterismCore/BackupArchiveProjection.swift@@ -192,15 +192,14 @@ extension LibraryRepository {     /// A Work's `typeRaw` is deliberately absent (Q8, Q34): V8 derives a type     /// from the work-type identity alone, so the column is not read at all.     ///-    /// The Entry's three provenance raws are here for the reason every other-    /// raw is, and Q53 does not reach them. Q53 retired the *validator's*-    /// guards, where `EntryCitations` types the kind and the arm a guard would-    /// have refused is unreachable. The export still reads the columns: an Entry-    /// whose `citationsData` is nil falls back to `LegacyColumns.citations`-    /// (Q36), which reads all three through `ToleratedEnum.read(default: .none)`-    /// — so an unrecognised spelling a newer build wrote would be archived as-    /// `.none`, silently, which is precisely the coercion Q8 refuses. The blob-    /// is checked beside them, by its bytes.+    /// The Entry's three provenance raws used to be checked here, because a row+    /// whose `citationsData` was nil fell back to the columns and read all three+    /// through `ToleratedEnum.read(default: .none)` — an unrecognised spelling a+    /// newer build wrote would have been archived as `.none`, silently, which is+    /// the coercion Q8 refuses. Since V9 the blob is the only home a citation+    /// has, so the check is the blob's: bytes that will not decode are named+    /// here, and a kind this build has no case for is one of them. That is+    /// stricter than the raw guards were, not looser.     private static func requireRepresentableValues(         entries: [Entry], works: [Work], memberships: [WorkSiteMembership], sites: [Site],         patterns: [TitlePattern], urlRules: [URLRulePattern], citations: EntryCitationsCache@@ -214,13 +213,6 @@ extension LibraryRepository {             if let raw = entry.ratingRaw {                 try require(Rating(rawValue: raw), record, "rating", raw)             }-            try require(FieldProvenanceKind(rawValue: entry.chapterTitleProvenanceRaw),-                record, "chapter provenance", entry.chapterTitleProvenanceRaw)-            try require(FieldProvenanceKind(rawValue: entry.workAssignmentProvenanceRaw),-                record, "work assignment provenance", entry.workAssignmentProvenanceRaw)-            if let raw = entry.workURLAssignmentKindRaw {-                try require(URLWorkAssignmentKind(rawValue: raw), record, "work URL assignment", raw)-            }             // The whole citation surface is one blob on the wire now (Q25), so a             // row whose blob will not decode is named here by its bytes rather             // than reached by a mapper that would throw a raw `DecodingError`.

diff --git a/Packages/AsterismCore/Sources/AsterismCore/DuplicateReconciler.swift b/Packages/AsterismCore/Sources/AsterismCore/DuplicateReconciler.swiftindex 6d44476..5dc0f5d 100644--- a/Packages/AsterismCore/Sources/AsterismCore/DuplicateReconciler.swift+++ b/Packages/AsterismCore/Sources/AsterismCore/DuplicateReconciler.swift@@ -782,10 +782,6 @@ enum DuplicateReconciler {                 removed += 1             }         }-        // The superseded columns mirror the primary membership (Decision 4), and-        // a moved membership can change which one that is.-        for row in survivor { LegacyColumns.refreshMembership(on: row) }-         for pair in distinctPairs where !pair.isDeleted {             let lower = loserIDs.contains(pair.lowerWorkID) ? target.id : pair.lowerWorkID             let higher = loserIDs.contains(pair.higherWorkID) ? target.id : pair.higherWorkID@@ -1239,6 +1235,8 @@ enum DuplicateReconciler {     /// variant and the set would not be here.     private static func apply(_ carrier: Entry, to rows: [Entry]) -> Bool {         var changed = false+        // One decode of the carrier's blob for the whole fan-out, not one per row.+        let carrierChapterIsManual = carrier.chapterTitleProvenance == .manual         for row in rows where row !== carrier {             if row.note != carrier.note {                 row.note = carrier.note@@ -1248,18 +1246,17 @@ enum DuplicateReconciler {                 row.rating = carrier.rating                 changed = true             }-            if carrier.chapterTitleProvenance == .manual {+            if carrierChapterIsManual {                 if row.chapterTitle != carrier.chapterTitle {                     row.chapterTitle = carrier.chapterTitle                     changed = true                 }-                if row.chapterTitleProvenance != .manual {-                    row.chapterTitleProvenance = .manual-                    // The one citation column this fan-out writes; the blob-                    // mirrors it at the write site (Decision 4).-                    LegacyColumns.refreshCitations(on: row)-                    changed = true-                }+                // The one citation this fan-out writes, in the blob that is now+                // its only home. `.manual` cites no rule, so the arm carries the+                // kind alone. `editCitations` is value-guarded and reports+                // whether it wrote, so a row already `.manual` needs no separate+                // read to leave it alone.+                if row.editCitations({ $0.chapterTitle = .manual }) { changed = true }             }             // Only ever set: a row holding the flag while the carrier does not             // would be a second variant. `work` goes with it, because a row@@ -1317,19 +1314,12 @@ enum DuplicateReconciler {             // the single-site assumption this feature removes. A hostname the             // row is not on is skipped: propagation carries authored content             // across a torn group, it does not mint site presence.-            var movedWorkURL = false             for carried in carrier.membershipValues {                 guard let url = carried.workURLString,                     let target = row.membership(for: carried.hostname),                     target.workURLString != url                 else { continue }                 target.workURLString = url-                movedWorkURL = true-            }-            if movedWorkURL {-                // The six superseded columns mirror the primary membership-                // (Decision 4), and one of the writes above may have been it.-                LegacyColumns.refreshMembership(on: row)                 changed = true             }             // The carrier's own ordering, not the normalised one the comparison

diff --git a/Packages/AsterismCore/Sources/AsterismCore/EntryCitations.swift b/Packages/AsterismCore/Sources/AsterismCore/EntryCitations.swiftindex ea1e93c..7d64d9e 100644--- a/Packages/AsterismCore/Sources/AsterismCore/EntryCitations.swift+++ b/Packages/AsterismCore/Sources/AsterismCore/EntryCitations.swift@@ -141,6 +141,18 @@ public struct EntryCitations: Codable, Equatable, Sendable {         self.workURLAssignmentKind = workURLAssignmentKind     } +    /// The encoded default value, encoded once.+    ///+    /// `Entry.init` seeds every new row with it (Q13), and it needs a `Data`,+    /// not a `Data?`: a `try?` there spells an encode failure exactly as it+    /// spells the V8-residue sentinel a nil blob means (Q6), so one would read+    /// as the other for the row's whole life. The `try!` is not a judgement+    /// call — `EntryCitations()` is a fixed value of `Codable` scalars and+    /// enums with no runtime input, so its encoding cannot vary, and+    /// `EntryCitationsTests.defaultBlobDecodes` decodes this constant back so a+    /// change that broke it fails the suite instead of the initializer.+    static let defaultBlob: Data = try! JSONBlob.encode(EntryCitations())+     /// Every citation this Entry holds, in the fixed order and under the labels     /// the retired key-path table used.     ///@@ -261,6 +273,11 @@ extension FieldProvenance {     /// blob mean.     public static let absent = try! FieldProvenance(kind: .none) +    /// The reader's own value, citing no rule. Spelt once here because a+    /// `.manual` provenance is the commonest thing a citation writer sets and+    /// `FieldProvenance`'s initializer throws.+    public static let manual = try! FieldProvenance(kind: .manual)+     /// A provenance built from a stored `(kind, patternID, patternVersion)`     /// triple that may not be legal.     ///

diff --git a/Packages/AsterismCore/Sources/AsterismCore/GroupOrdering.swift b/Packages/AsterismCore/Sources/AsterismCore/GroupOrdering.swiftindex 978b34e..7bf00b1 100644--- a/Packages/AsterismCore/Sources/AsterismCore/GroupOrdering.swift+++ b/Packages/AsterismCore/Sources/AsterismCore/GroupOrdering.swift@@ -476,11 +476,13 @@ public enum GroupOrdering {         // known: the cost is that a derived unattachment counts as authored,         // which can classify a group as non-bare and send it to the reader —         // the safe direction.-        EntryAuthoredContent(+        // One decode of the blob, not two: both provenances come out of it.+        let citations = entry.citationValues+        return EntryAuthoredContent(             note: entry.note,             rating: entry.rating,-            workAssignment: entry.workAssignmentProvenance == .manual ? entry.work?.id : nil,-            chapterTitle: entry.chapterTitleProvenance == .manual ? entry.chapterTitle : nil,+            workAssignment: citations.workAssignment == .manual ? entry.work?.id : nil,+            chapterTitle: citations.chapterTitle.kind == .manual ? entry.chapterTitle : nil,             intentionallyUnattached: entry.intentionallyUnattached)     } @@ -491,21 +493,39 @@ public enum GroupOrdering {     public static func authoredContent(         of work: Work, types: WorkTypeDirectory     ) -> WorkAuthoredContent {-        // Q34: `titleProvenance` defaults to `.manual`, so provenance alone-        // would make every Work non-bare and render silent Work resolution-        // inert. The title is authored only when it is *also* something other-        // than what parsing last produced.-        // Q59: the confirmed Work URL is a *membership* field now, and the-        // column is its mirror of the primary one. Authored content stays on the-        // column deliberately — it is the value V7 compared and a row ordering-        // must not move under a second site's URL — so it is read through the-        // one sanctioned door rather than off the row.+        authoredContent(+            of: work, primary: work.primaryMembership,+            typeAssignment: types.canonicalized(WorkTypeAssignment.assignment(of: work)))+    }++    /// The body both readers share, over a primary membership the caller has+    /// already faulted.+    ///+    /// Q59: the confirmed Work URL is a *membership* field, read from the+    /// **primary** membership — the first in membership order. It used to be+    /// read from the column that mirrored exactly that row, and reads from the+    /// row itself since V9 dropped the mirror; the answer is the same one, so a+    /// row ordering still does not move under a second site's URL.+    ///+    /// The membership arrives as a parameter rather than being read here so+    /// that `representativeComponents`, which wants the same row for its+    /// hostname component, pays for one read per Work rather than two.+    ///+    /// Q34: `titleProvenance` defaults to `.manual`, so provenance alone would+    /// make every Work non-bare and render silent Work resolution inert. The+    /// title is authored only when it is *also* something other than what+    /// parsing last produced.+    private static func authoredContent(+        of work: Work,+        primary: WorkSiteMembership?,+        typeAssignment: WorkTypeAssignment+    ) -> WorkAuthoredContent {         WorkAuthoredContent(             genericNotes: work.genericNotes,             manualTitle: manualTitle(of: work),-            workURLString: LegacyColumns.membership(from: work).workURLString,+            workURLString: primary?.workURLString,             genreTags: work.genreTags,-            typeAssignment: types.canonicalized(WorkTypeAssignment.assignment(of: work)))+            typeAssignment: typeAssignment)     }      // MARK: Canonical definition serialisations (Q63)@@ -517,21 +537,21 @@ public enum GroupOrdering {     /// The trims are part of it deliberately: a canonical form built from the     /// arm alone would call two rows that derive different chapter titles     /// converged (Q63). Undecodable bytes fall back to their own base64, which is-    /// deterministic and cannot collide with a decodable definition's encoding;-    /// a row that has not been through `V8PopulationPass` reads through the-    /// legacy columns first, so a mid-migration store still orders.+    /// deterministic and cannot collide with a decodable definition's encoding,+    /// and a row with no blob at all takes the constant key below (Q11) — so+    /// every row orders, whatever its blob holds.     public static func canonicalDefinition(_ pattern: TitlePattern) -> String {         if let text = canonicalJSON(try? pattern.storedDefinition) { return text }         // Bytes that will not decode: their own base64, which is deterministic         // and cannot collide with a decodable definition's encoding.         if let data = pattern.definitionData { return "raw:" + data.base64EncodedString() }-        // **No blob at all**, and the ten columns do not form a legal arm-        // (Q42) — the only remaining way `storedDefinition` throws. A constant-        // here gave every such row one ordering key, so two rows broken in two-        // different ways compared *converged*: the validator stopped reporting-        // the group and the reconciler read it as needing nothing. The columns-        // are what the row actually holds, so they are what orders it.-        return "columns:" + LegacyColumns.canonicalColumns(of: pattern)+        // **No blob at all** (Q11). The `columns:` key that stood here told two+        // broken rows apart by what their ten definition columns held; with the+        // columns unwritten, two nil-blob rows hold the same nothing and one key+        // is the truthful order. The prefix stays distinct from the `raw:`+        // family above so a nil row and an undecodable row never compare+        // converged.+        return "no-definition:"     }      /// The URL rule's definition decoded and re-encoded with sorted keys, so two@@ -666,13 +686,21 @@ public enum GroupOrdering {     /// contribute to a row ordering, and demanding it here would put a type     /// fetch behind `sortedWorkRows`, which every write path calls.     private static func representativeComponents(_ work: Work) -> [OrderComponent] {-        let legacy = LegacyColumns.membership(from: work)-        return [.string(legacy.hostname), .date(work.createdAt)]-            + WorkAuthoredContent(-                genericNotes: work.genericNotes,-                manualTitle: manualTitle(of: work),-                workURLString: legacy.workURLString,-                genreTags: work.genreTags,+        // The primary membership, read **once** and used for both the hostname+        // component and the authored content, since V9 dropped the columns that+        // mirrored it.+        //+        // A Work with no membership at all — a lagging writer's row, healed on+        // the next reconcile — orders under the empty hostname. That is *not*+        // where the column put it: Q17 keeps `Work.init` writing `siteHostname`,+        // so such a row's column held its capture-time hostname and this key+        // genuinely moves for it. Nothing reads the key across the upgrade —+        // it is derived per call, never stored — so what moves is the order of+        // one membership-less row against its group, which the heal repairs.+        let primary = work.primaryMembership+        return [.string(primary?.hostname ?? ""), .date(work.createdAt)]+            + authoredContent(+                of: work, primary: primary,                 typeAssignment: WorkTypeAssignment.assignment(of: work)             ).orderComponents             + [.date(work.modifiedAt)]

diff --git a/Packages/AsterismCore/Sources/AsterismCore/LibraryDiagnostics.swift b/Packages/AsterismCore/Sources/AsterismCore/LibraryDiagnostics.swiftindex 6067fb8..53f5087 100644--- a/Packages/AsterismCore/Sources/AsterismCore/LibraryDiagnostics.swift+++ b/Packages/AsterismCore/Sources/AsterismCore/LibraryDiagnostics.swift@@ -342,23 +342,27 @@ public enum LibraryToleranceScan {         /// hydration's final batch).         public let workTypeCollisionCount: Int -        /// The three V8 conversion counters, and the arrival-tier gate for-        /// `V8PopulationPass` and `MembershipReconciler.heal` (Decision 5).+        /// The three upgrade-residue counters, and the gate for+        /// `MembershipReconciler.heal` (Q10, Q20).         ///         /// Same bargain as `duplicateCandidateCount`: this walk already reads         /// every Work, Entry and TitlePattern row and already indexes the         /// memberships by `workID`, so the counts cost a scalar read per row and         /// no extra traversal. Zero is the answer that matters — a converged-        /// library gives it, and it means the whole-library conversion passes-        /// have nothing to do on this arrival.+        /// library gives it, and it means the heal has nothing to do on this+        /// arrival, on either tier.         ///         /// **A count of rows, not of logical records.** Two rows of one split         /// Work each missing a membership count twice; the gate only asks         /// whether the number is zero.         public let worksWithoutMembershipCount: Int-        /// Entries whose `citationsData` is nil — a row a lagging V7 writer-        /// synced in (Req 2.7, Q36), reading its citations through-        /// `LegacyColumns` until the pass converts it.+        /// Entries whose `citationsData` is nil — a row a V8 build wrote that+        /// the V9 drop stage reached before anything converted it. **No pass+        /// converts it**: the columns it would have been derived from are gone,+        /// so the row reads as the default (Q6), is reported rather than+        /// quarantined (Q25, Q32), and converges only when a writer has+        /// something real to write (Q23). This count is how the reader is told+        /// how many rows lost their provenance at the upgrade.         public let entriesWithoutCitationBlobCount: Int         /// TitlePatterns whose `definitionData` is nil, on the same terms.         public let patternsWithoutDefinitionBlobCount: Int@@ -458,7 +462,7 @@ public enum LibraryToleranceScan {         try context.enumerate(FetchDescriptor<Entry>(), batchSize: batchSize) { entry in             entriesByHostname[entry.hostname, default: 0] += 1             entryIdentities.record(entry.id)-            if entry.citationsData == nil { entriesWithoutCitationBlob += 1 }+            if entry.citationsAreAbsent { entriesWithoutCitationBlob += 1 }             if let key = DuplicateScan.entryBucketKey(                 hostname: entry.hostname, conservativeIdentityKey: entry.conservativeIdentityKey) {                 entryDuplicateKeys[key, default: 0] += 1

diff --git a/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+Articles.swift b/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+Articles.swiftindex 8748860..5beb6f5 100644--- a/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+Articles.swift+++ b/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+Articles.swift@@ -114,42 +114,36 @@ extension LibraryRepository {                 for entry in group.rows {                     if !projection.chapterProtected {                         entry.chapterTitle = nil-                        entry.chapterTitleProvenanceRaw = FieldProvenanceKind.none.rawValue-                        entry.chapterPatternID = nil-                        entry.chapterPatternVersion = nil                     }                     if !projection.assignmentProtected {                         entry.work = nil-                        entry.workAssignmentProvenanceRaw = FieldProvenanceKind.none.rawValue-                        entry.workPatternID = nil-                        entry.workPatternVersion = nil                         entry.intentionallyUnattached = true                     }                      // Restore conservative keys, clear URL-derived sequence and assignment                     // provenance (Req 8.11: articles clears URL-derived fields)                     entry.identityBasisRaw = EntryIdentityBasis.conservative.rawValue-                    entry.identityURLRuleID = nil-                    entry.identityURLRuleVersion = nil                     entry.urlWorkIdentity = nil-                    entry.urlWorkRuleID = nil-                    entry.urlWorkRuleVersion = nil                     entry.chapterSequence = nil-                    entry.chapterSequenceRuleID = nil-                    entry.chapterSequenceRuleVersion = nil-                    entry.workURLRuleID = nil-                    entry.workURLRuleVersion = nil-                    entry.workURLAssignmentKindRaw = nil                     // Restore conservative identity key (raw URL is already validated)                     if let conservativeKey = try? EntryIdentityNormalizer.key(forRawURL: entry.rawURLString) {                         entry.entryIdentityKey = conservativeKey-                        entry.identityKeyVersion = 1                     } -                    // Decision 4: the blob mirrors the columns this sweep just-                    // cleared, refreshed here so the commit's validation and the-                    // next reader see one answer.-                    LegacyColumns.refreshCitations(on: entry)+                    // Every field this sweep cleared is a citation, so it clears+                    // them where they live (V9): the identity falls back to the+                    // raw URL, both URL-derived evidence citations go, and the+                    // chapter and assignment arms go with the values above+                    // unless the projection protected them.+                    entry.editCitations { citations in+                        if !projection.chapterProtected { citations.chapterTitle = .absent }+                        if !projection.assignmentProtected { citations.workAssignment = .none }+                        citations.identity = .rawURL+                        citations.urlWork = nil+                        citations.chapterSequence = nil+                        citations.workURL = nil+                        citations.workURLAssignmentKind = nil+                    }                     entry.modifiedAt = timestamp                 }             }

diff --git a/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+BackupImport.swift b/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+BackupImport.swiftindex 6624767..984cbb7 100644--- a/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+BackupImport.swift+++ b/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+BackupImport.swift@@ -89,10 +89,6 @@ extension LibraryRepository {                     work: record.workID.flatMap { worksByID[$0] },                     site: sitesByHostname[record.hostname]))         }-        // The superseded Work columns mirror the primary membership, as they do-        // at every other write site (Decision 4, Q60) — until V9 (T-2272).-        for work in worksByID.values { LegacyColumns.refreshMembership(on: work) }-         // Pairs are UUID-only rows (Q27), so they import verbatim whether or not         // the Works they name are here (Req 5.7, 8.3).         for record in payload.distinctPairs {

diff --git a/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+BackupImportGates.swift b/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+BackupImportGates.swiftindex 5df2353..d4da7f5 100644--- a/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+BackupImportGates.swift+++ b/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+BackupImportGates.swift@@ -22,11 +22,16 @@ extension LibraryRepository {     static func validateImportPlanPayload(         _ payload: BackupImportPayload     ) throws -> LibraryRecordCounts {-        // The live schema. It is now the only one declared (Req 3.1), but the-        // pinning is deliberate rather than incidental: the materializer inserts-        // live classes, so validating against any snapshot schema would validate-        // against different entities (Q20).-        let schema = Schema(versionedSchema: AsterismSchemaV8.self)+        // **The live schema, and it has to be.** The materializer inserts live+        // classes, so validating against a snapshot schema would validate+        // against different entities (Q20) — and worse, a scratch container+        // built over a frozen snapshot wins SwiftData's name-keyed entity+        // registry for the rest of the process+        // (`docs/agent-notes/schema-migration.md`). While the snapshot only+        // *added* columns that showed up as saves silently dropping them; now+        // that V9 **removes**, it aborts the process instead, with+        // `NSUnknownKeyException` on a column the live entity no longer has.+        let schema = Schema(versionedSchema: AsterismSchemaV9.self)         let configuration = ModelConfiguration(             schema: schema,             isStoredInMemoryOnly: true,

diff --git a/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+Bootstrap.swift b/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+Bootstrap.swiftindex b153094..b9c3173 100644--- a/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+Bootstrap.swift+++ b/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+Bootstrap.swift@@ -4,33 +4,37 @@ import SwiftData  /// Runtime opening of the live library, classified then acted on. ///-/// Every store the app can reach is recorded at V5 or above, and the conversions-/// left are the `.lightweight` V5 → V6 → V7 → V8 stages `ModelContainer.init`-/// runs: the sidecar, the V3 reader and the completion pass are retired-/// (Decision 1). What survives is the readiness contract. The app validates with+/// Every store the app can reach is recorded at V8 or above, and the one+/// conversion left is the `.lightweight` V8 → V9 stage `ModelContainer.init`+/// runs: the sidecar, the V3 reader, the completion pass and every stage below+/// V8 are retired (Decision 1; Q2 of `drop-superseded-columns`). What survives+/// is the readiness contract. The app validates with /// `LibraryValidator` and clears residual evidence; the marker it publishes-/// contains `"8"` (`extensionOpenableMarkerVersion`), the only version the+/// contains `"9"` (`extensionOpenableMarkerVersion`), the only version the /// extension opens (Q14). /// /// An *empty* store is marked ready as soon as it exists, so the app either opens /// a ready library or throws — there is no third state for the reader to resolve.-/// It is marked at `"8"` directly: there is nothing in it to bring forward (Q26).+/// It is marked at `"9"` directly: there is nothing in it to bring forward (Q26). ///-/// **There is one lagging generation: `"7"`.** `data-model-cleanups` Decision 2-/// had deleted the last of them — `"4"`, `"5"` and `"6"` — on the argument that-/// the population is one user whose every device carried `"7"`.-/// `multi-site-works` publishes `"8"`, so `"7"` is back as the lagging digit: a-/// device that has not launched this build yet is on it, and the `.markerLagging`-/// arm is the upgrade path. That arm converts the store, runs `V8PopulationPass`-/// to fill the new site-membership rows, runs `MembershipReconciler` over what-/// another device may already have written, certifies the pass with-/// `assertComplete`, and only then publishes `"8"`.+/// **There is one lagging generation: `"8"`.** V9 drops the columns V8+/// superseded, and the whole of that is the lightweight stage `ModelContainer`+/// runs — so the `.markerLagging` arm opens, validates, and publishes `"9"`,+/// with no data pass and no reconciler (Q9). The digit exists even though the+/// stage needs no help from it, because it is what keeps the *extension* out of+/// a conversion that destroys the source (Q3): `openContainer` passes the+/// migration plan for both roles, and only the marker check stops a concurrent+/// share-sheet invocation from running the drop.+///+/// `"7"` is **gone** rather than kept beside `"8"`: every device is confirmed at+/// `"8"` (Q2), and the substitution the schema-migration note allows only after+/// re-verifying the population is what that confirmation buys. /// /// A store found on any other digit is refused, naming it, and the recovery is /// the backup archive, exactly as for a store recorded below V5. The two roles /// differ in what they accept and in what they may do about it: the app opens-/// `"7"` and `"8"` (`appOpenableMarkerVersions`) and may create, convert and mark-/// a store; the extension opens `"8"` only and writes nothing.+/// `"8"` and `"9"` (`appOpenableMarkerVersions`) and may create, convert and mark+/// a store; the extension opens `"9"` only and writes nothing. public extension LibraryRepository {     /// The result of evaluating the live library's fixed-path state under an     /// exclusive lease.@@ -38,7 +42,7 @@ public extension LibraryRepository {         case ready(LibraryRecordCounts)     } -    /// Extension-only readiness result. The extension opens only an `"8"` marker.+    /// Extension-only readiness result. The extension opens only a `"9"` marker.     enum ExtensionResult: Equatable, Sendable {         case ready(LibraryRecordCounts)     }@@ -102,8 +106,7 @@ public extension LibraryRepository {             mode: .exclusive, at: configuration.lockURL, timeout: bootstrapLockTimeout)         defer { withExtendedLifetime(lease) {} } -        let certification = try certifyForApp(-            configuration, hooks: hooks, saveStrategy: saveStrategy)+        let certification = try certifyForApp(configuration, hooks: hooks)         // The certification container died with that call's frame. Nothing here         // holds a reference to it, which is what makes the construction below         // the only live container over this store.@@ -123,14 +126,13 @@ public extension LibraryRepository {     /// reference to a second container over the store) into the caller's frame.     internal static func certifyForApp(         _ configuration: LibraryConfiguration,-        hooks: MirroringOpenHooks,-        saveStrategy: any RepositorySaveStrategy = ModelContextSaveStrategy()+        hooks: MirroringOpenHooks     ) throws -> Certification {         let state = try classify(configuration, fileManager: .default)         hooks.bootstrapEventObserver?(.classified(state))         bootstrapLogger.debug("Bootstrap state: \(String(describing: state), privacy: .public)") -        return try act(on: state, configuration, hooks: hooks, saveStrategy: saveStrategy)+        return try act(on: state, configuration, hooks: hooks)     }      /// The only code that writes. One case per `BootstrapState`, so the compiler@@ -148,15 +150,16 @@ public extension LibraryRepository {     ///   store file's prior absence (Req 2.4). `.sqlite` can be gone while a     ///   `-wal` holding rows is not, so "we just created it" is not evidence of     ///   anything.-    /// `saveStrategy` is the repository's own, threaded through so the one-    /// acting arm that writes *rows* — the population pass — commits through the-    /// same seam every other bulk pass does, and a test can inject a refusing-    /// one to prove the marker stays put (Req 2.4).+    ///+    /// **No acting arm writes rows any more**, so no save strategy is threaded+    /// in: the one that did was the `"7"` arm's population pass, and V9 deletes+    /// it along with the columns it filled. What the arms write is the readiness+    /// marker, `publishReadiness` writes that, and the empty store `.pristine`+    /// creates saves through its own context.     internal static func act(         on state: BootstrapState,         _ configuration: LibraryConfiguration,-        hooks: MirroringOpenHooks,-        saveStrategy: any RepositorySaveStrategy = ModelContextSaveStrategy()+        hooks: MirroringOpenHooks     ) throws -> Certification {         switch state {         case .belowV5(let version):@@ -168,7 +171,7 @@ public extension LibraryRepository {                     + "version this build opens; restore from a backup archive")          case .ready:-            // open (which converts, V5 → V6 → V7) → validate → clear residual+            // open (nothing to convert at `"9"`) → validate → clear residual             // evidence → counts. The marker already records the current             // generation, so nothing is published: this is the only certification             // sequence left, and it writes no marker at all.@@ -181,37 +184,34 @@ public extension LibraryRepository {             return Certification(result: .ready(counts), diagnostics: diagnostics)          case .markerLagging(let generation):-            // open (which converts V7 → V8) → population pass → membership-            // reconcile → assertComplete → publish `"8"` → validate.+            // open (which drops the superseded columns) → validate → publish+            // `"9"`.             //-            // **The marker goes after the work it certifies** (Q36), as every-            // other acting arm does: a throw anywhere above leaves `"7"` on-            // disk, fails the open, and the next open re-enters this arm — which-            // is safe because every phase of the pass is idempotent by an-            // existence guard (Req 2.4).+            // **No data pass and no reconciler** (Q9). The `"7"` arm ran+            // `V8PopulationPass` and `MembershipReconciler` because V8 *added*+            // tables and blobs that something had to fill; V9 only takes columns+            // away, and the lightweight stage does the whole of it inside+            // `ModelContainer.init`. The launch reconcile runs moments later on+            // the same store for anything else.             //-            // **The pass certifies itself** (Q35). `assertComplete` is the gate,-            // not the validator: every state the pass repairs is one the-            // validator tolerates, so a validator run over an unconverted-            // library comes back clean and would certify nothing.+            // **Validation is the gate, and the marker goes after it.**+            // There is no pass to certify itself with, so what certifies the+            // conversion is the store validating: a throw here leaves `"8"` on+            // disk, fails the open, and the next open re-enters this arm over a+            // store the stage has already converted — which is safe, because+            // dropping columns that are already gone is a no-op.             //-            // **Validation runs after the marker**, and opens with diagnoses-            // rather than refusing, exactly as the `.ready` arm does — a library-            // that opened on V7 must open on V8.+            // The residual evidence goes **last**, after the publish rather than+            // with the validation: a publish that fails on a full disk leaves+            // the library at `"8"` with its historical marker and sidecar still+            // beside it, which is the state the next open wants to find.             let container = try openCertificationContainer(configuration, hooks: hooks)             let context = ModelContext(container)             bootstrapLogger.debug(-                "Marker generation \(generation, privacy: .public) is lagging; running the V8 population pass")-            try V8PopulationPass.run(context: context, saveStrategy: saveStrategy)-            // Between the pass and its certification: a library that arrived-            // carrying duplicate or orphaned membership rows — the other device-            // having migrated first (Req 2.6) — is resolved before the marker-            // moves. The pass alone is what `assertComplete` certifies.-            _ = try MembershipReconciler.run(context: context, saveStrategy: saveStrategy)-            try V8PopulationPass.assertComplete(context: context)+                "Marker generation \(generation, privacy: .public) is lagging; certifying the V9 conversion")+            let diagnostics = try validateStore(context: context)             try publishReadiness(at: configuration.readinessMarkerURL)-            let diagnostics = try validateAndClearResidualEvidence(-                configuration, context: context)+            clearResidualEvidence(configuration)             let counts = try rowCounts(context: context)             hooks.certificationContainerObserver?(container)             return Certification(result: .ready(counts), diagnostics: diagnostics)@@ -227,7 +227,7 @@ public extension LibraryRepository {                 reason: kind.orphanedReason)          case .unmarkedStore:-            // open → counts → refuse if nonempty → publish `"8"`.+            // open → counts → refuse if nonempty → publish `"9"`.             //             // An *empty* unmarked store is the state a crash between store             // creation and the marker leaves, or a `publishReadiness` that@@ -254,12 +254,12 @@ public extension LibraryRepository {             return Certification(result: .ready(counts), diagnostics: .empty)          case .pristine:-            // open (which creates) → save → counts → publish `"8"`.+            // open (which creates) → save → counts → publish `"9"`.             //-            // Certified at `"8"`, the current generation: an empty store has-            // nothing for the population pass to bring forward, so it is born-            // in the state a certified library is in (Q26) rather than at the-            // lagging digit with a pass ahead of it.+            // Certified at `"9"`, the current generation: a store created by+            // these classes is already V9-shaped, so it is born in the state a+            // certified library is in (Q26) rather than at the lagging digit+            // with a conversion ahead of it.             let container = try openCertificationContainer(configuration, hooks: hooks)             let context = ModelContext(container)             do { try context.save() } catch {@@ -385,16 +385,18 @@ extension LibraryRepository {         var quarantined: [String: LibraryValidationError] { diagnostics.quarantineMap() }     } -    /// Opens the fixed-path store with the live V8 schema and-    /// `AsterismV8MigrationPlan`, which declares `[V5, V6, V7, V8]` and three-    /// lightweight stages: this call is where an installed V5, V6 or V7 library-    /// is converted, and the only place it happens.+    /// Opens the fixed-path store with the live V9 schema and+    /// `AsterismV9MigrationPlan`, which declares `[V8, V9]` and one lightweight+    /// stage: this call is where an installed V8 library is converted, and the+    /// only place it happens.     ///-    /// The V7 → V8 stage only adds (Decision 3). The rows and blobs the new-    /// tables and columns need are filled afterwards by `V8PopulationPass`,-    /// under the marker-lagging arm of `act(on:)`.+    /// **The V8 → V9 stage removes** — 35 attributes and the `Work.site` ↔+    /// `Site.works` inverse pair — which is why nothing may read any of them by+    /// the time this runs. It needs no data pass afterwards: the rows and blobs+    /// it leaves behind were filled by `V8PopulationPass` under the V8 build,+    /// and every device is confirmed past that marker (Q2).     ///-    /// A store recorded below V5 has no stage and is refused here — `classify`+    /// A store recorded below V8 has no stage and is refused here — `classify`     /// already refuses one before any container is constructed (Req 2.9,     /// Decision 1 of `retire-migration-chain`), so the refusal is a second     /// closed door rather than a new one.@@ -409,12 +411,12 @@ extension LibraryRepository {         at storeURL: URL,         mirroring cloudKitDatabase: ModelConfiguration.CloudKitDatabase = .none     ) throws -> ModelContainer {-        let schema = Schema(versionedSchema: AsterismSchemaV8.self)+        let schema = Schema(versionedSchema: AsterismSchemaV9.self)         let storeConfiguration = ModelConfiguration(             // **Frozen persisted state (Req 3.5).** This names the store             // configuration *inside* the container, not the file — `url:` below is-            // the locator. It is frozen anyway (Q13): the store it labels holds V8,-            // so the name is five versions behind, and renaming it buys nothing on+            // the locator. It is frozen anyway (Q13): the store it labels holds V9,+            // so the name is six versions behind, and renaming it buys nothing on             // a path that opens the owner's only library.             "AsterismV3",             schema: schema,@@ -423,7 +425,7 @@ extension LibraryRepository {         )         return try ModelContainer(             for: schema,-            migrationPlan: AsterismV8MigrationPlan.self,+            migrationPlan: AsterismV9MigrationPlan.self,             configurations: [storeConfiguration]         )     }@@ -490,19 +492,35 @@ extension LibraryRepository {     /// The cleanup goes after the validation for the reason Q36 gives about the     /// marker: the historical marker and the migration artefact are the recovery     /// evidence for the state this call is leaving, so they are removed only once-    /// the library they belong to has been established as openable. Both are-    /// absent on most calls, which `try?` covers along with a removal that fails.+    /// the library they belong to has been established as openable.+    ///+    /// This composed form is for `.ready`, which publishes nothing. The+    /// `.markerLagging` arm calls the two halves separately, so the evidence+    /// outlives a failed publish.     static func validateAndClearResidualEvidence(         _ configuration: LibraryConfiguration,         context: ModelContext     ) throws -> LibraryDiagnostics {         let diagnostics = try validateStore(context: context)+        clearResidualEvidence(configuration)+        return diagnostics+    }++    /// Removes the recovery evidence the current marker supersedes. Both files+    /// are absent on most calls, which `try?` covers along with a removal that+    /// fails.+    ///+    /// **The caller decides when.** On an arm that publishes a marker this has+    /// to run *after* the publish: a validated store whose `publishReadiness`+    /// then fails on a full disk is still at the old digit, and taking its+    /// historical marker and sidecar away first would leave the next open with+    /// the lagging state and none of the evidence for it.+    static func clearResidualEvidence(_ configuration: LibraryConfiguration) {         try? FileManager.default.removeItem(at: configuration.historicalMarkerURL)         try? FileManager.default.removeItem(at: configuration.migrationSidecarURL)-        return diagnostics     } -    /// Store-level validation on the open path — over V5, the only schema this+    /// Store-level validation on the open path — over V9, the only schema this     /// package declares. States outside Req 1.1 still     /// fail closed; the three tolerated states and every illegal Site tuple come     /// back as diagnoses, so the library opens and quarantines what it must@@ -517,21 +535,6 @@ extension LibraryRepository {         }     } -    /// Store-level validation for the backup import gates, which refuse anything-    /// the open paths now tolerate: an imported library must be wholly legal-    /// (Decision 3). Separate from `validateStore` so the boundary holds by-    /// construction rather than by each gate remembering to ask for it.-    static func validateStoreStrictly(-        context: ModelContext-    ) throws -> [String: LibraryValidationError] {-        do {-            return try LibraryValidator.validateStrict(context: context)-        } catch {-            throw LibraryRepositoryError.libraryUnavailable(-                operation: "validating the store", reason: String(describing: error))-        }-    }-     /// Marker generations the app opens: the current one and its predecessor.     ///     /// **This is the live acceptance test**, not a description of one: the@@ -541,19 +544,25 @@ extension LibraryRepository {     ///     /// `data-model-cleanups` Decision 2 had reduced this to one digit, on the     /// argument that the population was one user whose every device carried-    /// `"7"`. `multi-site-works` publishes `"8"`, so `"7"` is **added back**-    /// rather than substituted: a device that has not launched the new build yet-    /// is on `"7"`, and this set is what keeps it openable-    /// (`docs/agent-notes/schema-migration.md`). Retiring it again is the same-    /// argument, made again about the population as it is then.+    /// `"7"`. `multi-site-works` added `"7"` back beside `"8"`, and+    /// `drop-superseded-columns` **substitutes** rather than adding: `"7"` goes+    /// and `"8"` takes its place, because every device is confirmed at `"8"`+    /// (Q2) and a lagging arm no device can reach is a path nothing tests. That+    /// substitution is what `docs/agent-notes/schema-migration.md` allows only+    /// after re-verifying the population, which Q2 records.     static let appOpenableMarkerVersions: Set<String> = [-        "7", extensionOpenableMarkerVersion,+        laggingOpenableMarkerVersion, extensionOpenableMarkerVersion,     ] +    /// The one lagging generation the app still opens: a library certified by a+    /// V8 build, which `.markerLagging` converts and re-marks. Frozen persisted+    /// state, like its successor below.+    static let laggingOpenableMarkerVersion = "8"+     /// The only version the **extension** opens, and the one `publishReadiness`     /// writes (Q14). Frozen persisted state — these are the bytes on disk in an     /// installed library (Req 3.5).-    static let extensionOpenableMarkerVersion = "8"+    static let extensionOpenableMarkerVersion = "9"      // The app-side counterpart of `validateMarkerContentForExtension` stood     // here. It restated the acceptance test the classifier performs, and@@ -579,11 +588,13 @@ extension LibraryRepository {     /// the fork back the moment it opened two. `multi-site-works` is that     /// moment.     ///-    /// * A generation the app *does* open — `"7"`, the update window: the app is+    /// * A generation the app *does* open — `"8"`, the update window: the app is     ///   updated and not yet launched, the library still records the previous-    ///   digit, and opening the app runs the population pass. The message says+    ///   digit, and opening the app completes the conversion. The message says     ///   so, and `configurable-work-types` Req 8.7 requires the capture to fail-    ///   safely rather than convert a store under a shared lock.+    ///   safely rather than convert a store under a shared lock — which matters+    ///   more at V9 than it did at V8, because the conversion *drops* columns+    ///   and a concurrent extension open mid-drop would be destructive (Q3).     /// * Anything else — a retired or unknown digit: nothing the reader can do     ///   from here, and the recovery is the backup archive. The wording is the     ///   extension's own — "the containing app has not initialized the current

diff --git a/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+BootstrapState.swift b/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+BootstrapState.swiftindex e90949a..ec482e7 100644--- a/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+BootstrapState.swift+++ b/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+BootstrapState.swift@@ -12,18 +12,31 @@ import Foundation /// * every outcome is assertable from a seeded temp directory, without provoking ///   an error and without opening the library the assertion is about. enum BootstrapState: Equatable, Sendable {-    /// The store positively identifies itself as recorded below V5. Refused-    /// (Req 2.9, Decision 1): the migration that would raise it is gone, and the-    /// recovery is the backup archive.+    /// A store below the plan's floor, refused (Req 2.9, Decision 1): the+    /// migration that would raise it is gone, and the recovery is the backup+    /// archive.+    ///+    /// **The floor is V8, not V5** — the plan is `[V8, V9]` — so V5, V6 and V7+    /// stores are equally beyond raising. The name is inherited from when V5+    /// *was* the floor and is kept deliberately (Q35 of+    /// `drop-superseded-columns`); the refusal it stands for has widened under+    /// it. What has *not* widened is the reading that reaches this case:+    /// `StoreMetadata` positively identifies only a below-V5 store, because+    /// `NSStoreModelVersionIdentifiers` is advisory and a reader that refused+    /// on anything it did not recognise would lock the owner's only library.+    /// A V5–V7 store is therefore refused a row later, by its retired marker+    /// digit (`"5"`, `"6"` and `"7"` all fall to `.unrecognised`), with the+    /// same recovery. Both paths refuse; only this one names a store version.     case belowV5(version: String)     /// A certified library: the readiness marker records the current-    /// generation, `"8"`, and a store is present.+    /// generation, `"9"`, and a store is present.     case ready-    /// A library certified at the **previous** generation, `"7"`, with a store-    /// present: V8's schema stage will convert the store on the way in, and the-    /// data pass that fills what the stage could only add still owes its work-    /// (Req 2.2, Decision 3). The app runs it and republishes; the extension-    /// refuses and says to open the app (Req 2.3).+    /// A library certified at the **previous** generation, `"8"`, with a store+    /// present: V9's schema stage drops the superseded columns on the way in,+    /// which is the whole of the conversion, so all this arm owes is validating+    /// it and republishing (Q9). The app does that; the extension refuses and+    /// says to open the app (Req 2.3), which is what keeps the drop out of a+    /// process that holds a shared lock (Q3).     case markerLagging(generation: String)     /// Evidence that a library existed, with no store file of any kind to go with     /// it. Refused so the evidence survives for a restore (Req 2.6).@@ -74,22 +87,21 @@ extension LibraryRepository {     /// overlapping evidence resolvable at all (Q15). The rows, in order:     ///     /// 1. a positively below-V5 recorded version (Req 2.9)-    /// 2. marker `"8"` and a store present (Req 2.2)-    /// 3. marker `"7"` — a generation the app still opens — and a store present+    /// 2. marker `"9"` and a store present (Req 2.2)+    /// 3. marker `"8"` — a generation the app still opens — and a store present     /// 4. any evidence with no store present (Req 2.6)     /// 5. a store present with no readiness marker of any generation (Req 2.4)     /// 6. nothing on disk (Req 2.5)     /// 7. anything else, including a marker recording a retired generation     ///    (Req 2.7)     ///-    /// **Row 3 is back**, for the first time since `data-model-cleanups`-    /// Decision 2 retired `"4"`, `"5"` and `"6"`. `multi-site-works` publishes-    /// `"8"` and the population it ships to is on `"7"`, so the predecessor is-    /// *added* to `appOpenableMarkerVersions` rather than substituted — a device-    /// that has not launched the new build yet is on the old marker, and the set-    /// is what keeps it openable (`docs/agent-notes/schema-migration.md`). A-    /// digit outside the set still falls to the last row and is refused naming-    /// itself, with the backup archive as the recovery.+    /// **Row 3 holds one digit at a time.** `multi-site-works` brought it back+    /// for `"7"`; `drop-superseded-columns` substitutes `"8"` for it rather than+    /// adding a third, because every device is confirmed past `"7"` (Q2) and a+    /// lagging arm no device can reach is a path nothing tests. Substituting is+    /// what `docs/agent-notes/schema-migration.md` permits only after that+    /// confirmation. A digit outside the set still falls to the last row and is+    /// refused naming itself, with the backup archive as the recovery.     ///     /// Store presence is the disjunction over the SQLite family — `.sqlite`,     /// `-wal`, `-shm` (Req 2.10). A main file that is gone while its companions@@ -124,7 +136,10 @@ extension LibraryRepository {          // 1. The advisory reading, which can refuse and can never authorise         // (Decision 5). Absent, unreadable, merged and unrecognised readings all-        // fall through to the marker's word, which is what ships today.+        // fall through to the marker's word, which is what ships today. The+        // reading only ever names a *below-V5* store even though the plan's+        // floor is now V8 (Q35): a V5–V7 store falls through to row 7 on its+        // retired marker digit, which refuses it just the same.         if case .below(let version) = StoreMetadata.recordedVersion(at: storeURL) {             return .belowV5(version: version)         }

diff --git a/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+ComposedTeaching.swift b/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+ComposedTeaching.swiftindex 0b7bbde..4e014c6 100644--- a/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+ComposedTeaching.swift+++ b/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+ComposedTeaching.swift@@ -430,12 +430,18 @@ extension LibraryRepository {                 let derivation = ComposedDeriver.derive(                     captureTitle: entry.captureTitle, rawURL: entry.rawURLString,                     hostname: hostname, titleRule: titleRule, urlRule: urlRule)+                // One decode of the blob per row, not two: `keyVersion` and the+                // chapter-title provenance both live in it.+                let citations = entry.citationValues                 if entry.conservativeIdentityKey != entry.rawURLString { return true }                 if entry.entryIdentityKey != derivation.identity.key { return true }-                if entry.identityKeyVersion != derivation.identity.version { return true }+                if citations.identity.keyVersion != derivation.identity.version {+                    return true+                }                 if entry.chapterSequence != derivation.chapterSequence?.value { return true }                 if entry.urlWorkIdentity != derivation.workIdentity?.value { return true }-                if entry.chapterTitleProvenance != .manual, entry.chapterTitle != derivation.chapterTitle {+                if citations.chapterTitle.kind != .manual,+                   entry.chapterTitle != derivation.chapterTitle {                     return true                 }                 switch projection.assignment {@@ -655,98 +661,89 @@ extension LibraryRepository {                 let derivation = ComposedDeriver.derive(                     captureTitle: entry.captureTitle, rawURL: entry.rawURLString,                     hostname: hostname, titleRule: composedTitleRule, urlRule: composedURLRule)-                applyEntryIdentityAndChapter(-                    to: entry, derivation: derivation, titleRuleID: titleRuleID,-                    titleVersion: titleVersion, url: url)-                applyAssignment(-                    to: entry, assignment: projection.assignment, derivation: derivation,-                    hostname: hostname,-                    titleRuleID: titleRuleID, titleVersion: titleVersion, url: url,-                    createdByKey: createdByKey, workGroups: workGroups, timestamp: timestamp)+                // One decode and one encode of the blob per row: the derivation+                // and the assignment both write citations, and the chapter+                // guard reads one.+                entry.editCitations { citations in+                    applyEntryIdentityAndChapter(+                        to: entry, citations: &citations, derivation: derivation,+                        titleRuleID: titleRuleID, titleVersion: titleVersion, url: url)+                    applyAssignment(+                        to: entry, citations: &citations,+                        assignment: projection.assignment, derivation: derivation,+                        hostname: hostname,+                        titleRuleID: titleRuleID, titleVersion: titleVersion, url: url,+                        createdByKey: createdByKey, workGroups: workGroups, timestamp: timestamp)+                }                 entry.modifiedAt = timestamp             }         }     } +    /// Writes the whole derivation — the stored keys *and* the citations that+    /// describe them — against citations the caller already decoded (V9).+    ///+    /// The blob arrives `inout` rather than being edited here so that one row's+    /// derivation and its assignment share a single decode/encode: the identity+    /// basis, both pieces of URL evidence, the chapter provenance and the+    /// assignment are all citations, and a value the commit's own validation+    /// reads has to be consistent across every one of them.     static func applyEntryIdentityAndChapter(-        to entry: Entry, derivation: ComposedDerivation,+        to entry: Entry, citations: inout EntryCitations, derivation: ComposedDerivation,         titleRuleID: UUID, titleVersion: Int, url: (id: UUID, version: Int, definition: URLRuleDefinition)?     ) {         // The conservative-key alias is always the immutable raw URL (Q21).         entry.conservativeIdentityKey = entry.rawURLString -        switch derivation.identity {-        case .conservative(let raw):-            entry.entryIdentityKey = raw-            entry.identityKeyVersion = 1-            entry.identityBasis = .conservative-            entry.identityURLRuleID = nil-            entry.identityURLRuleVersion = nil-            entry.identityNameTitleRuleID = nil-            entry.identityNameTitleRuleVersion = nil-        case .identitySequence(let key):-            entry.entryIdentityKey = key-            entry.identityKeyVersion = 2-            entry.identityBasis = .urlRule-            entry.identityURLRuleID = url?.id-            entry.identityURLRuleVersion = url?.version-            entry.identityNameTitleRuleID = nil-            entry.identityNameTitleRuleVersion = nil-        case .sequenceName(let key):-            entry.entryIdentityKey = key-            entry.identityKeyVersion = 3-            entry.identityBasis = .urlRule-            entry.identityURLRuleID = url?.id-            entry.identityURLRuleVersion = url?.version-            entry.identityNameTitleRuleID = titleRuleID-            entry.identityNameTitleRuleVersion = titleVersion-        }+        let urlCited = url.flatMap { CitedRule(id: $0.id, version: $0.version) }+        let titleCited = CitedRule(id: titleRuleID, version: titleVersion)++        // One switch, not two: the stored key, the basis column and the cited+        // identity are three answers to the same question.+        let derived: (key: String, basis: EntryIdentityBasis, cited: EntryCitations.Identity) =+            switch derivation.identity {+            case .conservative(let raw):+                (raw, .conservative, .rawURL)+            case .identitySequence(let key):+                (key, .urlRule, urlCited.map { .rule(url: $0, nameTitle: nil) } ?? .rawURL)+            case .sequenceName(let key):+                (key, .urlRule, urlCited.map { .composed(url: $0, nameTitle: titleCited) } ?? .rawURL)+            }+        entry.entryIdentityKey = derived.key+        entry.identityBasis = derived.basis+        citations.identity = derived.cited          // Extracted Work identity (evidence), present only when the rule supplies it.-        if let workIdentity = derivation.workIdentity, let url {+        if let workIdentity = derivation.workIdentity, url != nil {             entry.urlWorkIdentity = workIdentity.value-            entry.urlWorkRuleID = url.id-            entry.urlWorkRuleVersion = url.version         } else {             entry.urlWorkIdentity = nil-            entry.urlWorkRuleID = nil-            entry.urlWorkRuleVersion = nil         }          // Chapter sequence (settlement evidence), present when extracted.-        if let sequence = derivation.chapterSequence, let url {+        if let sequence = derivation.chapterSequence, url != nil {             entry.chapterSequence = sequence.value-            entry.chapterSequenceRuleID = url.id-            entry.chapterSequenceRuleVersion = url.version         } else {             entry.chapterSequence = nil-            entry.chapterSequenceRuleID = nil-            entry.chapterSequenceRuleVersion = nil-        }--        // Chapter title from the title rule, unless a manual chapter protects it.-        if entry.chapterTitleProvenance != .manual {-            if let chapter = derivation.chapterTitle {-                entry.chapterTitle = chapter-                entry.chapterTitleProvenanceRaw = FieldProvenanceKind.pattern.rawValue-                entry.chapterPatternID = titleRuleID-                entry.chapterPatternVersion = titleVersion-            } else {-                entry.chapterTitle = nil-                entry.chapterTitleProvenanceRaw = FieldProvenanceKind.none.rawValue-                entry.chapterPatternID = nil-                entry.chapterPatternVersion = nil-            }         } -        // Decision 4: the columns were just written, so the blob is re-derived-        // from them before anything reads it — this commit's own validation-        // included, which is what a post-migration re-teach used to fail on.-        LegacyColumns.refreshCitations(on: entry)+        citations.urlWork = derivation.workIdentity != nil ? urlCited : nil+        citations.chapterSequence = derivation.chapterSequence != nil ? urlCited : nil++        // Chapter title from the title rule, unless a manual chapter protects+        // it — read off the citations already in hand.+        guard citations.chapterTitle.kind != .manual else { return }+        entry.chapterTitle = derivation.chapterTitle+        citations.chapterTitle = derivation.chapterTitle == nil+            ? .absent+            : FieldProvenance.tolerant(+                kind: .pattern, patternID: titleCited.id,+                patternVersion: titleCited.version)     }      private static func applyAssignment(-        to entry: Entry, assignment: ComposedAssignmentProjection, derivation: ComposedDerivation,+        to entry: Entry, citations: inout EntryCitations,+        assignment: ComposedAssignmentProjection, derivation: ComposedDerivation,         hostname: String,         titleRuleID: UUID, titleVersion: Int, url: (id: UUID, version: Int, definition: URLRuleDefinition)?,         createdByKey: [ProspectiveWorkKey: Work], workGroups: [UUID: WorkGroup], timestamp: Date@@ -778,38 +775,35 @@ extension LibraryRepository {                 work.refreshParsedTitle(to: derivation.workName, commit: true)                 work.modifiedAt = timestamp             }-            applyAssignmentProvenance(to: entry, derivation: derivation,+            applyAssignmentProvenance(to: &citations, derivation: derivation,                 titleRuleID: titleRuleID, titleVersion: titleVersion, url: url)         case .create(let key):             guard let work = createdByKey[key] else { break }             entry.work = work-            applyAssignmentProvenance(to: entry, derivation: derivation,+            applyAssignmentProvenance(to: &citations, derivation: derivation,                 titleRuleID: titleRuleID, titleVersion: titleVersion, url: url)         }     } +    /// The assignment's own citations, written into a blob the caller already+    /// decoded so a row pays one decode and one encode for its whole write.     static func applyAssignmentProvenance(-        to entry: Entry, derivation: ComposedDerivation,+        to citations: inout EntryCitations, derivation: ComposedDerivation,         titleRuleID: UUID, titleVersion: Int, url: (id: UUID, version: Int, definition: URLRuleDefinition)?     ) {-        if let _ = derivation.workIdentity, let url {+        if derivation.workIdentity != nil, let url {             // Identity-based assignment (URL rule supplied the Work identity).-            entry.workAssignmentProvenanceRaw = FieldProvenanceKind.urlRule.rawValue-            entry.workURLRuleID = url.id-            entry.workURLRuleVersion = url.version-            entry.workURLAssignmentKindRaw = URLWorkAssignmentKind.identity.rawValue-            entry.workPatternID = nil-            entry.workPatternVersion = nil+            let cited = CitedRule(id: url.id, version: url.version)+            citations.workAssignment = .urlRule(cited)+            citations.workURL = cited+            citations.workURLAssignmentKind = .identity         } else {             // Title-based assignment (the composed name grouped the Work).-            entry.workAssignmentProvenanceRaw = FieldProvenanceKind.pattern.rawValue-            entry.workPatternID = titleRuleID-            entry.workPatternVersion = titleVersion-            entry.workURLRuleID = nil-            entry.workURLRuleVersion = nil-            entry.workURLAssignmentKindRaw = nil+            citations.workAssignment = .pattern(+                CitedRule(id: titleRuleID, version: titleVersion))+            citations.workURL = nil+            citations.workURLAssignmentKind = nil         }-        LegacyColumns.refreshCitations(on: entry)     }      static func nonEmpty(_ value: String?) -> String? {

diff --git a/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+ConfirmImport.swift b/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+ConfirmImport.swiftindex c0aa1b9..96f4ddc 100644--- a/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+ConfirmImport.swift+++ b/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+ConfirmImport.swift@@ -460,17 +460,6 @@ extension LibraryRepository {             }             try saveStrategy.save(context)         }--        // The superseded Work columns mirror the primary membership wherever one-        // moved (Decision 4, Q60) — until V9 (T-2272). Every row of the identity-        // group, because the mirror is a per-row column.-        var dirty = false-        for workID in touched {-            for work in workRows[workID] ?? [] where LegacyColumns.refreshMembership(on: work) {-                dirty = true-            }-        }-        if dirty { try saveStrategy.save(context) }     }      /// The reader's dismissed pairs (Req 5.5, 5.8). Matched by row UUID and@@ -551,12 +540,18 @@ extension LibraryRepository {         entry.lastSharedAt = record.lastSharedAt         entry.modifiedAt = record.modifiedAt         entry.intentionallyUnattached = record.intentionallyUnattached-        // A 7/8 record carries the citations as one blob (Q25), so the columns-        // are written from it and the blob re-encoded from them — Decision 4's-        // invariant, stated at the write site as every other citation writer-        // states it, so an import into a **non-empty** library cannot leave the-        // two homes disagreeing for its own validation to read. Until V9-        // (T-2272), which deletes the columns and this call with them.-        LegacyColumns.applyCitations(record.citations, on: entry)+        // A 7/8 record carries the citations as one blob (Q25) and the store has+        // exactly one home for them, so the record's value is written straight+        // in. This is a **whole-value** write, not an edit: the record replaces+        // everything the row cited, bytes that would not decode included.+        //+        // Swallowed deliberately, and this function stays non-throwing: the+        // value being encoded came out of `JSONDecoder` moments ago as the same+        // `EntryCitations` type, so the encode has no runtime input that could+        // fail it — the same invariant `EntryCitations.defaultBlob` rests on.+        // Making the whole record-application path throwing to carry an error+        // that cannot arise would put a `try` on every sibling `apply` for+        // nothing.+        try? entry.setCitations(record.citations)     } }

diff --git a/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+DuplicateResolution.swift b/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+DuplicateResolution.swiftindex 1bebfa4..fe84968 100644--- a/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+DuplicateResolution.swift+++ b/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+DuplicateResolution.swift@@ -548,37 +548,42 @@ extension LibraryRepository {     ) {         row.note = note         row.rating = content.rating-        // Decision 4: this writes provenance columns on both arms and returns-        // early on one of them, so the mirror is refreshed on the way out.-        defer { LegacyColumns.refreshCitations(on: row) }--        if content.chapterTitle != nil {-            row.chapterTitle = carrier.chapterTitle-            row.chapterTitleProvenance = carrier.chapterTitleProvenance-        } else if row.chapterTitleProvenance == .manual {-            row.chapterTitle = nil-            row.chapterTitleProvenance = .none-        }--        if content.intentionallyUnattached {-            // Q85: every write path that sets the flag nils the pointer, and a-            // row that is intentionally unattached and still points somewhere is-            // a state nothing else produces.-            row.intentionallyUnattached = true-            row.work = nil-            return-        }-        row.intentionallyUnattached = false-        if content.workAssignment != nil {-            // The carrier's own pointer — never the normalised equality key,-            // which names a survivor rule's candidate rather than anybody's-            // decision (Q67), and never a re-fetch by the content's UUID, which-            // throws when that Work has since gone and would fail the whole-            // resolution over an assignment.-            row.work = carrier.work-            row.workAssignmentProvenance = carrier.workAssignmentProvenance-        } else if row.workAssignmentProvenance == .manual {-            row.workAssignmentProvenance = .none+        // The carrier's citation arms are copied whole rather than kind by kind:+        // the blob's arms *are* the provenance, and copying a kind without its+        // cited rule is a state it cannot spell (Q39).+        let carried = carrier.citationValues++        // One decode and one encode of the survivor's blob for both arms, with+        // the `.manual` guards read off the value already in hand.+        row.editCitations { citations in+            if content.chapterTitle != nil {+                row.chapterTitle = carrier.chapterTitle+                citations.chapterTitle = carried.chapterTitle+            } else if citations.chapterTitle.kind == .manual {+                row.chapterTitle = nil+                citations.chapterTitle = .absent+            }++            if content.intentionallyUnattached {+                // Q85: every write path that sets the flag nils the pointer, and+                // a row that is intentionally unattached and still points+                // somewhere is a state nothing else produces.+                row.intentionallyUnattached = true+                row.work = nil+                return+            }+            row.intentionallyUnattached = false+            if content.workAssignment != nil {+                // The carrier's own pointer — never the normalised equality key,+                // which names a survivor rule's candidate rather than anybody's+                // decision (Q67), and never a re-fetch by the content's UUID,+                // which throws when that Work has since gone and would fail the+                // whole resolution over an assignment.+                row.work = carrier.work+                citations.workAssignment = carried.workAssignment+            } else if citations.workAssignment.provenanceKind == .manual {+                citations.workAssignment = .none+            }         }     } @@ -652,12 +657,10 @@ extension LibraryRepository {             // so each site's answer lands on that site's membership. A hostname             // the fold produced no URL for is left alone rather than cleared —             // the fold only ever adopts, so "no answer" means "nobody had one",-            // never "discard the one this row holds". The superseded column-            // mirrors the primary membership beside it (Decision 4).+            // never "discard the one this row holds".             for (hostname, url) in union.workURLsByHostname {                 row.membership(for: hostname)?.workURLString = url             }-            LegacyColumns.refreshMembership(on: row)             // The chosen variant's assignment, written through the one write             // table so the compatibility column stays what a pre-feature build             // can read (Req 6.11). The fold never moves the type.@@ -743,7 +746,7 @@ extension LibraryRepository {         // The character's Work's primary site (Req 1.2): a character has no         // hostname of its own, and the site is only needed to name the         // quarantine key the resolution validates against.-        let hostname = rows.compactMap { $0.work?.membershipValues.first?.hostname }.first ?? ""+        let hostname = rows.compactMap { $0.work?.primaryMembership?.hostname }.first ?? ""         if let refusal = try commitResolution(             context: context, hostnames: [hostname], operation: "resolution") {             return (refusal, [], nil)

diff --git a/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+Groups.swift b/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+Groups.swiftindex 2c9a100..92bd774 100644--- a/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+Groups.swift+++ b/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+Groups.swift@@ -114,8 +114,9 @@ extension LibraryRepository {     ///     /// Cheap by construction. Only a *split* group whose rows carry two     /// different **manual** assignments can be read torn by an assignment, so-    /// the guard is two scalar reads per row and a relationship fault only for-    /// the manual rows of a split group. A library in which no group disagrees —+    /// the guard is one citation decode per row of a split group and a+    /// relationship fault only for its manual rows. A library in which no group+    /// disagrees —     /// which is nearly all of them — never fetches a Work at all.     internal static func canonicalWorkIDs(         normalising rows: [Entry], context: ModelContext

diff --git a/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+ReparseCapture.swift b/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+ReparseCapture.swiftindex 5572485..06c139a 100644--- a/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+ReparseCapture.swift+++ b/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+ReparseCapture.swift@@ -333,8 +333,12 @@ extension LibraryRepository {             context.insert(entry)             // The conservative-key alias is always the immutable raw URL (Q21).             entry.conservativeIdentityKey = contract.request.rawURLString-            entry.identityKeyVersion = contract.outcome.composedIdentityKeyVersion             entry.identityBasis = contract.outcome.composedIdentityKeyVersion == 1 ? .conservative : .urlRule+            // The basis *version* is a citation now, so it is not written here:+            // `init` seeded the blob at `.rawURL`, which is what every arm below+            // that does not apply a rule leaves it at, and+            // `applyEntryIdentityAndChapter` writes the cited arm for the one+            // that does.              // Apply the approved Site-specific outcome. A quarantined Site or a             // taught Site with no active title rule (transitional M3 Work-only)@@ -367,20 +371,25 @@ extension LibraryRepository {                     captureTitle: contract.request.captureTitle, rawURL: contract.request.rawURLString,                     hostname: validated.hostname, titleRule: titleRule, urlRule: composedURL) -                Self.applyEntryIdentityAndChapter(-                    to: entry, derivation: derivation,-                    titleRuleID: activePattern.id, titleVersion: activePattern.version, url: url)-                 // Predicated, not a full-table fetch filtered in memory: this is-                // the share extension's commit path.+                // the share extension's commit path. Read before the blob edit+                // below so the derivation and the assignment share one decode.                 let allWorks = try Self.worksOn(                     hostname: validated.hostname, context: context)-                Self.applyCaptureAssignment(-                    to: entry, assignment: contract.outcome.composedAssignment, derivation: derivation,-                    titleRuleID: activePattern.id, titleVersion: activePattern.version, url: url,-                    allWorks: allWorks, types: try Self.workTypeDirectory(context: context),-                    hostname: validated.hostname, site: site,-                    context: context, timestamp: timestamp)+                let types = try Self.workTypeDirectory(context: context)+                entry.editCitations { citations in+                    Self.applyEntryIdentityAndChapter(+                        to: entry, citations: &citations, derivation: derivation,+                        titleRuleID: activePattern.id, titleVersion: activePattern.version,+                        url: url)+                    Self.applyCaptureAssignment(+                        to: entry, citations: &citations,+                        assignment: contract.outcome.composedAssignment, derivation: derivation,+                        titleRuleID: activePattern.id, titleVersion: activePattern.version,+                        url: url, allWorks: allWorks, types: types,+                        hostname: validated.hostname, site: site,+                        context: context, timestamp: timestamp)+                }             }              // Validate the written tuple only (Req 6.5, Q9): no full-graph pass.@@ -420,7 +429,8 @@ extension LibraryRepository {      /// Applies a composed capture assignment to a single new Entry (Req 6.2).     private static func applyCaptureAssignment(-        to entry: Entry, assignment: ComposedAssignmentProjection?, derivation: ComposedDerivation,+        to entry: Entry, citations: inout EntryCitations,+        assignment: ComposedAssignmentProjection?, derivation: ComposedDerivation,         titleRuleID: UUID, titleVersion: Int, url: (id: UUID, version: Int, definition: URLRuleDefinition)?,         allWorks: [Work], types: WorkTypeDirectory, hostname: String, site: Site?,         context: ModelContext, timestamp: Date@@ -431,7 +441,7 @@ extension LibraryRepository {         case .ambiguous:             // The rule processed this Entry but could not resolve a single Work;             // record the processing provenance with no Work, matching M3 (Req 9.3).-            applyAssignmentProvenance(to: entry, derivation: derivation,+            applyAssignmentProvenance(to: &citations, derivation: derivation,                 titleRuleID: titleRuleID, titleVersion: titleVersion, url: url)         case .reuse(let workID), .claim(let workID):             // **Every row of the Work group, not the one row this Entry points@@ -460,7 +470,7 @@ extension LibraryRepository {                 work.refreshParsedTitle(to: derivation.workName, commit: true)                 work.modifiedAt = timestamp             }-            applyAssignmentProvenance(to: entry, derivation: derivation,+            applyAssignmentProvenance(to: &citations, derivation: derivation,                 titleRuleID: titleRuleID, titleVersion: titleVersion, url: url)         case .create(let key):             guard let name = derivation.workName, !M2Unicode.isBlank(name) else { break }@@ -477,7 +487,7 @@ extension LibraryRepository {             work.lastParsedTitle = name             work.titleProvenanceRaw = TitleProvenance.parsed.rawValue             entry.work = work-            applyAssignmentProvenance(to: entry, derivation: derivation,+            applyAssignmentProvenance(to: &citations, derivation: derivation,                 titleRuleID: titleRuleID, titleVersion: titleVersion, url: url)         }     }

diff --git a/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+Sites.swift b/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+Sites.swiftindex 03a57c4..8161665 100644--- a/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+Sites.swift+++ b/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+Sites.swift@@ -129,23 +129,6 @@ extension LibraryRepository {                 context.delete(row)             } -            // The superseded columns mirror the **primary** membership-            // (Decision 4), and removing a site can be removing that one. Left-            // unrefreshed they keep naming the removed site — and-            // `BackupArchiveProjection` reads the Work record's hostname from-            // the surviving membership and its identity from the columns, so the-            // export would then cite a rule belonging to a site the Work is no-            // longer on and `BackupArchiveReferenceChecks` would refuse the whole-            // archive. Before validation, so the refusal below can see the graph-            // the save would write — and from the surviving rows explicitly,-            // because `siteMemberships` still hands back the ones deleted above-            // until the save.-            for row in group.rows {-                LegacyColumns.refreshMembership(-                    on: row,-                    memberships: row.membershipValues.filter { !removed.contains($0.id) })-            }-             // Task 8 review: **every** hostname of the Work, not just the one             // being removed. A removal on a two-site Work changes what the other             // site's graph looks like too — the Work is still on it — and

diff --git a/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+URLIdentity.swift b/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+URLIdentity.swiftindex 0e84ac9..ecf1e0d 100644--- a/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+URLIdentity.swift+++ b/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+URLIdentity.swift@@ -91,8 +91,7 @@ extension LibraryRepository {           workID: group.carrier.work?.id,           intentionallyUnattached: group.carrier.intentionallyUnattached,           parsedWorkTitle: nil,-          hasManualAssignment: group.carrier.workAssignmentProvenanceRaw-            == FieldProvenanceKind.manual.rawValue+          hasManualAssignment: group.carrier.workAssignmentProvenance == .manual         )       } 

diff --git a/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+WorkMerge.swift b/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+WorkMerge.swiftindex 9c149cd..0d0c211 100644--- a/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+WorkMerge.swift+++ b/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository+WorkMerge.swift@@ -110,11 +110,6 @@ extension LibraryRepository {                 // group that has not been healed onto the hostname yet simply has                 // nothing to write — the heal adds it, and the next commit lands.                 row.membership(for: hostname)?.workURLString = contract.outcome.resultingURL-                // The superseded column mirrors the primary membership until V9-                // (Decision 4): `GroupOrdering`'s authored content still reads it,-                // so a confirmed URL that skipped it would stop counting as a-                // reason two rows are torn.-                LegacyColumns.refreshMembership(on: row)                 // Q74: one stamp for the whole group, or a write that was never                 // about which row represents it moves which row represents it.                 row.modifiedAt = urlTimestamp@@ -434,10 +429,6 @@ extension LibraryRepository {                     }                 }             }-            // The superseded columns mirror the primary membership (Decision 4),-            // and a moved membership can change which one that is.-            for row in targetGroup.rows { LegacyColumns.refreshMembership(on: row) }-             // Req 3.4: the source's characters move to the target with their             // entry citations intact, its generic-notes citations repointed to             // the target's generic notes, its suppressions unioned, and the

diff --git a/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository.swift b/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository.swiftindex 268ad06..4d02647 100644--- a/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository.swift+++ b/Packages/AsterismCore/Sources/AsterismCore/LibraryRepository.swift@@ -182,17 +182,16 @@ public actor LibraryRepository {         if scan.duplicateCandidateCount > 0, duplicatePhaseSkipped {             duplicateFollowUpNeeded = true         }-        // The same shape for the V8 conversion passes (Decision 5). No latch is-        // needed here: an unconverted row that arrives after this refresh is-        // still unconverted when the next scan sees it, and the full-tier pass-        // that every launch, import and reader action runs is unconditional. A-        // duplicate set is different — the phase that processed it clears the-        // candidate, so a skipped pass has to be remembered.-        var pending: V8PopulationPass.Phases = []-        if scan.worksWithoutMembershipCount > 0 { pending.insert(.memberships) }-        if scan.entriesWithoutCitationBlobCount > 0 { pending.insert(.citations) }-        if scan.patternsWithoutDefinitionBlobCount > 0 { pending.insert(.definitions) }-        pendingConversionPhases = pending+        // The same shape for the membership heal (Q10). No latch is needed+        // here: a Work that arrives without a membership after this refresh is+        // still without one when the next scan sees it. A duplicate set is+        // different — the phase that processed it clears the candidate, so a+        // skipped pass has to be remembered.+        //+        // The two blob counters are **reports**, not gates: nothing converts a+        // row any more, so a nil blob is a state the reader is told about and+        // the archive repairs.+        worksWithoutMembership = scan.worksWithoutMembershipCount > 0     }      /// The chunk size every bulk pass commits in — the reconciler's re-pin and@@ -275,16 +274,13 @@ public actor LibraryRepository {     /// candidates when the session's first pass runs, so that one pass runs the     /// phase whatever the counters say; every pass after it consults them.     internal var hasRunDuplicatePhaseThisSession = false-    /// Which V8 conversion phases the last tolerance scan found unconverted-    /// rows for — the arrival tier's gate for the population pass and the-    /// membership heal (Decision 5).+    /// Whether the last tolerance scan counted a Work with no membership — the+    /// gate for `MembershipReconciler`'s heal phase (Q10).     ///-    /// The three counters this replaces were only ever read as `> 0`, once each,-    /// to build exactly this set. Storing the set stores the answer rather than-    /// three numbers and a rule for turning them into it. Empty from the open,-    /// which is the right answer for the arrival tier: the launch pass runs-    /// `.full` and is unconditional.-    internal var pendingConversionPhases: V8PopulationPass.Phases = []+    /// False from the open, and that is the right answer: the heal is a repair+    /// for a state a lagging writer produced, so a library nothing has scanned+    /// has nothing to repair and the next refresh arms it if it has.+    internal var worksWithoutMembership = false      /// Makes the Site graph coherent after records arrive (Req 1.1–1.8).     ///@@ -348,8 +344,6 @@ public actor LibraryRepository {         }         let cachedTuples = diagnostics.tupleDiagnoses         let runsDuplicatePhase = duplicatePhaseRuns(tier: tier)-        let populationPhases = self.populationPhases(tier: tier)-        let membershipHealRuns = self.membershipHealRuns(tier: tier)          bulkOperationInProgress = true         defer { bulkOperationInProgress = false }@@ -370,25 +364,19 @@ public actor LibraryRepository {                 context: context,                 saveStrategy: saveStrategy) -            // Steps 3 and 4, inside the same exclusive context as the Site-            // phase. The population pass converts anything a lagging V7 device-            // synced in since the migration (Req 2.7, Q36) — memberships and-            // both blobs, behind the same guards the bootstrap arm runs it with-            // — and the membership reconciler then heals, de-duplicates and-            // re-attaches what arrived (Req 8.1–8.3, 5.8).+            // Step 3, inside the same exclusive context as the Site phase: the+            // membership reconciler heals, de-duplicates and re-attaches what+            // arrived (Req 8.1–8.3, 5.8).             //-            // **Tiered** (Decision 5). The full tier is unconditional and keeps-            // Decision 4's value guard, which is what re-derives a blob a-            // column writer left stale. The arrival tier runs the whole-library-            // phases only where the last tolerance scan counted rows for them —-            // otherwise every remote-change debounce charged a converged-            // library four whole-table walks for nothing (Req 8.6).-            try V8PopulationPass.run(-                context: context, batchSize: Self.bulkOperationBatchSize,-                saveStrategy: saveStrategy, phases: populationPhases)+            // `V8PopulationPass` ran here until V9 and is gone with the columns+            // it converted from. Its **heal** gate survives it (Q10), on both+            // tiers rather than only the arrival one: heal walks the whole Entry+            // table — 0.505 s over the M4 fixture with nothing to do — and a+            // library whose every Work holds a membership has nothing for it to+            // find, whichever tier asked.             pass.memberships = try MembershipReconciler.run(                 context: context, batchSize: Self.bulkOperationBatchSize,-                saveStrategy: saveStrategy, heals: membershipHealRuns)+                saveStrategy: saveStrategy, heals: worksWithoutMembership)              // The hostnames this pass wrote to. The Site half is filtered by the             // cached tuple set — a hostname with nothing to shed costs nothing,@@ -534,37 +522,11 @@ public actor LibraryRepository {         }     } -    /// Which `V8PopulationPass` phases this tier's pass runs (Decision 5).-    ///-    /// The **full** tier runs all three, and must: phase 2 is a *value* guard,-    /// not an existence guard (Decision 4), so it is the only thing that-    /// re-derives a blob a lagging V7 device left stale by rewriting the columns-    /// under it — a state no counter can see, because the row has a blob. Launch,-    /// import re-fire and every reader action are full-tier, so convergence is-    /// bounded by those rather than by the debounce.-    ///-    /// The **arrival** tier runs a phase only where the last tolerance scan-    /// counted unconverted rows for it. That is the Req 2.7 shape exactly — a-    /// V7 writer syncs in a Work with no membership row and an Entry with no-    /// citation blob, and both are counted — and it is what keeps a converged-    /// library from paying three whole-table fetches per debounce (Req 8.6).-    private func populationPhases(tier: ReconcilePassTier) -> V8PopulationPass.Phases {-        tier == .arrival ? pendingConversionPhases : .all-    }--    /// Whether this tier's pass runs `MembershipReconciler`'s heal phase-    /// (Decision 5) — the one phase of that pass which walks the whole Entry-    /// table, measured at 0.505 s over the M4 fixture with nothing to do.-    ///-    /// Gated on the same counter as the membership population phase, and-    /// deliberately: `populateMemberships` mints from a Work's retained-    /// hostname column, so on an arrival that carries the Req 2.7 shape it runs-    /// first and heal only has to reach what it could not mint for — a Work with-    /// a blank hostname, or one whose Entries are on a hostname its memberships-    /// are not.-    private func membershipHealRuns(tier: ReconcilePassTier) -> Bool {-        tier == .full || pendingConversionPhases.contains(.memberships)-    }+    // `populationPhases(tier:)` and `membershipHealRuns(tier:)` stood here.+    // The first chose which `V8PopulationPass` phases a tier ran; the second+    // made the heal unconditional on the full tier because the pass's own value+    // guard was. Both went with the pass: the heal's gate is now the diagnosis+    // counter alone, on every tier (Q10).      /// Req 2.1's second half: the settled sets' losing members go, in a **fresh**     /// context (Q61), with their saves chunked (Decision 29).@@ -1359,13 +1321,11 @@ public actor LibraryRepository {     /// validates and so rolled the whole deletion back; `moveEntry` does not,     /// and saved a graph the next open quarantines.     internal static func applyManualAssignment(to row: Entry, at timestamp: Date) {-        row.workAssignmentProvenance = .manual-        row.workPatternID = nil-        row.workPatternVersion = nil-        row.workURLRuleID = nil-        row.workURLRuleVersion = nil-        row.workURLAssignmentKindRaw = nil-        LegacyColumns.refreshCitations(on: row)+        row.editCitations { citations in+            citations.workAssignment = .manual+            citations.workURL = nil+            citations.workURLAssignmentKind = nil+        }         row.modifiedAt = timestamp     } @@ -1405,56 +1365,52 @@ public actor LibraryRepository {         existingWorks: [UUID: Work],         timestamp: Date     ) {-        // Apply chapter-        switch projection.chapterProvenance {-        case .preserved:-            break // Keep existing-        case .cleared:-            entry.chapterTitle = nil-            entry.chapterTitleProvenanceRaw = FieldProvenanceKind.none.rawValue-            entry.chapterPatternID = nil-            entry.chapterPatternVersion = nil-        case .pendingPattern:-            entry.chapterTitle = projection.projectedChapter-            entry.chapterTitleProvenanceRaw = FieldProvenanceKind.pattern.rawValue-            entry.chapterPatternID = patternID-            entry.chapterPatternVersion = patternVersion-        }+        let cited = CitedRule(id: patternID, version: patternVersion)++        // One decode and one encode of the blob for both arms: the chapter and+        // the assignment are two citations in the same value.+        entry.editCitations { citations in+            // Apply chapter+            switch projection.chapterProvenance {+            case .preserved:+                break // Keep existing+            case .cleared:+                entry.chapterTitle = nil+                citations.chapterTitle = .absent+            case .pendingPattern:+                entry.chapterTitle = projection.projectedChapter+                citations.chapterTitle = FieldProvenance.tolerant(+                    kind: .pattern, patternID: cited.id, patternVersion: cited.version)+            } -        // Apply assignment-        switch projection.assignmentProvenance {-        case .preserved:-            break // Keep existing-        case .cleared:-            entry.work = nil-            entry.workAssignmentProvenanceRaw = FieldProvenanceKind.none.rawValue-            entry.workPatternID = nil-            entry.workPatternVersion = nil-            entry.intentionallyUnattached = false-        case .pendingPattern:-            if let workOutcome = projection.workOutcome {-                switch workOutcome {-                case .reuse(let workID):-                    if let work = existingWorks[workID] {-                        entry.work = work-                    }-                case .create(let title):-                    if let work = createdWorks[title] {-                        entry.work = work+            // Apply assignment+            switch projection.assignmentProvenance {+            case .preserved:+                break // Keep existing+            case .cleared:+                entry.work = nil+                citations.workAssignment = .none+                entry.intentionallyUnattached = false+            case .pendingPattern:+                if let workOutcome = projection.workOutcome {+                    switch workOutcome {+                    case .reuse(let workID):+                        if let work = existingWorks[workID] {+                            entry.work = work+                        }+                    case .create(let title):+                        if let work = createdWorks[title] {+                            entry.work = work+                        }+                    case .ambiguous:+                        entry.work = nil                     }-                case .ambiguous:-                    entry.work = nil                 }+                citations.workAssignment = .pattern(cited)+                entry.intentionallyUnattached = false             }-            entry.workAssignmentProvenanceRaw = FieldProvenanceKind.pattern.rawValue-            entry.workPatternID = patternID-            entry.workPatternVersion = patternVersion-            entry.intentionallyUnattached = false         } -        // Decision 4: the columns lead and the blob mirrors, refreshed at the-        // write site so the re-parse commit's own validation reads what it wrote.-        LegacyColumns.refreshCitations(on: entry)         entry.modifiedAt = timestamp     } @@ -1812,28 +1768,30 @@ public actor LibraryRepository {         return true     } -    /// The four raw enum columns are read through the model's tolerant accessors+    /// The raw enum columns are read through the model's tolerant accessors     /// (Q2): a spelling this build has no case for reads as the column's default     /// — nil for `ratingRaw`, which is optional — rather than failing the whole     /// screen with `corruptLibrary`.     ///-    /// `FieldProvenance`'s throwing init stays. It validates the *combination*-    /// of kind, pattern id and version, which is an invariant about the row's-    /// own columns rather than a spelling from a newer build, and nothing about-    /// enum tolerance makes an id-less `.pattern` provenance legal. The one-    /// thing it must not do is refuse a combination the coercion itself-    /// manufactured — see `toleratedProvenance`.+    /// Both provenances come out of the citation blob, which types them: the+    /// kind *is* the case, and the case carries its own cited rule or carries+    /// none, so there is no combination left to validate and no unrecognised+    /// spelling to coerce. `toleratedProvenance` and its two coercion arms went+    /// with the columns.+    ///+    /// **Bytes that will not decode still fail closed here**, which is what the+    /// combination check used to do and for the same reason: enum tolerance is+    /// about a spelling a newer build wrote, while a malformed row is a fault in+    /// the row itself and the mapper must not invent a value for it. A *nil*+    /// blob is neither (Q6) — it is a row V9 has not rewritten, it reads as the+    /// default, and the validator reports it.     internal static func snapshot(_ entry: Entry) throws -> EntrySnapshot {-        let chapter = try Self.toleratedProvenance(-            raw: entry.chapterTitleProvenanceRaw,-            patternID: entry.chapterPatternID,-            patternVersion: entry.chapterPatternVersion-        )-        let assignment = try Self.toleratedProvenance(-            raw: entry.workAssignmentProvenanceRaw,-            patternID: entry.workPatternID,-            patternVersion: entry.workPatternVersion-        )+        let citations = try entry.citations+        let chapter = citations.chapterTitle+        let assignment = FieldProvenance.tolerant(+            kind: citations.workAssignment.provenanceKind,+            patternID: citations.workAssignment.patternRule?.id,+            patternVersion: citations.workAssignment.patternRule?.version)         return EntrySnapshot(             id: entry.id,             captureTitle: entry.captureTitle,@@ -1842,7 +1800,7 @@ public actor LibraryRepository {             canonicalURLString: entry.canonicalURLString,             hostname: entry.hostname,             entryIdentityKey: entry.entryIdentityKey,-            identityKeyVersion: entry.identityKeyVersion,+            identityKeyVersion: citations.identity.keyVersion,             chapterTitle: entry.chapterTitle,             chapterTitleProvenance: chapter,             note: entry.note,@@ -1858,29 +1816,11 @@ public actor LibraryRepository {         )     } -    /// A provenance kind read tolerantly, with the citation columns dropped-    /// where the raw spelling is one this build has no case for.-    ///-    /// The coercion is a presentation choice about the *kind* (Q2), and it-    /// cannot be allowed to invent an illegal row. A newer build's provenance-    /// kind legitimately cites a pattern id and version; coerced to `.none`,-    /// which carries neither, the pair would fail `FieldProvenance`'s-    /// combination check and take the whole snapshot down — exactly the-    /// screen-wide refusal the tolerance exists to remove. So the citation-    /// travels with the kind it belonged to: a coerced row presents as uncited.-    ///-    /// A spelling this build *does* know keeps the check untouched, illegal-    /// combination and all: an id-less `.pattern` is a fault in the row's own-    /// columns, not a message from a newer build.-    private static func toleratedProvenance(-        raw: String, patternID: UUID?, patternVersion: Int?-    ) throws -> FieldProvenance {-        guard let kind = FieldProvenanceKind(rawValue: raw) else {-            return try FieldProvenance(kind: .none)-        }-        return try FieldProvenance(-            kind: kind, patternID: patternID, patternVersion: patternVersion)-    }+    // `toleratedProvenance` stood here: a provenance kind read out of a raw+    // column, coerced to `.none` for a spelling this build had no case for and+    // stripped of its citation so the coercion could not manufacture an illegal+    // `FieldProvenance`. The blob types the provenance, so neither half has+    // anything left to do (V9, T-2280).      // `validateStore` stood here — the superseded opener's validation, via the     // since-deleted `V2LibraryValidator` over a backup snapshot of the whole

diff --git a/Packages/AsterismCore/Sources/AsterismCore/LibraryValidator.swift b/Packages/AsterismCore/Sources/AsterismCore/LibraryValidator.swiftindex 682328f..32d907b 100644--- a/Packages/AsterismCore/Sources/AsterismCore/LibraryValidator.swift+++ b/Packages/AsterismCore/Sources/AsterismCore/LibraryValidator.swift@@ -801,10 +801,18 @@ public enum LibraryValidator {         let id = entry.id.uuidString         let citation = CitationContext(             citingSite: entry.site, tolerant: tolerateUnlinkedCitations)-        // V8: every citation this arm reads comes out of the blob (Q25), which-        // falls back to the legacy columns while a row is unconverted (Q36). A-        // blob that will not decode is its own diagnosis, named after the Entry-        // rather than reported as a fan of tuple failures.+        // V9: the blob is the only home a citation has (multi-site-works Q25).+        // Bytes that will not decode are a fault in the row itself and are+        // **thrown**, which quarantines the hostname the way every other+        // unreadable row does.+        //+        // **No bytes at all is a report, not a quarantine** (Req 19). It is a+        // row a V8 build wrote that the drop stage reached before anything+        // converted it: the row is intact apart from its provenance, it reads as+        // "cites nothing" everywhere else so a screen still renders, and+        // quarantining its hostname would take away every write on that site+        // over a loss no write can undo. `entriesWithoutCitationBlobCount`+        // counts it and the archive repairs it.         let citations: EntryCitations         do { citations = try entry.citations }         catch {@@ -1035,9 +1043,9 @@ public enum LibraryValidator {     /// The chapter arm, over the blob's `chapterTitle` provenance.     ///     /// The unrecognised-raw guard is gone with the column: the blob types the-    /// kind, and a spelling a newer build wrote reads as `.none` through-    /// `LegacyColumns` exactly as it does everywhere else in the schema (Q25,-    /// T-2271 Q2). What is left is the pairing of value, kind and citation.+    /// kind, and a spelling a newer build wrote reads as `.none` exactly as it+    /// does everywhere else in the schema (Q25, T-2271 Q2). What is left is the+    /// pairing of value, kind and citation.     private static func validateChapter(         _ entry: Entry,         id: String,@@ -1076,6 +1084,11 @@ public enum LibraryValidator {     /// arm's citation and the "stray pattern reference" guards have nothing left     /// to catch. The URL arm's own two citations — the cited rule and the     /// assignment kind — are still paired here, because they are the arm's.+    ///+    /// The `.none` arm reads `entry.citationsAreAbsent`: no citation bytes at+    /// all is the same value as bytes decoding to `.none` and a different fact —+    /// the second is a partial write, the first is a row the V8 → V9 drop stage+    /// reached before anything converted it (Q6).     private static func validateAssignment(         _ entry: Entry,         id: String,@@ -1088,7 +1101,16 @@ public enum LibraryValidator {          switch citations.workAssignment {         case .none:-            guard work == nil, !hasURLReference,+            // `work == nil` is the invariant for a row whose citations were+            // actually written: nothing assigns an Entry to a Work without+            // recording how. A **nil blob** is the one exception, and it is the+            // same exception the unreadable-citations arm makes one call up+            // (Q25): the assignment provenance is what the drop stage took, the+            // relationship is not, and quarantining the hostname over it would+            // withdraw every write on the site — the manual re-assignment that+            // is the only repair included. The row is counted by+            // `entriesWithoutCitationBlobCount` instead.+            guard work == nil || entry.citationsAreAbsent, !hasURLReference,                   entry.intentionallyUnattached == (site.mode == .articles) else {                 throw invalid("Entry", id, "none assignment has incompatible relationship or provenance")             }

diff --git a/Packages/AsterismCore/Sources/AsterismCore/M4PerformanceFixture.swift b/Packages/AsterismCore/Sources/AsterismCore/M4PerformanceFixture.swiftindex c863230..02ccebe 100644--- a/Packages/AsterismCore/Sources/AsterismCore/M4PerformanceFixture.swift+++ b/Packages/AsterismCore/Sources/AsterismCore/M4PerformanceFixture.swift@@ -313,9 +313,10 @@ extension LibraryRepository {         func attach(_ entry: Entry, to work: Work?) {             guard let work else { return }             entry.work = work-            entry.workAssignmentProvenance = .pattern-            entry.workPatternID = activePattern.id-            entry.workPatternVersion = activePattern.version+            entry.editCitations {+                $0.workAssignment = .pattern(+                    CitedRule(id: activePattern.id, version: activePattern.version))+            }         }          // 50 Work sets: two Works sharing one parsed title (§2.4's title arm —

diff --git a/Packages/AsterismCore/Sources/AsterismCore/MembershipReconciler.swift b/Packages/AsterismCore/Sources/AsterismCore/MembershipReconciler.swiftindex bb399f2..5fddf28 100644--- a/Packages/AsterismCore/Sources/AsterismCore/MembershipReconciler.swift+++ b/Packages/AsterismCore/Sources/AsterismCore/MembershipReconciler.swift@@ -121,10 +121,10 @@ enum MembershipReconciler {      /// The `(work, hostname)` pair Req 1.1 forbids twice over.     ///-    /// Internal, and the package's only one: `V8PopulationPass` and-    /// `BackupArchiveProjection` each declared their own copy of the same two-    /// fields for the same group-by. One key, so a change to what "one-    /// membership" means cannot land in two of the three places.+    /// Internal, and the package's only one: `BackupArchiveProjection` used to+    /// declare its own copy of the same two fields for the same group-by. One+    /// key, so a change to what "one membership" means cannot land in two+    /// places.     struct Key: Hashable {         var workID: UUID         var hostname: String@@ -139,25 +139,11 @@ enum MembershipReconciler {     /// (Req 2.6) still write the same date.     static let healStep: TimeInterval = 0.001 -    /// Mirrors the superseded columns of every Work a phase wrote to-    /// (Decision 4).-    ///-    /// A phase that adds, re-attaches or deletes a membership can change which-    /// one is *primary*, and the columns mirror the primary. Left unrefreshed-    /// they name a site the Work may no longer be on first, which-    /// `BackupArchiveProjection` reads for the identity half of a Work record-    /// and `BackupArchiveReferenceChecks` then refuses — a reconcile that-    /// repaired the graph would have broken the export.-    private static func refreshColumns(-        of works: [UUID: Work],-        saveStrategy: any RepositorySaveStrategy,-        context: ModelContext-    ) throws {-        guard !works.isEmpty else { return }-        var dirty = false-        for work in works.values where LegacyColumns.refreshMembership(on: work) { dirty = true }-        if dirty { try saveStrategy.save(context) }-    }+    // `refreshColumns` stood here: after every phase that could change which+    // membership is *primary*, it mirrored that membership back into the six+    // superseded Work columns, because `BackupArchiveProjection` read a Work+    // record's identity out of them. Both halves went at V9 — the projection+    // reads the membership, and nothing writes the columns at all.      // MARK: - Phase 0: re-attach (Q37) @@ -184,7 +170,6 @@ enum MembershipReconciler {             worksByID[work.id, default: []].append(work)         } -        var touched: [UUID: Work] = [:]         var unarrived: Set<UUID> = []         for chunk in LibraryRepository.chunks(of: orphans, size: batchSize) {             var dirty = false@@ -196,14 +181,12 @@ enum MembershipReconciler {                     continue                 }                 membership.work = work-                touched[work.id] = work                 report.reattached += 1                 report.touchedHostnames.insert(membership.hostname)                 dirty = true             }             if dirty { try saveStrategy.save(context) }         }-        try refreshColumns(of: touched, saveStrategy: saveStrategy, context: context)         return unarrived     } @@ -224,7 +207,7 @@ enum MembershipReconciler {     /// already carries it, so a heal would *tie* with it and the `(createdAt,     /// id)` order that decides the primary would fall through to two random     /// UUIDs. A heal that won that toss would move the site the Work is-    /// presented under (Req 6.4), move what the superseded columns mirror, and+    /// presented under (Req 6.4) and     /// hand the export a Work record whose identity half names one site and     /// whose hostname names another. So the heal takes the **latest** date the     /// Work's memberships already hold, one `healStep` on: a repair joins the@@ -268,7 +251,6 @@ enum MembershipReconciler {         // declared escaping because the rows this inserts are memberships, which         // the Entry enumeration does not read.         var pending = 0-        var touched: [UUID: Work] = [:]         var inserted: [WorkSiteMembership] = []         try context.enumerate(             FetchDescriptor<Entry>(), batchSize: batchSize, allowEscapingMutations: true@@ -278,7 +260,6 @@ enum MembershipReconciler {             // membership per `(work, hostname)` however many Entries ask.             guard held.insert(Key(workID: work.id, hostname: entry.hostname)).inserted             else { return }-            touched[work.id] = work             let membership = WorkSiteMembership(                 hostname: entry.hostname,                 createdAt: healCreatedAt(for: work),@@ -302,7 +283,6 @@ enum MembershipReconciler {             }         }         if pending > 0 { try saveStrategy.save(context) }-        try refreshColumns(of: touched, saveStrategy: saveStrategy, context: context)         return inserted     } @@ -311,7 +291,7 @@ enum MembershipReconciler {     /// only case where a healed row is legitimately the primary, because it is     /// the only one.     private static func healCreatedAt(for work: Work) -> Date {-        guard let latest = work.membershipValues.map(\.createdAt).max() else {+        guard let latest = (work.siteMemberships ?? []).map(\.createdAt).max() else {             return work.createdAt         }         return max(latest, work.createdAt).addingTimeInterval(healStep)@@ -350,11 +330,9 @@ enum MembershipReconciler {         }          var losers: [WorkSiteMembership] = []-        var touched: [UUID: Work] = [:]         for (key, rows) in groups where rows.count > 1 {             losers.append(contentsOf: survivorFirst(rows).dropFirst())             report.touchedHostnames.insert(key.hostname)-            if let work = rows.compactMap(\.work).first { touched[work.id] = work }         }         guard !losers.isEmpty else { return } @@ -365,7 +343,6 @@ enum MembershipReconciler {             }             try saveStrategy.save(context)         }-        try refreshColumns(of: touched, saveStrategy: saveStrategy, context: context)     }      /// Q23's order: the strongest identity state first, then the earliest

diff --git a/Packages/AsterismCore/Sources/AsterismCore/Models.swift b/Packages/AsterismCore/Sources/AsterismCore/Models.swiftindex b2f88a5..abd9f74 100644--- a/Packages/AsterismCore/Sources/AsterismCore/Models.swift+++ b/Packages/AsterismCore/Sources/AsterismCore/Models.swift@@ -1,34 +1,35 @@ import Foundation import SwiftData -// The live model classes are V8's, nested inside `AsterismSchemaV8` (Decision 6,+// The live model classes are V9's, nested inside `AsterismSchemaV9` (Decision 6, // Q20). Top-level typealiases keep every call site (`Entry`, `Site`, …) unchanged. //-// The nesting is what makes the frozen `AsterismSchemaV5`, `AsterismSchemaV6`-// and `AsterismSchemaV7` snapshots possible: they carry nested classes with the-// same SwiftData entity names, which is legal only while there is exactly one-// *top-level* `@Model` per entity name — and there are none, because every-// top-level name here is a typealias. Two top-level `@Model`s sharing an entity-// name crash `ModelContext` (`docs/agent-notes/schema-migration.md`).-public typealias Entry = AsterismSchemaV8.Entry-public typealias Work = AsterismSchemaV8.Work-public typealias Site = AsterismSchemaV8.Site-public typealias TitlePattern = AsterismSchemaV8.TitlePattern-public typealias URLRulePattern = AsterismSchemaV8.URLRulePattern-public typealias WorkTypeEntity = AsterismSchemaV8.WorkTypeEntity+// The nesting is what makes the frozen `AsterismSchemaV8` snapshot possible: it+// carries nested classes with the same SwiftData entity names, which is legal+// only while there is exactly one *top-level* `@Model` per entity name — and+// there are none, because every top-level name here is a typealias. Two+// top-level `@Model`s sharing an entity name crash `ModelContext`+// (`docs/agent-notes/schema-migration.md`).+public typealias Entry = AsterismSchemaV9.Entry+public typealias Work = AsterismSchemaV9.Work+public typealias Site = AsterismSchemaV9.Site+public typealias TitlePattern = AsterismSchemaV9.TitlePattern+public typealias URLRulePattern = AsterismSchemaV9.URLRulePattern+public typealias WorkTypeEntity = AsterismSchemaV9.WorkTypeEntity /// V8: a Work's presence on one site (Q3). One row per hostname, carrying that-/// site's URL identity, the rule that derived it and the confirmed Work URL.-public typealias WorkSiteMembership = AsterismSchemaV8.WorkSiteMembership+/// site's URL identity, the rule that derived it and the confirmed Work URL —+/// and since V9 the only home any of them has.+public typealias WorkSiteMembership = AsterismSchemaV9.WorkSiteMembership /// V8: a reader's "not the same work" over an unordered pair of Works (Q20).-public typealias WorkDistinctPair = AsterismSchemaV8.WorkDistinctPair+public typealias WorkDistinctPair = AsterismSchemaV9.WorkDistinctPair // `Character` is deliberately **not** aliased at the top level: the stdlib owns // that name, and shadowing it module-wide would silently retype every // `[Character]` in `MarkdownExport` and `HTMLEntityDecoder` — and every one a // future file writes. The SwiftData entity is still named "Character" (that is // the nested class's name, and what the CloudKit record type and the archive // key on); only the Swift spelling call sites use is qualified.-public typealias CharacterRecord = AsterismSchemaV8.Character-public typealias CharacterSuppression = AsterismSchemaV8.CharacterSuppression+public typealias CharacterRecord = AsterismSchemaV9.Character+public typealias CharacterSuppression = AsterismSchemaV9.CharacterSuppression  /// The presentation-enum tolerance policy for the **model accessors**, in one /// place (Q2).@@ -70,416 +71,6 @@ internal enum ToleratedEnum {     } } -/// The **only** reader of the columns V8 superseded (Decision 3, Q34).-///-/// V8 stops using `Work`'s six site/identity/URL columns, `Entry`'s-/// `identityKeyVersion` and seventeen citation columns, and `TitlePattern`'s ten-/// definition columns — but it cannot drop them, because the lightweight stage-/// runs inside `ModelContainer.init` and would destroy the source before-/// `V8PopulationPass` could read it. Column names cannot change either: a rename-/// *is* a schema change.-///-/// So the mechanism is access control plus one reader. Each superseded column is-/// `internal`, which makes any reference from the app or extension targets a-/// compile error (the precedent is `Site.works`/`Site.entries`), and inside the-/// package these three functions are where they are read. `ModelContractTests`-/// pins both halves: a source grep that no other file names them, and a-/// `Schema(...).entities` check that every one is still in the V8 schema, so the-/// V9 drop has something to drop.-///-/// Every read function is pure and returns the V8 value the columns encode. They-/// serve `V8PopulationPass` and the nil-blob fallbacks, so an Entry or-/// TitlePattern written by a lagging V7 device (Req 2.7) is never read as empty.-/// The two `rewrite` helpers and `refreshCitations` are the transitional writers-/// Decision 4 leaves here, and go with the columns in V9.-enum LegacyColumns {--    /// A Work's site presence as the six superseded columns hold it — the-    /// content of the single `WorkSiteMembership` the population pass mints for-    /// it (Req 2.1).-    struct Membership: Equatable, Sendable {-        var hostname: String-        var createdAt: Date-        var urlIdentity: String?-        var urlIdentityState: WorkURLIdentityState-        /// The rule UUID only: memberships cite by identity, never by version-        /// (Req 10.4, Q28), so the retired `urlIdentityRuleVersion` is dropped-        /// here rather than carried into V8.-        var urlIdentityRuleID: UUID?-        var workURLString: String?-    }--    static func membership(from work: Work) -> Membership {-        Membership(-            hostname: work.siteHostname,-            createdAt: work.createdAt,-            urlIdentity: work.urlIdentity,-            urlIdentityState: ToleratedEnum.read(work.urlIdentityStateRaw, default: .none),-            urlIdentityRuleID: work.urlIdentityRuleID,-            workURLString: work.workURLString)-    }--    /// The Site row a migrated membership pins to, mirroring what `Work.site`-    /// held. Kept here because `Work.site` is one of the superseded columns.-    static func site(from work: Work) -> Site? { work.site }--    /// The identity-state column **exactly as stored**, which `Membership`-    /// cannot carry: it reads the column through `ToleratedEnum` (Q2), and a-    /// spelling this build has no case for therefore arrives as `.none`. The-    /// 6/7 export refuses such a row by name rather than archiving a value the-    /// store does not hold (Q8), so it needs the raw string.-    static func urlIdentityStateRaw(from work: Work) -> String { work.urlIdentityStateRaw }--    /// Writes that column **raw**, which `update` cannot: `Membership` types the-    /// state, so a spelling this build has no case for has no way through it.-    /// The tolerance suite writes one on purpose.-    static func setURLIdentityStateRaw(_ raw: String, on work: Work) {-        work.urlIdentityStateRaw = raw-    }--    /// The write door for the six superseded columns, mirroring-    /// `membership(from:)` in the other direction.-    ///-    /// The columns are `fileprivate` on `Work` (Q59), so this and `setSite` are-    /// the only ways to write them from anywhere — including from a `@testable`-    /// suite, which `fileprivate` shuts out exactly as it shuts out the app.-    /// Since task 21 the only writers are the fixtures that seed a V7-shaped-    /// Work: the 6/7 import mapper went with its format, and every production-    /// write now lands on the membership with `refreshMembership` mirroring it-    /// back. `createdAt` is not written back: it belongs to the Work, and-    /// `Membership` only carries it so a minted membership can copy it.-    static func update(_ work: Work, _ edit: (inout Membership) -> Void) {-        var value = membership(from: work)-        edit(&value)-        work.siteHostname = value.hostname-        work.urlIdentity = value.urlIdentity-        work.urlIdentityStateRaw = value.urlIdentityState.rawValue-        work.urlIdentityRuleID = value.urlIdentityRuleID-        work.workURLString = value.workURLString-    }--    /// `Work.site` alone: `Membership` cannot carry it, because a `Site` is a-    /// model reference and `Membership` is a `Sendable` value.-    static func setSite(_ site: Site?, on work: Work) { work.site = site }--    /// Mirrors the Work's **primary** membership back into the six superseded-    /// site/identity/URL columns, and reports whether anything moved.-    ///-    /// The Work counterpart of `refreshCitations`, and the same bargain-    /// (Decision 4): from tasks 12-13 the membership is the source of truth for a-    /// Work's site presence, URL identity and confirmed Work URL, and the columns-    /// are a derived mirror kept in step beside it until V9 drops them.-    ///-    /// The mirror is the *primary* membership — the first in membership order —-    /// because the columns are single-site by construction and that is the site-    /// every legacy reader means by "the Work's site". A second membership's-    /// identity and URL live only on the membership, which is exactly the-    /// difference V8 exists to represent; the readers that still consult the-    /// columns (`GroupOrdering`'s authored content and row ordering,-    /// `DuplicateScan`, `LibraryDiagnostics`) therefore see a multi-site Work as-    /// its primary site, and move to the memberships with their own tasks.-    ///-    /// `urlIdentityRuleVersion` is mirrored too, and it is the one field the-    /// membership cannot hand over: a membership cites by UUID alone (Req 10.4,-    /// Q28), so the version is **resolved** from the rule rows of the primary-    /// membership's own Site (Q60). Three arms, because a version that does not-    /// describe the cited rule is what `LibraryValidator`'s `.rule` arm and-    /// `BackupArchiveReferenceChecks` refuse over:-    ///-    /// * no rule cited — the column is cleared, as `applyURLIdentity` clears it;-    /// * the cited row is there — the column takes its version;-    /// * the cited row is **not** there (Q54's dangling citation, or a Site this-    ///   membership was never pinned to) — the column is left alone where the-    ///   citation has not moved, and cleared where it has, because the version-    ///   then describes a rule nothing cites any more.-    ///-    /// - Parameter memberships: the rows to mirror from, where the caller knows-    ///   better than the inverse array does. A commit that has *deleted* rows-    ///   and not yet saved is the case: `work.siteMemberships` can still hand-    ///   them back, and mirroring a row that is on its way out is how a removal-    ///   leaves the columns naming the site it just removed. Nil reads the-    ///   Work's own memberships, which is right everywhere else.-    @discardableResult-    static func refreshMembership(-        on work: Work, memberships: [WorkSiteMembership]? = nil-    ) -> Bool {-        let primary = (memberships.map(Work.membershipOrder) ?? work.membershipValues).first-        let hostname = primary?.hostname ?? work.siteHostname-        let priorRuleID = work.urlIdentityRuleID-        var changed = false-        func assign<Value: Equatable>(_ keyPath: ReferenceWritableKeyPath<Work, Value>, _ value: Value) {-            guard work[keyPath: keyPath] != value else { return }-            work[keyPath: keyPath] = value-            changed = true-        }-        assign(\.siteHostname, hostname)-        assign(\.urlIdentity, primary?.urlIdentity)-        assign(\.urlIdentityStateRaw, (primary?.urlIdentityState ?? .none).rawValue)-        assign(\.urlIdentityRuleID, primary?.urlIdentityRuleID)-        assign(\.workURLString, primary?.workURLString)-        if let ruleID = primary?.urlIdentityRuleID {-            if let version = primary?.site?.urlRuleValues.first(where: { $0.id == ruleID })?.version {-                assign(\.urlIdentityRuleVersion, version)-            } else if ruleID != priorRuleID {-                assign(\.urlIdentityRuleVersion, nil)-            }-        } else {-            assign(\.urlIdentityRuleVersion, nil)-        }-        if let site = primary?.site, work.site !== site {-            work.site = site-            changed = true-        }-        return changed-    }--    static func citations(from entry: Entry) -> EntryCitations {-        let identityURL = CitedRule(-            id: entry.identityURLRuleID, version: entry.identityURLRuleVersion)-        let nameTitle = CitedRule(-            id: entry.identityNameTitleRuleID, version: entry.identityNameTitleRuleVersion)-        let identity: EntryCitations.Identity-        switch (entry.identityKeyVersion, identityURL) {-        case (2, .some(let url)): identity = .rule(url: url, nameTitle: nameTitle)-        case (3, .some(let url)): identity = .composed(url: url, nameTitle: nameTitle)-        default: identity = .rawURL-        }--        let workPattern = CitedRule(id: entry.workPatternID, version: entry.workPatternVersion)-        let workURL = CitedRule(id: entry.workURLRuleID, version: entry.workURLRuleVersion)-        let assignmentKind: FieldProvenanceKind = ToleratedEnum.read(-            entry.workAssignmentProvenanceRaw, default: .none)-        // **One rule, applied everywhere** (Q39): the stored kind picks the arm,-        // the arm reads only its own citation column, and an arm whose citation-        // is absent degrades to `.none`. A citation belonging to another arm —-        // a work pattern under `.manual`, a work URL rule under `.pattern` — is-        // dropped, because only a partial write produces one and the columns-        // still hold it until V9. The identity switch above says the same thing-        // in the same words: the key version picks the arm, and an arm with no-        // cited URL rule degrades to `.rawURL`.-        let assignment: EntryCitations.WorkAssignment-        switch assignmentKind {-        case .none:-            assignment = .none-        case .manual:-            assignment = .manual-        case .urlRule:-            assignment = workURL.map { .urlRule($0) } ?? .none-        case .pattern:-            assignment = workPattern.map { .pattern($0) } ?? .none-        }--        return EntryCitations(-            identity: identity,-            urlWork: CitedRule(id: entry.urlWorkRuleID, version: entry.urlWorkRuleVersion),-            chapterSequence: CitedRule(-                id: entry.chapterSequenceRuleID, version: entry.chapterSequenceRuleVersion),-            chapterTitle: FieldProvenance.tolerant(-                kind: ToleratedEnum.read(entry.chapterTitleProvenanceRaw, default: .none),-                patternID: entry.chapterPatternID,-                patternVersion: entry.chapterPatternVersion),-            workAssignment: assignment,-            workURL: workURL,-            workURLAssignmentKind: ToleratedEnum.read(entry.workURLAssignmentKindRaw))-    }--    /// Writes an `EntryCitations` value **into the columns**, then refreshes the-    /// blob from them so the two homes agree by construction.-    ///-    /// The one caller is the archive import (task 21): a 7/8 record carries the-    /// blob and nothing else, and every remaining column reader would otherwise-    /// see the pre-import citations on a row the import just rewrote. Going-    /// value → columns → blob rather than value → blob directly is deliberate —-    /// `citations(from:)` is where Q39's normalisation lives, so a record whose-    /// arms disagree lands in exactly the state a column writer would have-    /// produced, and `refreshCitations` states the invariant once for every-    /// writer there is.-    static func applyCitations(_ citations: EntryCitations, on entry: Entry) {-        entry.identityKeyVersion = citations.identity.keyVersion-        entry.identityURLRuleID = citations.identity.urlRule?.id-        entry.identityURLRuleVersion = citations.identity.urlRule?.version-        entry.identityNameTitleRuleID = citations.identity.nameTitleRule?.id-        entry.identityNameTitleRuleVersion = citations.identity.nameTitleRule?.version-        entry.urlWorkRuleID = citations.urlWork?.id-        entry.urlWorkRuleVersion = citations.urlWork?.version-        entry.chapterSequenceRuleID = citations.chapterSequence?.id-        entry.chapterSequenceRuleVersion = citations.chapterSequence?.version-        entry.chapterTitleProvenanceRaw = citations.chapterTitle.kind.rawValue-        entry.chapterPatternID = citations.chapterTitle.patternID-        entry.chapterPatternVersion = citations.chapterTitle.patternVersion-        entry.workAssignmentProvenanceRaw = citations.workAssignment.provenanceKind.rawValue-        entry.workPatternID = citations.workAssignment.patternRule?.id-        entry.workPatternVersion = citations.workAssignment.patternRule?.version-        // The assignment's `.urlRule` arm and `workURL` are one column pair, so-        // an arm carrying a citation the blob's own `workURL` does not is-        // written from the arm rather than lost.-        let workURL = citations.workAssignment.urlRuleRule ?? citations.workURL-        entry.workURLRuleID = workURL?.id-        entry.workURLRuleVersion = workURL?.version-        entry.workURLAssignmentKindRaw = citations.workURLAssignmentKind?.rawValue-        refreshCitations(on: entry)-    }--    /// Re-encodes the citation blob from the columns, and reports whether the-    /// bytes moved.-    ///-    /// **The invariant is "columns written ⇒ blob refreshed"**, and it is held at-    /// the write site because it has to hold *inside* a commit (Decision 4).-    /// Through phase 1 every citation writer in the repository writes the-    /// columns; `Entry.citations` reads the blob wherever one exists and only-    /// falls back to the columns while it is nil (Q36). A commit that wrote the-    /// columns and left an existing blob alone would therefore hand its own-    /// validation the *pre-write* citations against post-write values — which is-    /// a re-teach refused on a library that had just migrated cleanly. The-    /// population pass converges the two homes as well, but only between-    /// commits, which is too late for the commit that caused the divergence.-    ///-    /// Value-guarded, like the pass: a writer that changed nothing dirties no-    /// row. `V8PopulationPass.populateCitations` calls this, so the two homes are-    /// reconciled by one piece of code rather than two spellings of it.-    ///-    /// The writer rewrite task 12 scheduled was not performed (Q68): readers-    /// prefer the blob, the columns stay the write-side source of truth, and-    /// V9 (T-2272) deletes this with the columns.-    @discardableResult-    static func refreshCitations(on entry: Entry) -> Bool {-        let columns = citations(from: entry)-        // Undecodable bytes compare unequal and are replaced, so a row whose-        // blob will not read is repaired rather than left diagnosed for ever.-        if entry.citationsData != nil, (try? entry.citations) == columns { return false }-        do { try entry.setCitations(columns) } catch {-            // Nothing honest to mirror. Dropping the blob is not data loss —-            // the columns still hold every citation, and a nil blob is exactly-            // the state Q36's fallback exists to read.-            entry.citationsData = nil-        }-        return true-    }--    /// Rewrites the cited *versions* in place, in the columns, and reports-    /// whether anything moved.-    ///-    /// **Transitional, and deleted with the columns in V9.** In phase 1 the-    /// columns are still the source of truth for citations (Decision 4): the-    /// validator, the archive projection and the reference checks all resolve a-    /// citation out of them, and the blob is a derived mirror. A rule-version-    /// renumbering that wrote only the blob would therefore leave every one of-    /// those readers citing a version no rule holds — which quarantines the-    /// hostname and refuses the export. So the rewrite lands here-    /// unconditionally, and the blob is kept in step beside it.-    @discardableResult-    static func rewriteVersions(_ rewrites: [UUID: Int], on entry: Entry) -> Bool {-        var changed = false-        func rewrite(_ id: UUID?, _ version: inout Int?) {-            guard let id, let replacement = rewrites[id], version != replacement else { return }-            version = replacement-            changed = true-        }-        rewrite(entry.identityURLRuleID, &entry.identityURLRuleVersion)-        rewrite(entry.identityNameTitleRuleID, &entry.identityNameTitleRuleVersion)-        rewrite(entry.urlWorkRuleID, &entry.urlWorkRuleVersion)-        rewrite(entry.chapterSequenceRuleID, &entry.chapterSequenceRuleVersion)-        rewrite(entry.chapterPatternID, &entry.chapterPatternVersion)-        rewrite(entry.workPatternID, &entry.workPatternVersion)-        rewrite(entry.workURLRuleID, &entry.workURLRuleVersion)-        return changed-    }--    /// The ten definition columns as one value. Throws on a combination that is-    /// not a legal arm, which is what the 55-line getter this replaces did —-    /// substituting a rule the reader never taught did real damage once-    /// (Decision 5 of `library-integrity-tolerance`).-    static func definition(from pattern: TitlePattern) throws -> StoredPatternDefinition {-        guard let form = PatternForm(rawValue: pattern.formRaw) else {-            throw ModelInvariantError.invalidCombination(field: "title pattern form")-        }-        let arm: PatternDefinition-        switch form {-        case .segment:-            guard let work = pattern.segmentWorkAnchor,-                  let ignored = pattern.segmentIgnoredAnchors,-                  pattern.phrasePrefix == nil,-                  pattern.phraseSeparator == nil,-                  pattern.phraseSuffix == nil,-                  pattern.fieldOrderRaw == nil else {-                throw ModelInvariantError.invalidCombination(field: "segment pattern arm")-            }-            arm = pattern.chapterless-                ? try PatternDefinition.chapterlessSegment(work: work, ignored: ignored).validated()-                : try PatternDefinition.segment(work: work, ignored: ignored).validated()-        case .phrase:-            guard pattern.segmentWorkAnchor == nil,-                  pattern.segmentIgnoredAnchors == nil,-                  let prefix = pattern.phrasePrefix,-                  let separator = pattern.phraseSeparator,-                  let suffix = pattern.phraseSuffix,-                  let orderRaw = pattern.fieldOrderRaw,-                  let order = FieldOrder(rawValue: orderRaw) else {-                throw ModelInvariantError.invalidCombination(field: "phrase pattern arm")-            }-            arm = pattern.chapterless-                ? try PatternDefinition.chapterlessPhrase(-                    prefix: prefix, separator: separator, suffix: suffix, order: order).validated()-                : try PatternDefinition.phrase(-                    prefix: prefix, separator: separator, suffix: suffix, order: order).validated()-        case .wholeTitle:-            guard pattern.segmentWorkAnchor == nil,-                  pattern.segmentIgnoredAnchors == nil,-                  pattern.phrasePrefix == nil,-                  pattern.phraseSeparator == nil,-                  pattern.phraseSuffix == nil,-                  pattern.fieldOrderRaw == nil else {-                throw ModelInvariantError.invalidCombination(field: "whole-title pattern arm")-            }-            arm = .wholeTitle-        }-        return StoredPatternDefinition(-            definition: arm, trimPrefix: pattern.trimPrefix, trimSuffix: pattern.trimSuffix)-    }--    /// The ten definition columns as one canonically-encodable value — the-    /// ordering key `GroupOrdering.canonicalDefinition` falls back to for a row-    /// with **no blob** whose columns do not form a legal arm (Q42).-    ///-    /// It lives here rather than in `GroupOrdering` because this enum is the one-    /// sanctioned reader of the retired columns (Q34, Q40) and the only file-    /// `ModelContractTests` lets name them.-    private struct DefinitionColumns: Encodable {-        let formRaw: String-        let segmentWorkAnchor: SegmentRangeSpec?-        let segmentIgnoredAnchors: [SegmentPositionSpec]?-        let phrasePrefix: String?-        let phraseSeparator: String?-        let phraseSuffix: String?-        let fieldOrderRaw: String?-        let trimPrefix: String?-        let trimSuffix: String?-        let chapterless: Bool-    }--    /// Canonically-encoded definition columns, or the empty string where even-    /// that will not encode.-    static func canonicalColumns(of pattern: TitlePattern) -> String {-        let columns = DefinitionColumns(-            formRaw: pattern.formRaw,-            segmentWorkAnchor: pattern.segmentWorkAnchor,-            segmentIgnoredAnchors: pattern.segmentIgnoredAnchors,-            phrasePrefix: pattern.phrasePrefix,-            phraseSeparator: pattern.phraseSeparator,-            phraseSuffix: pattern.phraseSuffix,-            fieldOrderRaw: pattern.fieldOrderRaw,-            trimPrefix: pattern.trimPrefix,-            trimSuffix: pattern.trimSuffix,-            chapterless: pattern.chapterless)-        let encoder = JSONEncoder()-        encoder.outputFormatting = .canonical-        guard let data = try? encoder.encode(columns),-              let text = String(data: data, encoding: .utf8)-        else { return "" }-        return text-    }-}- /// The one place a JSON blob column is turned into a value and back. /// /// Three model properties store a value as JSON bytes — `Entry.citationsData`,@@ -501,7 +92,7 @@ enum JSONBlob {     } } -extension AsterismSchemaV8 {+extension AsterismSchemaV9 {  @Model public final class Entry {@@ -518,41 +109,20 @@ public final class Entry {     /// (Req 1.4).     public var site: Site?     public var entryIdentityKey: String = ""-    internal var identityKeyVersion: Int = 1     /// M4 secondary lookup index: the conservative (v1) key for this Entry's raw     /// URL, retained even after an S-rule rewrites `entryIdentityKey` to v3 so a     /// title-less same-URL re-share still matches (Q21). Backfilled at migration.     public var conservativeIdentityKey: String = ""     public var identityBasisRaw: String = EntryIdentityBasis.conservative.rawValue-    internal var identityURLRuleID: UUID?-    internal var identityURLRuleVersion: Int?-    /// M4 sequence+name (v3) basis: the active title rule that contributed the-    /// Work name embedded in a v3 identity key (Req 4.2's dual-contributor-    /// provenance). Nil for conservative and identity+sequence bases.-    internal var identityNameTitleRuleID: UUID?-    internal var identityNameTitleRuleVersion: Int?     public var urlWorkIdentity: String?-    internal var urlWorkRuleID: UUID?-    internal var urlWorkRuleVersion: Int?     public var chapterSequence: String?-    internal var chapterSequenceRuleID: UUID?-    internal var chapterSequenceRuleVersion: Int?     public var chapterTitle: String?-    internal var chapterTitleProvenanceRaw: String = FieldProvenanceKind.none.rawValue-    internal var chapterPatternID: UUID?-    internal var chapterPatternVersion: Int?     public var note: String = ""     public var ratingRaw: String?     public var firstCapturedAt: Date = Date(timeIntervalSince1970: 0)     public var lastSharedAt: Date = Date(timeIntervalSince1970: 0)     public var modifiedAt: Date = Date(timeIntervalSince1970: 0)     public var work: Work?-    internal var workAssignmentProvenanceRaw: String = FieldProvenanceKind.none.rawValue-    internal var workPatternID: UUID?-    internal var workPatternVersion: Int?-    internal var workURLRuleID: UUID?-    internal var workURLRuleVersion: Int?-    internal var workURLAssignmentKindRaw: String?     public var intentionallyUnattached: Bool = false     /// V7: the fingerprint of the note text a character-extraction pass last     /// covered (Q59). A **derived** field, excluded from authored content the@@ -561,13 +131,15 @@ public final class Entry {     /// Nil means the note has never been covered.     public var characterExtractionFingerprint: String?     /// V8: the Entry's seven rule citations and its identity basis, as one-    /// `EntryCitations` blob (Q25) — the column that supersedes-    /// `identityKeyVersion` and the seventeen citation/provenance columns above.+    /// `EntryCitations` blob (Q25) — the column that superseded+    /// `identityKeyVersion` and the seventeen citation/provenance columns V9+    /// dropped, and now the **only** home any of them has.     ///-    /// Nil means the row has not been through `V8PopulationPass` yet: either a-    /// V7 library mid-migration, or a row a lagging V7 device synced in-    /// afterwards (Req 2.7). `citations` falls back to the legacy columns in-    /// that state (Q36), so a nil blob is never read as "no citations".+    /// Every writer writes it and `init` seeds it, so nil means one thing: a row+    /// a V8 build wrote that this build has not rewritten. It reads as the+    /// default rather than throwing (Q6) and `entriesWithoutCitationBlobCount`+    /// counts it — a **report**, not a quarantine (Q25): the validator throws on+    /// bytes that will not decode and says nothing about bytes that are absent.     public var citationsData: Data?      public init(@@ -603,6 +175,16 @@ public final class Entry {         lastSharedAt = capturedAt ?? timestamp         modifiedAt = timestamp         self.work = work+        // **Every code path that creates an Entry writes the blob at creation**+        // (V9 Req 4). Since the blob is the only home a citation has, a row born+        // without one would read as "cites nothing" for the rest of its life+        // rather than as "not converted yet" — so the default value is written+        // here, once, instead of at a dozen construction sites. A nil blob is+        // therefore only ever a row a V8 build wrote and this one has not+        // rewritten, which is exactly the state the validator reports — so the+        // default is encoded once into a constant rather than `try?`d here,+        // where a failed encode would spell itself the same way.+        citationsData = EntryCitations.defaultBlob     }      public var captureTitleSource: CaptureTitleSource {@@ -620,38 +202,88 @@ public final class Entry {         set { identityBasisRaw = newValue.rawValue }     } +    /// The chapter title's provenance kind, **derived from the blob**. Read-only:+    /// the blob stores the whole citation, and a kind written without its cited+    /// rule is a state `EntryCitations` deliberately cannot spell (Q39). Writers+    /// go through `setCitations` or `editCitations`.     public var chapterTitleProvenance: FieldProvenanceKind {-        get { ToleratedEnum.read(chapterTitleProvenanceRaw, default: .none) }-        set { chapterTitleProvenanceRaw = newValue.rawValue }+        citationValues.chapterTitle.kind     } +    /// How this Entry came to be on its Work, derived from the blob. Read-only,+    /// for the reason above.     public var workAssignmentProvenance: FieldProvenanceKind {-        get { ToleratedEnum.read(workAssignmentProvenanceRaw, default: .none) }-        set { workAssignmentProvenanceRaw = newValue.rawValue }+        citationValues.workAssignment.provenanceKind     } +    /// Which half of a URL rule assigned the Work, derived from the blob.     public var workURLAssignmentKind: URLWorkAssignmentKind? {-        get { ToleratedEnum.read(workURLAssignmentKindRaw) }-        set { workURLAssignmentKindRaw = newValue?.rawValue }+        citationValues.workURLAssignmentKind     }      /// Everything this Entry cites, as one value (Q25).     ///-    /// Nil bytes fall back to the legacy columns (Q36) rather than reading as-    /// "cites nothing": a row a lagging V7 device syncs in after the migration-    /// (Req 2.7) has its citations in the columns and nowhere else, and the next-    /// reconcile converts it.+    /// Nil bytes read as the default — identity `.rawURL`, nothing cited (Q6).+    /// A nil blob means a row a V8 build wrote and V9 has not rewritten; it is+    /// reported by the validator and counted by the diagnosis, but an ordinary+    /// read of one must not throw or a single exposed row would fail a screen.     ///     /// Throws on bytes that will not decode, as `URLRulePattern.definition`     /// does; the validator turns that into a reportable per-row state rather     /// than a substituted value.     public var citations: EntryCitations {         get throws {-            guard let citationsData else { return LegacyColumns.citations(from: self) }+            guard let citationsData else { return EntryCitations() }             return try JSONBlob.decode(EntryCitations.self, from: citationsData)         }     } +    /// Whether the row carries **no** citation bytes at all, as against bytes+    /// that decode to the default. The two read the same and are a different+    /// fact: the second is what a writer wrote, the first is a row the V8 → V9+    /// drop stage reached before anything converted it (Q6). The validator, the+    /// diagnosis and the counter all ask this question, so they ask it once.+    public var citationsAreAbsent: Bool { citationsData == nil }++    /// The citations as every ordinary reader wants them: bytes that will not+    /// decode read as the default rather than throwing, which is the same+    /// tolerance the enum columns had (Q2). The validator is the one caller that+    /// wants the throw, and it uses `citations`.+    public var citationValues: EntryCitations {+        (try? citations) ?? EntryCitations()+    }++    /// Reads the citations, applies `edit`, and writes them back — the door for+    /// a writer that owns some arms of the blob and must leave the rest alone.+    ///+    /// **Bytes that will not decode are repaired in place** (Q24): the edit is+    /// applied over the default value and written, which is what the retired+    /// column-derived refresh did — it replaced bytes that would not decode+    /// rather than leaving them diagnosed for ever. Skipping the write+    /// instead would land the caller's *surrounding* write (a manual+    /// assignment, a re-teach) with its provenance stuck at `.none`, which is a+    /// state the validator refuses on the next save. What the row loses is the+    /// citations nothing could read anyway.+    ///+    /// **A nil blob is not undecodable** (Q23). It reads as the default, so a+    /// real edit over one is written and a no-op edit over one leaves it nil —+    /// which is what keeps `entriesWithoutCitationBlobCount` meaning something+    /// after `SiteReconciler.rewriteCitations` has walked every Entry.+    ///+    /// Value-guarded, so a writer that changed nothing dirties no row.+    @discardableResult+    public func editCitations(_ edit: (inout EntryCitations) -> Void) -> Bool {+        let decoded = try? citations+        var edited = decoded ?? EntryCitations()+        edit(&edited)+        // Undecodable bytes: always write, even where the edit produced the+        // default — the point of the write is that the row stops being+        // unreadable.+        if let current = decoded, edited == current { return false }+        do { try setCitations(edited) } catch { return false }+        return true+    }+     /// Writes the citations, leaving the stored bytes untouched when encoding     /// fails (Req 4.6) — the `URLRulePattern.setDefinition` guarantee.     public func setCitations(_ citations: EntryCitations) throws {@@ -673,27 +305,7 @@ public final class Work {     public var id: UUID = UUID()     public var displayTitle: String = ""     public var lastParsedTitle: String?-    fileprivate var siteHostname: String = ""-    /// M4a: the Site this Work belongs to, as a modelled reference (Req 1.1).-    /// `siteHostname` stays beside it as capture-time evidence (Q3). Same-    /// nil-tolerance and same-save rule as `Entry.site`.-    ///-    /// **Retained legacy column** (Decision 3): superseded by-    /// `WorkSiteMembership.site` and dropped in V9.-    fileprivate var site: Site?-    fileprivate var urlIdentity: String?-    fileprivate var urlIdentityStateRaw: String = WorkURLIdentityState.none.rawValue-    fileprivate var urlIdentityRuleID: UUID?-    internal var urlIdentityRuleVersion: Int?-    fileprivate var workURLString: String?     public var genericNotes: String = ""-    /// The **compatibility** type column pre-feature builds read and write-    /// (Decision 4). An updated build writes only `WorkType.other` here for a-    /// configured assignment or an untype (Req 6.11), so any other value proves a-    /// pre-feature build wrote it afterwards — which is what makes Req 6.10-    /// detectable. Never read it directly to decide a work's type: derive the-    /// assignment through `WorkTypeAssignment.assignment(of:)`.-    internal var typeRaw: String = WorkType.other.rawValue     /// V6: the `WorkTypeEntity` this Work is assigned, cited by UUID rather than     /// modelled as a relationship (Decision 8 — an inverse would fault every     /// Work assigned a type, the Q17 fan-out at larger scale). A dangling value@@ -735,10 +347,13 @@ public final class Work {     /// mints the row and its first membership together. This initializer is the     /// inside of that door, reachable from the package (and from `@testable`     /// suites modelling a Req 2.7 membership-less arrival) and from nowhere else.-    init(id: UUID = UUID(), displayTitle: String, siteHostname: String, timestamp: Date) {+    ///+    /// It takes no hostname since V9: `siteHostname` was the last column a+    /// Work's site presence had outside its `WorkSiteMembership`, and the row+    /// that carries it is minted by `createCarrying` in the same call.+    init(id: UUID = UUID(), displayTitle: String, timestamp: Date) {         self.id = id         self.displayTitle = displayTitle-        self.siteHostname = siteHostname         createdAt = timestamp         modifiedAt = timestamp     }@@ -748,15 +363,6 @@ public final class Work {         set { titleProvenanceRaw = newValue.rawValue }     } -    /// **`fileprivate` with its column** (Q59): a live accessor on a superseded-    /// column is a reader of that column, and Decision 3 leaves none. The V8-    /// value is `WorkSiteMembership.urlIdentityState`; what the column still-    /// holds reads through `LegacyColumns.membership(from:)`.-    fileprivate var urlIdentityState: WorkURLIdentityState {-        get { ToleratedEnum.read(urlIdentityStateRaw, default: .none) }-        set { urlIdentityStateRaw = newValue.rawValue }-    }-     public var entryValues: [Entry] { entries ?? [] }     public var characterValues: [Character] { characters ?? [] }     public var characterSuppressionValues: [CharacterSuppression] { characterSuppressions ?? [] }@@ -768,15 +374,31 @@ public final class Work {         Self.membershipOrder(siteMemberships ?? [])     } +    /// The **primary** membership: the first row in `membershipValues`, found+    /// without sorting the rest.+    ///+    /// `GroupOrdering` reads this once per Work on a path every write takes+    /// (Q18), and `membershipValues.first` charged that read a whole sort to+    /// answer a question `min` answers in one pass.+    public var primaryMembership: WorkSiteMembership? {+        (siteMemberships ?? []).min(by: Self.membershipPrecedes)+    }+     /// Req 1.2's order over an explicit set of rows, for the callers that hold     /// one — a commit that has deleted a membership and not yet saved cannot     /// trust the inverse array to have dropped it.     static func membershipOrder(_ rows: [WorkSiteMembership]) -> [WorkSiteMembership] {-        rows.sorted {-            $0.createdAt == $1.createdAt-                ? $0.id.uuidString < $1.id.uuidString-                : $0.createdAt < $1.createdAt-        }+        rows.sorted(by: membershipPrecedes)+    }++    /// Req 1.2's comparison itself, so the order and the `min` that picks its+    /// first element cannot disagree about which membership is primary.+    private static func membershipPrecedes(+        _ lhs: WorkSiteMembership, _ rhs: WorkSiteMembership+    ) -> Bool {+        lhs.createdAt == rhs.createdAt+            ? lhs.id.uuidString < rhs.id.uuidString+            : lhs.createdAt < rhs.createdAt     }      /// The membership for `hostname`, or nil where the Work holds none.@@ -826,22 +448,12 @@ public final class Site {     /// `entryValues` accessor exists, for the same reason.     @Relationship(deleteRule: .nullify, inverse: \Entry.site)     var entries: [Entry]?-    /// Inverse of `Work.site`. Same reasoning as `entries` — internal, no-    /// convenience accessor (Q17).-    @Relationship(deleteRule: .nullify, inverse: \Work.site)-    var works: [Work]?     /// V8: inverse of `WorkSiteMembership.site`, present because CloudKit     /// requires every relationship to have one. Internal for the same reason     /// `works` is (Q17): traversing it faults every membership for a hostname,     /// and the repository fetches memberships by predicate instead.     @Relationship(deleteRule: .nullify, inverse: \WorkSiteMembership.site)     var workMemberships: [WorkSiteMembership]?-    /// A format-2 era column that is now permanently nil: `LibraryValidator`-    /// requires it absent in every live store, and the legacy mapping that was-    /// once meant to migrate it into historical `URLRulePattern` records went-    /// with the retired import paths. It stays because dropping a column is a-    /// schema version, not an edit.-    internal var urlIdentityRule: URLIdentityRule?     public var junkSuffixRule: JunkSuffixRule?      public init(hostname: String, displayName: String? = nil) {@@ -873,28 +485,15 @@ public final class TitlePattern {     public var version: Int = 1     public var isActive: Bool = false     public var createdAt: Date = Date(timeIntervalSince1970: 0)-    internal var formRaw: String = PatternForm.segment.rawValue-    internal var segmentWorkAnchor: SegmentRangeSpec?-    internal var segmentIgnoredAnchors: [SegmentPositionSpec]?-    internal var phrasePrefix: String?-    internal var phraseSeparator: String?-    internal var phraseSuffix: String?-    internal var fieldOrderRaw: String?-    /// M4: exact leading affix trimmed from the capture title before parsing or-    /// whole-title naming (Req 3.1); nil = no leading trim. Applied fail-open.-    internal var trimPrefix: String?-    /// M4: exact trailing affix trimmed from the capture title before parsing or-    /// whole-title naming (Req 3.1); nil = no trailing trim. Applied fail-open.-    internal var trimSuffix: String?-    /// M4: discriminates the chapter-less segment/phrase arms from their-    /// ordinary counterparts, which share the same `formRaw` and columns.-    internal var chapterless: Bool = false     /// V8: the pattern's whole definition surface — the arm *and* both trims —-    /// as one `StoredPatternDefinition` blob (Q25), the column that supersedes-    /// the ten decomposed columns above.+    /// as one `StoredPatternDefinition` blob (Q25), and since V9 the only home+    /// it has: the ten decomposed columns it superseded are gone.     ///-    /// Nil means the row has not been through `V8PopulationPass` yet;-    /// `storedDefinition` falls back to the legacy columns in that state (Q36).+    /// Nil means a row a V8 build wrote that nothing has rewritten since; no+    /// pass converts one, because the ten columns it would be derived from are+    /// gone. `storedDefinition` throws for one, the validator reports it as+    /// `unreadableTitlePattern`, and `GroupOrdering` gives it its own constant+    /// ordering key (Q11).     public var definitionData: Data?     public var site: Site? @@ -953,16 +552,21 @@ public final class TitlePattern {         )     } -    /// The pattern's whole definition surface, read from the blob (Q25) or —-    /// for a row `V8PopulationPass` has not reached — from the ten legacy-    /// columns (Q36).+    /// The pattern's whole definition surface, read from the blob (Q25) — the+    /// only home it has since V9.     ///     /// Throws rather than substituting a rule the reader never taught (Req 4.3),     /// exactly as `URLRulePattern.definition` does and for the same reason: a-    /// fabricated definition validates cleanly and blames the captures.+    /// fabricated definition validates cleanly and blames the captures. **A nil+    /// blob throws for that reason too**: it used to fall back to the ten legacy+    /// columns, and with those unwritten there is nothing behind it. The+    /// validator reports such a row as `unreadableTitlePattern` and+    /// `GroupOrdering` gives it its own constant ordering key (Q11).     public var storedDefinition: StoredPatternDefinition {         get throws {-            guard let definitionData else { return try LegacyColumns.definition(from: self) }+            guard let definitionData else {+                throw ModelInvariantError.invalidCombination(field: "title pattern definition")+            }             return try JSONBlob.decode(StoredPatternDefinition.self, from: definitionData)         }     }@@ -1435,7 +1039,7 @@ public final class WorkDistinctPair {     } } -} // extension AsterismSchemaV8+} // extension AsterismSchemaV9  /// A rule-derived URL identity a creation site already holds, passed through /// `Work.create` so the minted membership is born carrying it (Req 1.3, 3.1).@@ -1499,19 +1103,13 @@ extension Work {         identity: WorkURLIdentityMint?,         timestamp: Date     ) -> Work {-        let work = Work(id: id, displayTitle: title, siteHostname: hostname, timestamp: timestamp)+        // **The membership, and nothing else.** A Work's site presence, URL+        // identity and confirmed URL live on its `WorkSiteMembership` — which is+        // what Req 3.1 matches on and what every reader reads — and since V9+        // there is nowhere else for them to live: the six columns that mirrored+        // them, `siteHostname` included, left the stored shape.+        let work = Work(id: id, displayTitle: title, timestamp: timestamp)         context.insert(work)-        // The retained `Work.site` column is still written here so a V8 library-        // and a V7-migrated one hold the same columns; V9 drops both with the-        // rest of the superseded set (Decision 3).-        work.site = site-        // The identity goes into **both** homes here, for the same reason: a-        // creation site that set the columns afterwards left the membership in-        // state `none`, and the membership is what Req 3.1 matches on.-        work.urlIdentity = identity?.value-        work.urlIdentityState = identity == nil ? .none : .rule-        work.urlIdentityRuleID = identity?.ruleID-        work.urlIdentityRuleVersion = identity?.ruleVersion         let membership = WorkSiteMembership(             id: membershipID, hostname: hostname, createdAt: timestamp,             urlIdentity: identity?.value,@@ -1530,25 +1128,18 @@ extension Work {     /// the whole of Req 3.5 — a two-site Work keeps the other site's identity     /// exactly as it was.     ///-    /// The superseded columns are refreshed from the primary membership beside-    /// it (Decision 4), `urlIdentityRuleVersion` included — `refreshMembership`-    /// resolves that one from the membership's own Site rules (Q60). The write-    /// below is the backstop for the case it cannot resolve: a membership with-    /// no `site` row yet (Req 1.5) has no rules to look the version up in, and-    /// the mint being applied here carries it directly.-    ///     /// A Work holding no membership for the hostname is left alone: the write had     /// no site to land on, and reconciliation heals the membership from the     /// Entries (Req 8.1) before the next pass re-derives it.+    ///+    /// The membership is the only home the identity has since V9; the mirror+    /// into the six superseded columns, and the `urlIdentityRuleVersion`+    /// backstop beside it, went with the mirror.     func applyURLIdentity(_ mint: WorkURLIdentityMint?, on hostname: String) {         guard let membership = membership(for: hostname) else { return }         membership.urlIdentity = mint?.value         membership.urlIdentityState = mint == nil ? .none : .rule         membership.urlIdentityRuleID = mint?.ruleID-        LegacyColumns.refreshMembership(on: self)-        if membershipValues.first?.hostname == hostname {-            urlIdentityRuleVersion = mint?.ruleVersion-        }     }      /// Req 3.21's one rule, in one place: a reuse or claim refreshes the Work's

diff --git a/Packages/AsterismCore/Sources/AsterismCore/ProjectionContract.swift b/Packages/AsterismCore/Sources/AsterismCore/ProjectionContract.swiftindex 930a25c..aee4ca3 100644--- a/Packages/AsterismCore/Sources/AsterismCore/ProjectionContract.swift+++ b/Packages/AsterismCore/Sources/AsterismCore/ProjectionContract.swift@@ -746,24 +746,6 @@ public struct WorkMergeOutcome: Equatable, Sendable {     public let targetIdentityEvidence: WorkIdentityEvidence     public let issues: [WorkMergeIssue] -    /// The primary site's answers, for the surfaces that speak of "the" merged-    /// Work's URL and identity. A same-site merge has exactly one site, so these-    /// are that site's.-    ///-    /// **The V7-shaped compatibility facade, and it is test-only from task 19.**-    /// Every production surface reads `sites` — the merge preview renders a row-    /// per site (Q74) and the commit applies a disposition per site — so on a-    /// cross-site merge these three answer about whichever site sorted first,-    /// which is a question no screen asks. They survive because the suites still-    /// read them as the single-site answer, and they are deleted with the rest-    /// of the single-site surface at V9 (T-2272).-    public var workURL: String? { sites.first?.workURL }-    public var identityEvidence: WorkIdentityEvidence {-        sites.first?.identityEvidence ?? .noEntries(previousIdentity: .none)-    }-    public var identityDisposition: WorkIdentityDisposition {-        sites.first?.identityDisposition ?? .retain(.none)-    }     public let retainedFields: [WorkMergeField]     public let discardedFields: [WorkMergeField]     public let sourceDeleted: Bool

diff --git a/Packages/AsterismCore/Sources/AsterismCore/SiteReconciler.swift b/Packages/AsterismCore/Sources/AsterismCore/SiteReconciler.swiftindex 35b8045..ae4886f 100644--- a/Packages/AsterismCore/Sources/AsterismCore/SiteReconciler.swift+++ b/Packages/AsterismCore/Sources/AsterismCore/SiteReconciler.swift@@ -321,16 +321,9 @@ enum SiteReconciler {     /// union's map. Rule UUIDs are unique, so the new version is a lookup and     /// provenance replay keeps resolving across the merge (Req 1.4).     ///-    /// **Both places, every time** (Decision 4). Through phase 1 the legacy-    /// columns are the source of truth — `LibraryValidator`,-    /// `BackupArchiveProjection` and the archive reference checks all resolve a-    /// citation out of them — and the blob is a derived mirror. A rewrite that-    /// wrote only the blob would leave every one of those readers citing a-    /// version no rule holds, which quarantines the hostname and refuses the-    /// export; a rewrite that wrote only the columns would leave the blob stale-    /// for the readers that have moved. So the columns are rewritten-    /// unconditionally and the blob is re-encoded beside them. Task 12 inverts-    /// it and V9 deletes the column half.+    /// **One place** since V9: the blob is where a citation lives, so+    /// `EntryCitations.rewritingVersions` is the whole rewrite and the column+    /// half is gone.     ///     /// Internal rather than private because `DuplicateReconciler` rewrites the     /// same citations after a rule identity group converges on one version@@ -340,20 +333,26 @@ enum SiteReconciler {     /// There is no Work counterpart any more: a `WorkSiteMembership` cites by     /// UUID and carries no version (Req 10.4, Q28), and since task 21 neither     /// the validator nor the archive reads `Work.urlIdentityRuleVersion`.-    /// Nothing here reads the blob, and that is the point: this used to decode-    /// `entry.citations` first, so **one** Entry whose bytes will not decode-    /// threw out of the enumeration and abandoned the consolidation — every-    /// later Entry left citing a version its rule no longer holds, on a pass-    /// whose whole job is to stop exactly that. The columns are rewritten, and-    /// `refreshCitations` re-derives the blob from them; its value guard skips a-    /// row already in step and its `catch` replaces bytes that will not decode,-    /// so a corrupt row is repaired by the pass rather than aborting it.+    ///+    /// **One unreadable row must not abandon the consolidation.** An earlier+    /// spelling decoded `entry.citations` and let the throw escape, so a single+    /// Entry whose bytes will not decode left every later Entry citing a version+    /// its rule no longer holds — on the pass whose whole job is to stop exactly+    /// that. `editCitations` repairs such a row from the default instead (Q24).+    ///+    /// A **nil**-blob Entry is left nil (Q23): `rewritingVersions` has nothing+    /// to rewrite in the default value, so the edit is a no-op and the value+    /// guard writes nothing. This pass walks every Entry on a consolidation, so+    /// a version of it that converted nil blobs would zero+    /// `entriesWithoutCitationBlobCount` on the first reconcile after the+    /// upgrade — the one counter that tells the reader which rows lost their+    /// provenance.     @discardableResult     static func rewriteCitations(of entry: Entry, _ rewrites: [UUID: Int]) -> Bool {         guard !rewrites.isEmpty else { return false }-        let columnsChanged = LegacyColumns.rewriteVersions(rewrites, on: entry)-        let blobRefreshed = LegacyColumns.refreshCitations(on: entry)-        return columnsChanged || blobRefreshed+        return entry.editCitations { citations in+            if let rewritten = citations.rewritingVersions(rewrites) { citations = rewritten }+        }     }      private static func chunks<Element>(of values: [Element], size: Int) -> [ArraySlice<Element>] {

diff --git a/Packages/AsterismCore/Sources/AsterismCore/SiteRelationshipPopulationPass.swift b/Packages/AsterismCore/Sources/AsterismCore/SiteRelationshipPopulationPass.swiftindex 6cfd328..f9e2409 100644--- a/Packages/AsterismCore/Sources/AsterismCore/SiteRelationshipPopulationPass.swift+++ b/Packages/AsterismCore/Sources/AsterismCore/SiteRelationshipPopulationPass.swift@@ -6,8 +6,14 @@ import SwiftData // the `"4"` marker generation, this pass has no production caller and must not // be linked into a shipping build. #if DEBUG || ASTERISM_PERFORMANCE_TESTING-/// Populates `Entry.site` and `Work.site` from their hostname strings, for a-/// library whose relationships are unset.+/// Populates `Entry.site` and `WorkSiteMembership.site` from their hostname+/// strings, for a library whose relationships are unset.+///+/// It populated `Work.site` too until V9 dropped that column+/// (`drop-superseded-columns` Q27, which is also why this survived the spec's+/// deletion list: two dozen seeders still need the two relationships that are+/// left, and inlining the row selection at each of them is the duplication the+/// paragraph below argues against). /// /// **Fixture and test support, and nothing else** — hence the guard above, /// which is the same one the fixtures that call it carry. It arrived as the@@ -58,15 +64,11 @@ enum SiteRelationshipPopulationPass {             let winner = winners[entry.hostname]             if entry.site !== winner { entry.site = winner }         }-        for work in try context.fetch(FetchDescriptor<Work>()) {-            let winner = winners[LegacyColumns.membership(from: work).hostname]-            if LegacyColumns.site(from: work) !== winner {-                LegacyColumns.setSite(winner, on: work)-            }-        }-        // V8: the membership carries its own Site reference, and it is the one-        // the live code reads — the Work column above is the superseded mirror.-        // A fixture that pinned only the mirror left every membership on+        // A Work's site presence is its memberships, and the membership carries+        // its own Site reference. The `Work.site` walk that used to stand here+        // went with the column at V9; nothing had read it since V8.+        //+        // A fixture that pinned only the Work mirror left every membership on         // whichever row it was minted against, which is precisely the state         // `SiteReconciler.repin` and `MembershipReconciler` exist to converge         // (Q57), so a suite built on this pass could not tell a converged graph

diff --git a/Packages/AsterismCore/Sources/AsterismCore/ToleratedStateFixture.swift b/Packages/AsterismCore/Sources/AsterismCore/ToleratedStateFixture.swiftindex 003c8c6..f9288fd 100644--- a/Packages/AsterismCore/Sources/AsterismCore/ToleratedStateFixture.swift+++ b/Packages/AsterismCore/Sources/AsterismCore/ToleratedStateFixture.swift@@ -150,20 +150,17 @@ extension LibraryRepository {                     // cheapest legal way to give both rows one.                     //                     // The **membership** is where the identity is authored. The-                    // retained columns were written here too, by hand, on the-                    // grounds that the duplicate scan and the validator still-                    // read them — neither does: the scan buckets by membership-                    // (Req 5.1) and the validator's identity arm is the-                    // membership arm (Q54). They are a mirror of the primary-                    // membership until V9 (T-2272), so the fixture keeps them in-                    // step the way every production write site does, through-                    // `refreshMembership`, rather than seeding a second-                    // authored copy that could disagree with the first.+                    // Work's own identity columns were written here too, by+                    // hand, on the grounds that the duplicate scan and the+                    // validator still read them — neither did: the scan buckets+                    // by membership (Req 5.1) and the validator's identity arm+                    // is the membership arm (Q54). V9 dropped the columns+                    // outright. The identity this shape needs is the+                    // membership's.                     if let membership = work.membership(for: "mergeable.test") {                         membership.urlIdentity = "twinned-serial"                         membership.urlIdentityState = .legacyUnverified                     }-                    LegacyColumns.refreshMembership(on: work)                     work.lastParsedTitle = "Twinned Serial"                     work.titleProvenance = .parsed                     work.genericNotes = notes@@ -172,7 +169,7 @@ extension LibraryRepository {                         path: "serial-\(index + 1)", index: 60 + index)                     context.insert(entry)                     entry.work = work-                    entry.workAssignmentProvenance = .manual+                    entry.editCitations { $0.workAssignment = .manual }                 }             } 

diff --git a/Packages/AsterismCore/Sources/AsterismCore/V8PopulationPass.swift b/Packages/AsterismCore/Sources/AsterismCore/V8PopulationPass.swiftdeleted file mode 100644index 8b75fd3..0000000--- a/Packages/AsterismCore/Sources/AsterismCore/V8PopulationPass.swift+++ /dev/null@@ -1,262 +0,0 @@-import Foundation-import SwiftData--/// Fills the rows and blobs the V7 → V8 stage could only *add*, from the columns-/// it left in place (Decision 3).-///-/// **Production code, not fixture support.** The V7 → V8 stage is lightweight-/// and additive — two tables and two columns — because SwiftData runs it inside-/// `ModelContainer.init`, where a stage that dropped the source columns would-/// destroy them before anything could read them. This pass is the other half of-/// that bargain: it runs *after* the open, under the bootstrap's exclusive lease-/// and before the library is presented, and it is what makes the `"7"` marker-/// generation an upgrade rather than a refusal (Req 2.2).-///-/// Three phases in a fixed order — Works, Entries, TitlePatterns. The order buys-/// nothing at runtime; it is fixed so a recorded-store test can assert what a-/// partial run left behind (Req 2.4).-///-/// **Every phase is idempotent by an existence guard**, so a run interrupted by-/// a failing save is completed rather than doubled by the next one: a Work that-/// already holds a membership on its hostname is skipped, and an Entry or-/// pattern that already holds its blob is skipped. That is what lets the-/// marker-lagging arm re-enter on the next open with the same result as a first-/// run (Req 2.4).-///-/// `reconcileAfterSync` runs it too, with the same guards: rows a lagging V7-/// device syncs in after the migration (Req 2.7) get their memberships and blobs-/// on the next reconcile, and until then the nil-blob fallbacks keep them-/// readable (Q36).-enum V8PopulationPass {--    /// Which of the three phases a run performs.-    ///-    /// The bootstrap arm and every full-tier reconcile run `.all`; an arrival-    /// runs only the phases the last tolerance scan saw unconverted rows for-    /// (Decision 5). A phase that does not run is a phase whose whole-table-    /// fetch is not paid for, which is the point.-    struct Phases: OptionSet {-        let rawValue: Int-        static let memberships = Phases(rawValue: 1 << 0)-        static let citations = Phases(rawValue: 1 << 1)-        static let definitions = Phases(rawValue: 1 << 2)-        static let all: Phases = [.memberships, .citations, .definitions]-    }--    /// Runs the selected phases, chunked, with one save per dirty chunk.-    ///-    /// Chunking is not a nicety: the whole library is rewritten here, and a-    /// single save over a 5,000-Entry store is the shape `SiteReconciler`'s Q27-    /// measured at seventeen seconds. Every chunk boundary is a legal library.-    static func run(-        context: ModelContext,-        batchSize: Int = LibraryRepository.bulkOperationBatchSize,-        saveStrategy: any RepositorySaveStrategy = ModelContextSaveStrategy(),-        phases: Phases = .all-    ) throws {-        if phases.contains(.memberships) {-            try populateMemberships(-                context: context, batchSize: batchSize, saveStrategy: saveStrategy)-        }-        if phases.contains(.citations) {-            try populateCitations(-                context: context, batchSize: batchSize, saveStrategy: saveStrategy)-        }-        if phases.contains(.definitions) {-            try populateDefinitions(-                context: context, batchSize: batchSize, saveStrategy: saveStrategy)-        }-    }--    // MARK: - Phase 1: Works → memberships--    /// One `WorkSiteMembership` per Work, carrying the six site/identity/URL-    /// columns (Req 2.1).-    ///-    /// The membership's `createdAt` is the Work's, so a migrated single-site-    /// Work orders exactly as it did before (Req 1.2). Its `site` is the row the-    /// Work was pinned to, and where the Work was never pinned — a tolerated-    /// state since M4a — the `SiteResolutionOrder` winner for the hostname, and-    /// nil where no Site row has arrived (Req 1.5).-    ///-    /// A Work with a **blank** hostname gets no membership. That is the Q30-    /// tolerated state, not a failure: it arrives from a lagging writer or a-    /// partial sync, the validator reports it, and inventing a membership on ""-    /// would put a row on a hostname that does not exist.-    private static func populateMemberships(-        context: ModelContext,-        batchSize: Int,-        saveStrategy: any RepositorySaveStrategy-    ) throws {-        let works = try context.fetch(FetchDescriptor<Work>())-        guard !works.isEmpty else { return }-        let winners = SiteResolutionOrder.winnersByHostname(-            try context.fetch(FetchDescriptor<Site>()))-        // One fetch rather than a relationship traversal per Work: reading-        // `work.siteMemberships` faults the inverse array a row at a time, which-        // is the fan-out cost Q17 keeps `Site.works` internal to avoid.-        var held = Set(-            try context.fetch(FetchDescriptor<WorkSiteMembership>())-                .compactMap { membership -> MembershipReconciler.Key? in-                    guard let workID = membership.resolvedWorkID else { return nil }-                    return MembershipReconciler.Key(workID: workID, hostname: membership.hostname)-                })--        for chunk in LibraryRepository.chunks(of: works, size: batchSize) {-            var dirty = false-            for work in chunk {-                let hostname = LegacyColumns.membership(from: work).hostname-                guard !M2Unicode.isBlank(hostname) else { continue }-                guard held.insert(-                    MembershipReconciler.Key(workID: work.id, hostname: hostname)).inserted-                else { continue }-                guard let membership = mint(for: work, fallbackSite: winners[hostname])-                else { continue }-                context.insert(membership)-                dirty = true-            }-            if dirty { try saveStrategy.save(context) }-        }-    }--    /// The single membership a Work's retained columns describe, or nil where the-    /// hostname is blank (the Q30 tolerated state).-    ///-    /// The migration's own, and nothing else's since task 21: the 7/8 archive-    /// carries membership records, so the import builds rows from what the file-    /// says rather than from a Work's retained columns.-    static func mint(for work: Work, fallbackSite: Site?) -> WorkSiteMembership? {-        let legacy = LegacyColumns.membership(from: work)-        guard !M2Unicode.isBlank(legacy.hostname) else { return nil }-        return WorkSiteMembership(-            hostname: legacy.hostname,-            createdAt: legacy.createdAt,-            urlIdentity: legacy.urlIdentity,-            urlIdentityState: legacy.urlIdentityState,-            urlIdentityRuleID: legacy.urlIdentityRuleID,-            workURLString: legacy.workURLString,-            workID: work.id,-            work: work,-            site: LegacyColumns.site(from: work) ?? fallbackSite)-    }--    // `refreshMembership` stood here: the 6/7 import's update branch, which-    // derived a Work's membership from the columns an archive record had just-    // overwritten. Task 21 deleted it with the format — a 7/8 archive carries-    // membership records, so the import applies what the file says and mirrors-    // the columns from the membership rather than the other way round.---    // MARK: - Phase 2: Entries → the citation blob--    /// **A value guard, not an existence guard** (Decision 4). Through phase 1-    /// the legacy columns are still the source of truth for citations: every-    /// writer in the repository — the composed teaching commit, the re-parse-    /// commit, the articles sweep, the import — writes the columns and never-    /// calls `setCitations`. An existence guard would therefore populate a row-    /// once and then let its blob drift for ever, silently, because a nil blob-    /// falls back to the columns while a *stale* one does not.-    ///-    /// So the blob is written whenever it differs from what the columns say —-    /// which still costs nothing on a converged library, because the second run-    /// finds every blob already equal (the idempotence Req 2.4 asks for). Task-    /// 12 inverts this: the writers move to `setCitations`, the blob becomes the-    /// source of truth, and V9 deletes the columns and this phase with them.-    ///-    /// This phase converges the two homes **between** commits. It is not the-    /// whole of Decision 4: a commit whose own validation reads the blob needs-    /// the refresh to have happened *inside* it, which is why every column-    /// writer calls `LegacyColumns.refreshCitations` — the same code, at the-    /// write site.-    private static func populateCitations(-        context: ModelContext,-        batchSize: Int,-        saveStrategy: any RepositorySaveStrategy-    ) throws {-        let entries = try context.fetch(FetchDescriptor<Entry>())-        for chunk in LibraryRepository.chunks(of: entries, size: batchSize) {-            var dirty = false-            for entry in chunk where LegacyColumns.refreshCitations(on: entry) {-                dirty = true-            }-            if dirty { try saveStrategy.save(context) }-        }-    }--    // MARK: - Phase 3: TitlePatterns → the definition blob--    /// A row whose ten columns do not form a legal arm is **left alone**.-    ///-    /// `LegacyColumns.definition` throws on such a row, and there is nothing-    /// honest to write for it: the arm the reader taught is not recoverable, and-    /// substituting one is the mistake Decision 5 of-    /// `library-integrity-tolerance` was written about. The validator already-    /// reports it and quarantines its hostname; failing the whole pass over it-    /// would make the library unopenable on V8 for a state it opens with today.-    /// `assertComplete` therefore does not demand a blob for it either.-    ///-    /// **An existence guard is right here, unlike phase 2's.** `TitlePattern`'s-    /// ten definition columns have no writer left: `TitlePattern.init` writes-    /// only `definitionData`, `applyStoredDefinition` goes through-    /// `setDefinition`, and no production path assigns a column (the pin in-    /// `ModelContractTests` is what keeps that true). A populated pattern blob-    /// therefore cannot go stale, so a converted row is skipped outright.-    private static func populateDefinitions(-        context: ModelContext,-        batchSize: Int,-        saveStrategy: any RepositorySaveStrategy-    ) throws {-        let patterns = try context.fetch(FetchDescriptor<TitlePattern>())-        for chunk in LibraryRepository.chunks(of: patterns, size: batchSize) {-            var dirty = false-            for pattern in chunk where pattern.definitionData == nil {-                guard let stored = try? LegacyColumns.definition(from: pattern) else { continue }-                try pattern.setDefinition(stored)-                dirty = true-            }-            if dirty { try saveStrategy.save(context) }-        }-    }--    // MARK: - Certification--    /// Throws unless the pass has nothing left to do (Q35).-    ///-    /// **The pass certifies itself, because the validator cannot.** Every state-    /// this pass repairs is one the validator *tolerates* — a Work with no-    /// membership, an Entry reading its citations through the columns — so a-    /// validator run over an unconverted library comes back clean. The marker is-    /// published on this answer, and only on this answer.-    static func assertComplete(context: ModelContext) throws {-        var membershipHostnames: [UUID: Set<String>] = [:]-        for membership in try context.fetch(FetchDescriptor<WorkSiteMembership>()) {-            guard let workID = membership.resolvedWorkID else { continue }-            membershipHostnames[workID, default: []].insert(membership.hostname)-        }-        for work in try context.fetch(FetchDescriptor<Work>()) {-            let hostname = LegacyColumns.membership(from: work).hostname-            guard !M2Unicode.isBlank(hostname) else { continue }-            guard membershipHostnames[work.id]?.contains(hostname) == true else {-                throw incomplete("Work", work.id, "holds no membership for \(hostname)")-            }-        }-        for entry in try context.fetch(FetchDescriptor<Entry>()) where entry.citationsData == nil {-            throw incomplete("Entry", entry.id, "carries no citation blob")-        }-        for pattern in try context.fetch(FetchDescriptor<TitlePattern>())-        where pattern.definitionData == nil {-            // A row whose columns will not decode is not the pass's failure —-            // see `populateDefinitions`.-            guard (try? LegacyColumns.definition(from: pattern)) != nil else { continue }-            throw incomplete("TitlePattern", pattern.id, "carries no definition blob")-        }-    }--    private static func incomplete(-        _ type: String, _ id: UUID, _ reason: String-    ) -> LibraryRepositoryError {-        .libraryUnavailable(-            operation: "completing the V8 population pass",-            reason: "\(type) \(id.uuidString) \(reason)")-    }-}

diff --git a/Packages/AsterismCore/Sources/AsterismCore/WorkVariantUnion.swift b/Packages/AsterismCore/Sources/AsterismCore/WorkVariantUnion.swiftindex 24c1e7a..465f79c 100644--- a/Packages/AsterismCore/Sources/AsterismCore/WorkVariantUnion.swift+++ b/Packages/AsterismCore/Sources/AsterismCore/WorkVariantUnion.swift@@ -106,23 +106,6 @@ public struct WorkVariantUnionOutcome: Sendable, Equatable {      /// Merge shows one block, so it takes the first (and only) one.     public var auditBlock: String? { auditBlocks.first }--    /// The one site's URL, for a fold over sides that are on one site — every-    /// duplicate-set fold, by Req 5.3.-    ///-    /// **Test-only, and scheduled for T-2272.** No production caller is left:-    /// `WorkMergeSiteOutcome` carries the per-hostname value (Q74, Q78) and the-    /// resolution sheet folds per hostname (Q65). It survives because the-    /// suites read it as the V7-shaped answer, and it is deleted with the rest-    /// of the single-site compatibility surface at V9.-    ///-    /// Keyed rather than `values.first`: a `Dictionary`'s iteration order is-    /// per-process seeded, so on the day this is handed a two-site fold it would-    /// return a different site's address on each run rather than the same wrong-    /// one — which is the difference between a bug and an unreproducible bug.-    public var workURL: String? {-        workURLsByHostname.keys.sorted().first.flatMap { workURLsByHostname[$0] }-    } }  public enum WorkVariantUnion {

diff --git a/Packages/AsterismCore/Tests/AsterismCoreTests/ArticlesReteachFlagTests.swift b/Packages/AsterismCore/Tests/AsterismCoreTests/ArticlesReteachFlagTests.swiftindex 14e07d4..a938ba6 100644--- a/Packages/AsterismCore/Tests/AsterismCoreTests/ArticlesReteachFlagTests.swift+++ b/Packages/AsterismCore/Tests/AsterismCoreTests/ArticlesReteachFlagTests.swift@@ -127,6 +127,6 @@ struct ArticlesReteachFlagTests {             try await fixture.repository.m5UnattachmentFields(of: entryID)                 == M5UnattachmentFields(                     hasWork: false, intentionallyUnattached: true, assignmentProvenance: .manual,-                    hasWorkPatternID: false, hasWorkPatternVersion: false))+                    citesWorkPattern: false))     } }

diff --git a/Packages/AsterismCore/Tests/AsterismCoreTests/BackupExportDegradedRefusalTests.swift b/Packages/AsterismCore/Tests/AsterismCoreTests/BackupExportDegradedRefusalTests.swiftindex e5010f9..51ed69d 100644--- a/Packages/AsterismCore/Tests/AsterismCoreTests/BackupExportDegradedRefusalTests.swift+++ b/Packages/AsterismCore/Tests/AsterismCoreTests/BackupExportDegradedRefusalTests.swift@@ -132,9 +132,10 @@ struct BackupExportDegradedRefusalTests {             let entry = store.insertEntry(                 hostname: "present.example", title: "Chapter 1 - Cited", offset: 0)             entry.chapterTitle = "Chapter 1"-            entry.chapterTitleProvenanceRaw = FieldProvenanceKind.pattern.rawValue-            entry.chapterPatternID = patternID-            entry.chapterPatternVersion = 1+            entry.editCitations {+                $0.chapterTitle = FieldProvenance.tolerant(+                    kind: .pattern, patternID: patternID, patternVersion: 1)+            }         }         let repository = try fixture.diagnosedRepository() @@ -237,27 +238,26 @@ struct BackupExportDegradedRefusalTests {     ///     /// A work's stored type is *not* checked for representability, which is what     /// makes `configurable-work-types` Req 7.1 — "export succeeds for works of-    /// any type" — true. What changed at V8 is where the type comes from: the-    /// derivation reads the work-type identity alone (Req 10.3), so a work-    /// carrying only a raw value exports **untyped** rather than carrying the-    /// value verbatim. The export still succeeds, which is the requirement.-    @Test("A work typed only by a raw value exports untyped rather than refusing")-    func unrecognisedWorkTypeExportsVerbatim() async throws {+    /// any type" — true. V8 moved the derivation onto the work-type identity+    /// alone (Req 10.3) and V9 dropped the raw column behind it, so a work with+    /// no identity exports untyped and the export succeeds, which is the+    /// requirement. It was seeded through `typeRaw = "graphicNovel"` until the+    /// column went; that work derived to exactly this.+    @Test("A work with no work-type identity exports untyped rather than refusing")+    func untypedWorkExportsWithoutRefusing() async throws {         let fixture = try DegradedExportFixture()         let workID = UUID()         try fixture.seed { store in             store.insertSite(hostname: "present.example")-            let work = store.insertWork(+            store.insertWork(                 id: workID, hostname: "present.example", title: "A Work", offset: 0)-            work.typeRaw = "graphicNovel"         }         let repository = try fixture.diagnosedRepository()          let payload = try await repository.backupV7Snapshot()          let record = try #require(payload.works.first { $0.id == workID })-        // The 7/8 record has nowhere to put a legacy type at all (Req 10.3, Q16),-        // and nothing derives one from the retained column.+        // The 7/8 record has nowhere to put a legacy type at all (Req 10.3, Q16).         #expect(record.workTypeID == nil)         #expect(record.typeName == nil)     }@@ -343,8 +343,7 @@ struct BackupExportDegradedRefusalTests {             rule.definitionData = Data("{}".utf8)             let entry = store.insertEntry(hostname: "tth.example", title: "Chapter 1", offset: 0)             entry.urlWorkIdentity = "a-story"-            entry.urlWorkRuleID = ruleID-            entry.urlWorkRuleVersion = 1+            entry.editCitations { $0.urlWork = CitedRule(id: ruleID, version: 1) }         }         let repository = try fixture.diagnosedRepository()         let staging = fixture.directory.appending(path: "staging")@@ -377,9 +376,10 @@ struct BackupExportDegradedRefusalTests {             let entry = store.insertEntry(                 hostname: "present.example", title: "Chapter 1 - Present", offset: 0)             entry.chapterTitle = "Chapter 1"-            entry.chapterTitleProvenanceRaw = FieldProvenanceKind.pattern.rawValue-            entry.chapterPatternID = absent-            entry.chapterPatternVersion = 3+            entry.editCitations {+                $0.chapterTitle = FieldProvenance.tolerant(+                    kind: .pattern, patternID: absent, patternVersion: 3)+            }         }         let repository = try fixture.diagnosedRepository() @@ -643,7 +643,7 @@ struct BackupExportDegradedRefusalTests {             metadata: BackupV7Metadata(appBuild: "1", exportedAt: DegradedExportFixture.epoch))         let decoded = try BackupV7Codec.decode(encoded) -        let schema = Schema(versionedSchema: AsterismSchemaV8.self)+        let schema = Schema(versionedSchema: AsterismSchemaV9.self)         let configuration = ModelConfiguration(             schema: schema, isStoredInMemoryOnly: true, cloudKitDatabase: .none)         let container = try ModelContainer(for: schema, configurations: [configuration])

diff --git a/Packages/AsterismCore/Tests/AsterismCoreTests/BackupGoldenExportTests.swift b/Packages/AsterismCore/Tests/AsterismCoreTests/BackupGoldenExportTests.swiftindex 2c56b93..9ee158a 100644--- a/Packages/AsterismCore/Tests/AsterismCoreTests/BackupGoldenExportTests.swift+++ b/Packages/AsterismCore/Tests/AsterismCoreTests/BackupGoldenExportTests.swift@@ -118,6 +118,32 @@ struct BackupGoldenExportTests {         #expect(plan.counts.works == plan.metadata.workCount)     } +    /// `drop-superseded-columns`' archive requirement: a 7/8 archive **exported+    /// by a V8 build** restores into a V9 library. The bytes on disk are that+    /// archive — `multi-site-works` recorded them and V9 did not re-record+    /// them, because V9 changed where the citations are read from and not what+    /// the wire says.+    ///+    /// Distinct from `recordedArchiveDecodesAndPlans` above, which stops at the+    /// import gate's in-memory materialization: this one commits to a real+    /// store and validates what is left there, which is what the reader does on+    /// the day the archive is the rollback.+    @Test("A 7/8 archive recorded before V9 restores into a V9 library and validates clean")+    func recordedArchiveRestoresIntoAV9Library() async throws {+        let golden = try Data(contentsOf: Self.goldenURL)++        let target = try await M5Fixture()+        try await target.repository.confirmImport(plan: try BackupImporter.plan(from: golden))++        #expect(try await target.repository.strictDiagnoses().isEmpty)+        // Against an empty library that would validate trivially: what is in the+        // store re-exports as the same archive, so every record arrived.+        let reExported = try BackupV7Codec.encode(+            payload: try await target.repository.backupV7Snapshot(),+            metadata: BackupGoldenLibrary.metadata)+        #expect(reExported == golden)+    }+     /// Req 9.2, end to end: export, restore into an empty library, export again.     /// Byte-identical is the strongest form of "reproduces every record" there     /// is — a field the import dropped, re-derived or reordered shows up as a@@ -191,6 +217,16 @@ extension LibraryRepository {             return (orphans, pairs)         }     }++    /// The strict validator over the live store, which is the bar an imported+    /// library has to clear (`+BackupImportGates`, Decision 3 of+    /// `library-integrity-tolerance`).+    fileprivate func strictDiagnoses() async throws -> [String: LibraryValidationError] {+        try await withLockedContext(mode: .shared, operation: "validating the restored library") {+            context in+            try LibraryValidator.validateStrict(context: context)+        }+    } }  /// The archive the golden library is built from: one record of every kind the

diff --git a/Packages/AsterismCore/Tests/AsterismCoreTests/BackupGroupProjectionTests.swift b/Packages/AsterismCore/Tests/AsterismCoreTests/BackupGroupProjectionTests.swiftindex 42b4791..db94e18 100644--- a/Packages/AsterismCore/Tests/AsterismCoreTests/BackupGroupProjectionTests.swift+++ b/Packages/AsterismCore/Tests/AsterismCoreTests/BackupGroupProjectionTests.swift@@ -191,8 +191,8 @@ struct BackupGroupProjectionTests {             id: shared, key: "chapter-1", capturedAt: 40, work: second, site: site)         // Manual, so the assignment *is* authored content and the normalisation         // is what keeps the two rows from reading as two variants.-        rowA.workAssignmentProvenanceRaw = FieldProvenanceKind.manual.rawValue-        rowB.workAssignmentProvenanceRaw = FieldProvenanceKind.manual.rawValue+        rowA.editCitations { $0.workAssignment = .manual }+        rowB.editCitations { $0.workAssignment = .manual }         try store.commit()          let payload = try store.read { try LibraryRepository.projectV7Payload(context: $0) }@@ -576,9 +576,10 @@ struct BackupGroupProjectionTests {         try store.addPattern(id: ruleID, site: second, version: 3, active: false, createdAt: 0)         let entry = store.addEntry(key: "chapter-1", capturedAt: 10, site: first)         entry.chapterTitle = "Chapter 1"-        entry.chapterTitleProvenanceRaw = FieldProvenanceKind.pattern.rawValue-        entry.chapterPatternID = ruleID-        entry.chapterPatternVersion = 3+        entry.editCitations {+            $0.chapterTitle = FieldProvenance.tolerant(+                kind: .pattern, patternID: ruleID, patternVersion: 3)+        }         try store.commit()          let payload = try store.read { try LibraryRepository.projectV7Payload(context: $0) }@@ -606,9 +607,10 @@ struct BackupGroupProjectionTests {         let losing = store.addEntry(             id: shared, key: "chapter-1", capturedAt: 20, title: "B", site: site)         losing.chapterTitle = "Chapter 1"-        losing.chapterTitleProvenanceRaw = FieldProvenanceKind.pattern.rawValue-        losing.chapterPatternID = ruleID-        losing.chapterPatternVersion = 1+        losing.editCitations {+            $0.chapterTitle = FieldProvenance.tolerant(+                kind: .pattern, patternID: ruleID, patternVersion: 1)+        }         try store.commit()          let payload = try store.read { try LibraryRepository.projectV7Payload(context: $0) }

diff --git a/Packages/AsterismCore/Tests/AsterismCoreTests/BackupGroupRoundTripTests.swift b/Packages/AsterismCore/Tests/AsterismCoreTests/BackupGroupRoundTripTests.swiftindex 0281bf9..342aa2a 100644--- a/Packages/AsterismCore/Tests/AsterismCoreTests/BackupGroupRoundTripTests.swift+++ b/Packages/AsterismCore/Tests/AsterismCoreTests/BackupGroupRoundTripTests.swift@@ -222,14 +222,13 @@ extension LibraryRepository {             context.insert(site)             for (index, (created, notes)) in [(5.0, "phone notes"), (20.0, "")].enumerated() {                 let work = Work(-                    id: id, displayTitle: "A Serial", siteHostname: hostname,+                    id: id, displayTitle: "A Serial",                     timestamp: epoch.addingTimeInterval(created))                 work.modifiedAt = epoch.addingTimeInterval(created)                 work.genericNotes = notes                 work.lastParsedTitle = "A Serial"                 work.titleProvenance = .parsed                 context.insert(work)-                work.setLegacySite(site)                 let entry = Entry(                     id: UUID(), captureTitle: "Chapter \(index)", captureTitleSource: .host,                     rawURLString: "https://\(hostname)/chapter-\(index)", hostname: hostname,

diff --git a/Packages/AsterismCore/Tests/AsterismCoreTests/BackupImportTransactionTests.swift b/Packages/AsterismCore/Tests/AsterismCoreTests/BackupImportTransactionTests.swiftindex 154b18b..78cd526 100644--- a/Packages/AsterismCore/Tests/AsterismCoreTests/BackupImportTransactionTests.swift+++ b/Packages/AsterismCore/Tests/AsterismCoreTests/BackupImportTransactionTests.swift@@ -456,7 +456,7 @@ private func createReadyEmptyV3Store(at configuration: LibraryConfiguration) thr         at: configuration.storeURL.deletingLastPathComponent(),         withIntermediateDirectories: true     )-    let schema = Schema(versionedSchema: AsterismSchemaV8.self)+    let schema = Schema(versionedSchema: AsterismSchemaV9.self)     let storeConfig = ModelConfiguration(         "AsterismV3",         schema: schema,@@ -465,12 +465,12 @@ private func createReadyEmptyV3Store(at configuration: LibraryConfiguration) thr     )     let container = try ModelContainer(         for: schema,-        migrationPlan: AsterismV8MigrationPlan.self,+        migrationPlan: AsterismV9MigrationPlan.self,         configurations: [storeConfig]     )     let context = ModelContext(container)     try context.save()-    try Data("7\n".utf8).write(to: configuration.readinessMarkerURL, options: .atomic)+    try Data("8\n".utf8).write(to: configuration.readinessMarkerURL, options: .atomic) }  private func createReadyPopulatedV3Store(at configuration: LibraryConfiguration) throws {@@ -479,7 +479,7 @@ private func createReadyPopulatedV3Store(at configuration: LibraryConfiguration)         at: configuration.storeURL.deletingLastPathComponent(),         withIntermediateDirectories: true     )-    let schema = Schema(versionedSchema: AsterismSchemaV8.self)+    let schema = Schema(versionedSchema: AsterismSchemaV9.self)     let storeConfig = ModelConfiguration(         "AsterismV3",         schema: schema,@@ -488,13 +488,13 @@ private func createReadyPopulatedV3Store(at configuration: LibraryConfiguration)     )     let container = try ModelContainer(         for: schema,-        migrationPlan: AsterismV8MigrationPlan.self,+        migrationPlan: AsterismV9MigrationPlan.self,         configurations: [storeConfig]     )     let context = ModelContext(container)     let site = Site(hostname: "existing.com")     context.insert(site)-    let work = Work(displayTitle: "Existing Work", siteHostname: "existing.com", timestamp: Date())+    let work = Work(displayTitle: "Existing Work", timestamp: Date())     context.insert(work)     let entry = Entry(         captureTitle: "Chapter 1",@@ -510,9 +510,8 @@ private func createReadyPopulatedV3Store(at configuration: LibraryConfiguration)     // gone with the marker generation that ran it, so a certified library is     // seeded already linked.     entry.site = site-    work.setLegacySite(site)     try context.save()-    try Data("7\n".utf8).write(to: configuration.readinessMarkerURL, options: .atomic)+    try Data("8\n".utf8).write(to: configuration.readinessMarkerURL, options: .atomic) }  /// An archive with `entryCount` Entries on one untaught Site, for the chunking

diff --git a/Packages/AsterismCore/Tests/AsterismCoreTests/BackupV7ArchiveTests.swift b/Packages/AsterismCore/Tests/AsterismCoreTests/BackupV7ArchiveTests.swiftindex c2a0399..8429947 100644--- a/Packages/AsterismCore/Tests/AsterismCoreTests/BackupV7ArchiveTests.swift+++ b/Packages/AsterismCore/Tests/AsterismCoreTests/BackupV7ArchiveTests.swift@@ -561,7 +561,7 @@ struct BackupV7ExportTests {         let context: ModelContext          init() throws {-            let schema = Schema(versionedSchema: AsterismSchemaV8.self)+            let schema = Schema(versionedSchema: AsterismSchemaV9.self)             container = try ModelContainer(                 for: schema,                 configurations: [@@ -586,7 +586,7 @@ struct BackupV7ExportTests {                 hostname: BackupV7ExportTests.host, entryIdentityKey: rawURL,                 timestamp: BackupV7ExportTests.early, note: BackupV7ExportTests.note)             entry.conservativeIdentityKey = rawURL-            entry.workAssignmentProvenanceRaw = FieldProvenanceKind.manual.rawValue+            entry.editCitations { $0.workAssignment = .manual }             context.insert(entry)             entry.site = site             entry.work = work

diff --git a/Packages/AsterismCore/Tests/AsterismCoreTests/BootstrapActionTests.swift b/Packages/AsterismCore/Tests/AsterismCoreTests/BootstrapActionTests.swiftindex 1be1197..bcaf979 100644--- a/Packages/AsterismCore/Tests/AsterismCoreTests/BootstrapActionTests.swift+++ b/Packages/AsterismCore/Tests/AsterismCoreTests/BootstrapActionTests.swift@@ -78,7 +78,7 @@ struct BootstrapActionTests {     /// refusal has to leave the library exactly as it found it, because the     /// recovery is a backup archive restored over this store.     @Test("A retired marker generation is refused, naming the digit, and nothing is written",-          arguments: ["4", "5", "6"])+          arguments: ["4", "5", "6", "7"])     func retiredMarkerGenerationIsRefused(digit: String) async throws {         let root = try ActionRoot()         try await root.seedReadyLibrary(hostname: "retired-\(digit).example")@@ -119,7 +119,7 @@ struct BootstrapActionTests {         // are not what "empty" means here: the guard asks whether anything of the         // *reader's* would be certified sight unseen.         #expect(result == .ready(.seededEmpty))-        #expect(try root.markerText() == "8",+        #expect(try root.markerText() == "9",                 "a crash between store creation and the marker is repaired, not terminal")         withExtendedLifetime(root) {}     }@@ -222,7 +222,7 @@ struct BootstrapActionTests {         // the owner's library (Decision 5) — and the container construction is         // what fails.         try Data("this is not a sqlite store".utf8).write(to: root.storeURL, options: .atomic)-        try root.writeMarker("8\n")+        try root.writeMarker("9\n")         let before = try root.digest()          await #expect(throws: (any Error).self) {@@ -260,10 +260,10 @@ private enum RefusedState: String, CaseIterable, Sendable {         switch self {         case .storeRecordedBelowV5:             try root.installStoreRecordedAtFourZeroZero()-            try root.writeMarker("8\n")+            try root.writeMarker("9\n")         case .readinessMarkerWithoutAStore:             try root.createStoreDirectory()-            try root.writeMarker("8\n")+            try root.writeMarker("9\n")         case .historicalMarkerWithoutAStore:             try root.createStoreDirectory()             try root.writeHistoricalMarker()@@ -272,7 +272,7 @@ private enum RefusedState: String, CaseIterable, Sendable {             try root.writeMigrationArtefact()         case .markerRecordingAnUnknownVersion:             try await root.seedReadyLibrary(hostname: "unknown.example")-            try root.writeMarker("9\n")+            try root.writeMarker("10\n")         case .markerThatIsNotText:             try await root.seedReadyLibrary(hostname: "bytes.example")             try root.writeMarkerBytes(ActionRoot.nonUTF8MarkerBytes)@@ -375,7 +375,7 @@ private final class ActionRoot {         let context = ModelContext(container)         let timestamp = Date(timeIntervalSince1970: 1_800_000_000)         let raw = "https://\(hostname)/read/1"-        let work = Work(displayTitle: "A Work", siteHostname: hostname, timestamp: timestamp)+        let work = Work(displayTitle: "A Work", timestamp: timestamp)         let entry = Entry(             captureTitle: "A Capture", captureTitleSource: .host, rawURLString: raw,             hostname: hostname, entryIdentityKey: raw, timestamp: timestamp, work: work)

diff --git a/Packages/AsterismCore/Tests/AsterismCoreTests/BootstrapClassifierTests.swift b/Packages/AsterismCore/Tests/AsterismCoreTests/BootstrapClassifierTests.swiftindex dd3b3c3..083d619 100644--- a/Packages/AsterismCore/Tests/AsterismCoreTests/BootstrapClassifierTests.swift+++ b/Packages/AsterismCore/Tests/AsterismCoreTests/BootstrapClassifierTests.swift@@ -18,14 +18,14 @@ import Testing /// | Axis | Values | /// |---|---| /// | Store family | absent / main file only / companions only / full family |-/// | Readiness marker | absent / `"4"` / `"5"` / `"6"` / `"7"` / `"8"` / unrecognised text / non-UTF-8 bytes |+/// | Readiness marker | absent / `"4"` / `"5"` / `"6"` / `"8"` / `"9"` / unrecognised text / non-UTF-8 bytes | /// | Historical marker | present / absent | /// | Migration artefact | present / absent | /// | Recorded version | at-or-above V5 / below / indeterminate | ///-/// 288 combinations, of which two collapse across the version axis: with no main+/// 384 combinations, of which two collapse across the version axis: with no main /// file there is nothing to read, so the store-absent and companions-only rows-/// have one version value rather than three. That leaves 192 distinct cells,+/// have one version value rather than three. That leaves 256 distinct cells, /// small enough to enumerate rather than sample. /// /// Every cell asserts three things:@@ -85,7 +85,7 @@ struct BootstrapClassifierTests {     func readyMarkerGovernsOverAHistoricalMarker() throws {         let root = try ClassifierRoot()         try root.seedBornAtLiveStore()-        try root.writeMarker("8\n")+        try root.writeMarker("9\n")         try root.writeHistoricalMarker()          #expect(try LibraryRepository.classify(root.configuration, fileManager: .default) == .ready)@@ -99,7 +99,7 @@ struct BootstrapClassifierTests {     func readyMarkerGovernsOverALeftoverArtefact() throws {         let root = try ClassifierRoot()         try root.seedBornAtLiveStore()-        try root.writeMarker("8\n")+        try root.writeMarker("9\n")         try root.writeMigrationArtefact()          #expect(try LibraryRepository.classify(root.configuration, fileManager: .default) == .ready)@@ -155,7 +155,7 @@ struct BootstrapClassifierTests {         let root = try ClassifierRoot()         try root.createStoreDirectory()         switch kind {-        case .readinessMarker: try root.writeMarker("7\n")+        case .readinessMarker: try root.writeMarker("8\n")         case .historicalMarker: try root.writeHistoricalMarker()         case .migrationSidecar: try root.writeMigrationArtefact()         }@@ -171,7 +171,7 @@ struct BootstrapClassifierTests {     func overlappingOrphanedEvidenceNamesTheReadinessMarker() throws {         let root = try ClassifierRoot()         try root.createStoreDirectory()-        try root.writeMarker("7\n")+        try root.writeMarker("8\n")         try root.writeHistoricalMarker()         try root.writeMigrationArtefact() @@ -180,19 +180,23 @@ struct BootstrapClassifierTests {         withExtendedLifetime(root) {}     } -    /// The three retired generations (`data-model-cleanups` Decision 2). Each was-    /// an openable state with an upgrade path beside it — the relationship data-    /// pass for `"4"`, a republication for `"5"` and `"6"` — and each is now+    /// The four retired generations. Each was an openable state with an upgrade+    /// path beside it — the relationship data pass for `"4"`, a republication+    /// for `"5"` and `"6"`, V8's population pass for `"7"` — and each is now     /// refused, because the population those paths existed for is entirely past-    /// them. `"7"` is **not** among them: `multi-site-works` added it back to-    /// `appOpenableMarkerVersions` as the lagging generation V8 upgrades from.+    /// them. `"4"`, `"5"` and `"6"` went at `data-model-cleanups` Decision 2;+    /// `"7"` joined them here. `multi-site-works` had added it back to+    /// `appOpenableMarkerVersions` as the lagging generation V8 upgraded from,+    /// and `drop-superseded-columns` **substituted** `"8"` for it (Q2 of that+    /// spec) once every device was confirmed past `"7"`, because the lagging+    /// row holds one digit at a time.     ///     /// The refusal **names the digit**. Nothing else on the failing side of the     /// state table distinguishes one retired generation from another, so a     /// message that said only "unsupported" would leave the owner of the one     /// library this can happen to with nothing to act on.     @Test("A marker recording a retired generation is refused, naming the digit",-          arguments: ["4", "5", "6"])+          arguments: ["4", "5", "6", "7"])     func retiredMarkerGenerationIsRefused(digit: String) throws {         let root = try ClassifierRoot()         try root.seedBornAtLiveStore()@@ -209,7 +213,7 @@ struct BootstrapClassifierTests {     }      @Test("A marker no build understands classifies unrecognised",-          arguments: ["9\n", "3\n", "45\n", "", "four\n"])+          arguments: ["3\n", "45\n", "", "four\n"])     func unrecognisedMarkerText(content: String) throws {         let root = try ClassifierRoot()         try root.seedBornAtLiveStore()@@ -283,7 +287,7 @@ struct BootstrapClassifierTests {     func belowV5StoreIsRefused() throws {         let root = try ClassifierRoot()         try V4RecordedStoreFixture.install(at: root.storeURL)-        try root.writeMarker("7\n")+        try root.writeMarker("8\n")          #expect(try LibraryRepository.classify(root.configuration, fileManager: .default)                 == .belowV5(version: "4.0.0"),@@ -298,7 +302,7 @@ struct BootstrapClassifierTests {         // it, which is `.indeterminate` — and `.indeterminate` proceeds.         try root.createStoreDirectory()         try Data("not a database".utf8).write(to: root.storeURL, options: .atomic)-        try root.writeMarker("8\n")+        try root.writeMarker("9\n")         try #require(StoreMetadata.recordedVersion(at: root.storeURL) == .indeterminate)          #expect(try LibraryRepository.classify(root.configuration, fileManager: .default) == .ready,@@ -364,9 +368,9 @@ private struct Cell: Sendable, CustomStringConvertible {         case .four: try root.writeMarker("4\n")         case .five: try root.writeMarker("5\n")         case .six: try root.writeMarker("6\n")-        case .seven: try root.writeMarker("7\n")         case .eight: try root.writeMarker("8\n")-        case .unrecognisedText: try root.writeMarker("9\n")+        case .nine: try root.writeMarker("9\n")+        case .unrecognisedText: try root.writeMarker("10\n")         case .nonUTF8: try root.writeMarkerBytes(ClassifierRoot.nonUTF8MarkerBytes)         }         if historicalMarker { try root.writeHistoricalMarker() }@@ -378,8 +382,8 @@ private struct Cell: Sendable, CustomStringConvertible {     func expectedState(recordedVersion: StoreMetadata.RecordedVersion) -> BootstrapState {         if case .below(let version) = recordedVersion { return .belowV5(version: version) }         let storePresent = family.isStorePresent-        if marker == .eight, storePresent { return .ready }-        if marker == .seven, storePresent { return .markerLagging(generation: "7") }+        if marker == .nine, storePresent { return .ready }+        if marker == .eight, storePresent { return .markerLagging(generation: "8") }         if !storePresent {             if marker != .absent { return .orphanedEvidence(kind: .readinessMarker) }             if historicalMarker { return .orphanedEvidence(kind: .historicalMarker) }@@ -406,7 +410,7 @@ private enum StoreFamily: String, CaseIterable, Sendable { }  private enum MarkerAxis: String, CaseIterable, Sendable {-    case absent, four, five, six, seven, eight, unrecognisedText, nonUTF8+    case absent, four, five, six, eight, nine, unrecognisedText, nonUTF8 }  /// What the seeded main file is meant to record. The expectation is derived from

diff --git a/Packages/AsterismCore/Tests/AsterismCoreTests/BootstrapStateCoverageTests.swift b/Packages/AsterismCore/Tests/AsterismCoreTests/BootstrapStateCoverageTests.swiftindex 75612c3..6dfc8a2 100644--- a/Packages/AsterismCore/Tests/AsterismCoreTests/BootstrapStateCoverageTests.swift+++ b/Packages/AsterismCore/Tests/AsterismCoreTests/BootstrapStateCoverageTests.swift@@ -23,7 +23,7 @@ import Testing ///   reaches, as far as bootstrap can observe: a `.sqlite` at the frozen path and ///   a marker beside it. What is lost is that the store *arrived* at V5 rather ///   than being born there. `MarkerContractTests` and-///   `V5CertificationPathTests` keep that half, on the retained+///   `CertificationPathTests` keep that half, on the retained ///   `v4-recorded-4.0.0.sqlite` fixture (task 12). /// * **The migration artefact is written as opaque bytes.** Nothing may construct ///   a valid sidecar once the codec is gone, and both the current bootstrap and@@ -79,14 +79,14 @@ struct AppBootstrapStateTests {     func unrecognisedMarkerFailsClosed() async throws {         let root = try LibraryRoot()         try await root.seedReadyLibrary(hostname: "f.example")-        // "8" is the version the app publishes, so the unopenable future version+        // "9" is the version the app publishes, so the unopenable future version         // this pins is the one after it.-        try root.writeMarker("9\n")+        try root.writeMarker("10\n")          await #expect(throws: LibraryRepositoryError.self) {             try await LibraryRepository.openForApp(root.configuration)         }-        #expect(try root.markerBytes() == Data("9\n".utf8),+        #expect(try root.markerBytes() == Data("10\n".utf8),                 "a refused open leaves the marker's bytes alone (Req 2.8)")         #expect(root.exists(root.storeURL), "and leaves the store it refused in place")     }@@ -231,8 +231,12 @@ private enum PreCertificationState: String, CaseIterable, Sendable {     case storeWithRetiredMarkerSix     /// `configurable-work-types` Req 8.7's update window, with the **live**     /// digit: the app has been updated and not yet launched, so the library-    /// still records `"7"`. The app opens it and runs the population pass; the-    /// extension must not, because it holds only a shared lock.+    /// still records `"8"`. The app opens it — the V8 → V9 stage drops the+    /// superseded columns on the way in — validates and republishes at `"9"`;+    /// the extension must not, because it holds only a shared lock and the+    /// conversion removes columns. The case name is historical: the lagging+    /// row holds one digit at a time and `drop-superseded-columns` substituted+    /// `"8"` for `"7"` (Q2), which is why the seed below writes `"8"`.     case storeWithLaggingMarkerSeven      func seed(into root: LibraryRoot) async throws {@@ -250,7 +254,7 @@ private enum PreCertificationState: String, CaseIterable, Sendable {             try root.removeMarker()             try root.writeMigrationArtefact()         case .storeWithFutureMarker:-            try root.writeMarker("9\n")+            try root.writeMarker("10\n")         case .storeWithRetiredMarkerFour:             try root.writeMarker("4\n")         case .storeWithRetiredMarkerFive:@@ -258,7 +262,7 @@ private enum PreCertificationState: String, CaseIterable, Sendable {         case .storeWithRetiredMarkerSix:             try root.writeMarker("6\n")         case .storeWithLaggingMarkerSeven:-            try root.writeMarker("7\n")+            try root.writeMarker("8\n")         }     } }@@ -268,7 +272,7 @@ private enum PreCertificationState: String, CaseIterable, Sendable { /// The bytes a certified library's readiness marker holds. Frozen persisted state /// — `FrozenLibraryPathTests` is where that is pinned; here it is the value the /// ready cases compare against.-private let readyMarkerBytes = "8\n"+private let readyMarkerBytes = "9\n"  /// The counts of a library seeded with exactly one `Site`. ///@@ -313,7 +317,7 @@ private final class LibraryRoot {     // MARK: - Seeding      /// The state Req 2.2 is about, reached the way the app reaches it: the-    /// app-role opener creates the store, certifies it and marks it `"7"`, and one+    /// app-role opener creates the store, certifies it and marks it `"9"`, and one     /// row is written through the repository it returns. No container opener and     /// no migration path is involved, so nothing here is removed by a later task.     func seedReadyLibrary(hostname: String) async throws {

diff --git a/Packages/AsterismCore/Tests/AsterismCoreTests/V5CertificationPathTests.swift b/Packages/AsterismCore/Tests/AsterismCoreTests/CertificationPathTests.swiftsimilarity index 68%rename from Packages/AsterismCore/Tests/AsterismCoreTests/V5CertificationPathTests.swiftrename to Packages/AsterismCore/Tests/AsterismCoreTests/CertificationPathTests.swiftindex 5a6db6c..83d7b28 100644--- a/Packages/AsterismCore/Tests/AsterismCoreTests/V5CertificationPathTests.swift+++ b/Packages/AsterismCore/Tests/AsterismCoreTests/CertificationPathTests.swift@@ -16,11 +16,11 @@ import Testing /// /// What is left is the two ends: a store on a retired generation is **refused /// before a container converts it**, and an empty store is marked at birth. The-/// refusal case still seeds through `V5RecordedStoreFixture` — a store the-/// container *would* open — because a store that could not be opened anyway-/// would prove nothing about when the refusal happens.+/// refusal case seeds through `V8RecordedStoreFixture` — a store the container+/// *would* open — because a store that could not be opened anyway would prove+/// nothing about when the refusal happens. @Suite("Certification paths", .serialized)-struct V5CertificationPathTests {+struct CertificationPathTests {      // MARK: - Helpers @@ -28,7 +28,7 @@ struct V5CertificationPathTests {         let url: URL         init() throws {             url = FileManager.default.temporaryDirectory.appending(-                path: "V5Certify-\(UUID())", directoryHint: .isDirectory)+                path: "Certify-\(UUID())", directoryHint: .isDirectory)             try FileManager.default.createDirectory(at: url, withIntermediateDirectories: true)         }         deinit { try? FileManager.default.removeItem(at: url) }@@ -44,21 +44,20 @@ struct V5CertificationPathTests {             .trimmingCharacters(in: .whitespacesAndNewlines)     } -    /// A store recorded at 5.0.0 — the state a device that stopped launching the-    /// app before `configurable-work-types` would be in, and one the declared-    /// V5 → V6 stage converts happily. That it *is* convertible is the point: the-    /// refusal below has to come from the marker, before any container exists,-    /// not from a store nothing could open.+    /// A store recorded at 8.0.0 — the state every installed device is in on+    /// the morning of the V9 update, and one the declared V8 → V9 stage converts+    /// happily. That it *is* convertible is the point: the refusal below has to+    /// come from the marker, before any container exists, not from a store+    /// nothing could open.     ///-    /// It was the 4.0.0 fixture, installed and then converted in a separate step.-    /// The declared V5 → V6 stage refuses a 4.0.0 store outright, and the shipped-    /// classifier already refused one before any container existed (Req 2.9,-    /// Decision 1) — so the frozen-snapshot seed is both the only constructible-    /// input and the faithful one.-    private func installStoreArrivedAtV5(_ configuration: LibraryConfiguration) throws {-        try V5RecordedStoreFixture.install(at: configuration.storeURL)+    /// It has been the frozen-snapshot seed at each version in turn, because+    /// each newly declared stage refuses the generation below it outright and+    /// the shipped classifier already refused one before any container existed+    /// (Req 2.9, Decision 1).+    private func installStoreArrivedAtV8(_ configuration: LibraryConfiguration) throws {+        try V8RecordedStoreFixture.install(at: configuration.storeURL)         #expect(try V4RecordedStoreFixture.recordedModelVersions(at: configuration.storeURL)-                == ["5.0.0"], "the seed is written by the frozen snapshot, not the live classes")+                == ["8.0.0"], "the seed is written by the frozen snapshot, not the live classes")     }      // MARK: - The retired generations@@ -73,19 +72,20 @@ struct V5CertificationPathTests {      /// The refusal happens in `classify`, before `ModelContainer.init`. That is     /// what the recorded version proves: this store would have been converted to-    /// 7.0.0 by any container construction, and it is still recorded at 5.0.0-    /// afterwards. The marker is left alone for the same reason — the recovery is-    /// a backup archive restored over this library, and a refusal that rewrote-    /// the evidence would take that away.+    /// 9.0.0 by any container construction — **destructively**, since the V8 → V9+    /// stage drops columns — and it is still recorded at 8.0.0 afterwards. The+    /// marker is left alone for the same reason: the recovery is a backup+    /// archive restored over this library, and a refusal that rewrote the+    /// evidence would take that away.     ///-    /// The 5.0.0 pin only means something alongside the control that follows it:-    /// the same store, marked `"7"`, opens and is recorded 7.0.0. That is what+    /// The 8.0.0 pin only means something alongside the control that follows it:+    /// the same store, marked `"8"`, opens and is recorded 9.0.0. That is what     /// makes the pin an ordering claim rather than a store nothing could convert.     @Test("A store on a retired marker generation is refused before anything converts it",-          arguments: ["4", "5", "6"])+          arguments: ["4", "5", "6", "7"])     func retiredMarkerGenerationIsRefusedBeforeConversion(digit: String) async throws {         let (dir, cfg) = try config()-        try installStoreArrivedAtV5(cfg)+        try installStoreArrivedAtV8(cfg)         try Data("\(digit)\n".utf8).write(to: cfg.readinessMarkerURL, options: .atomic)          do {@@ -97,29 +97,29 @@ struct V5CertificationPathTests {         }          #expect(try markerContent(cfg) == digit, "a refused open may not rewrite the marker")-        #expect(try V4RecordedStoreFixture.recordedModelVersions(at: cfg.storeURL) == ["5.0.0"],+        #expect(try V4RecordedStoreFixture.recordedModelVersions(at: cfg.storeURL) == ["8.0.0"],                 "the marker check must decide before ModelContainer.init converts anything")          // Control, mirroring the extension-side twin         // (`MarkerContractTests.extensionDeclinesBeforeOpeningAContainer`):-        // with a `"7"` marker the same store is reached, opened and converted.-        // Without it the 5.0.0 assertion above could hold because the store was+        // with an `"8"` marker the same store is reached, opened and converted.+        // Without it the 8.0.0 assertion above could hold because the store was         // unopenable rather than because the marker was read first.-        try Data("7\n".utf8).write(to: cfg.readinessMarkerURL, options: .atomic)+        try Data("8\n".utf8).write(to: cfg.readinessMarkerURL, options: .atomic)         _ = try await LibraryRepository.openForApp(cfg)-        #expect(try V4RecordedStoreFixture.recordedModelVersions(at: cfg.storeURL) == ["8.0.0"],+        #expect(try V4RecordedStoreFixture.recordedModelVersions(at: cfg.storeURL) == ["9.0.0"],                 "the same store converts once the marker check passes")         withExtendedLifetime(dir) {}     }      // MARK: - Mark-at-birth -    @Test("Mark-at-birth publishes \"8\" directly for an empty store")+    @Test("Mark-at-birth publishes \"9\" directly for an empty store")     func markAtBirthStillPublishesTheCurrentVersionDirectly() async throws {         let (dir, cfg) = try config()         let (result, _) = try await LibraryRepository.openForApp(cfg)         #expect(result == .ready(.zero))-        #expect(try markerContent(cfg) == "8",+        #expect(try markerContent(cfg) == "9",                 "an empty store has nothing to bring forward and is certified at birth (Q26)")         withExtendedLifetime(dir) {}     }

diff --git a/Packages/AsterismCore/Tests/AsterismCoreTests/CitationBlobRefreshTests.swift b/Packages/AsterismCore/Tests/AsterismCoreTests/CitationBlobRefreshTests.swiftindex bf0ffac..12ac13b 100644--- a/Packages/AsterismCore/Tests/AsterismCoreTests/CitationBlobRefreshTests.swift+++ b/Packages/AsterismCore/Tests/AsterismCoreTests/CitationBlobRefreshTests.swift@@ -4,71 +4,175 @@ import Testing  @testable import AsterismCore -/// Decision 4, the in-commit half: **columns written ⇒ blob refreshed**.+/// **The blob is the only home a citation has** (V9, T-2280). ///-/// Through phase 1 every citation writer in the repository writes the legacy-/// columns, while `Entry.citations` — which `LibraryValidator` is now the sole-/// reader through — returns the *blob* wherever one exists and falls back to the-/// columns only while it is nil (Q36). After the migration every Entry has a-/// blob. A commit that wrote the columns and left the blob alone would therefore-/// hand its own validation the pre-write citations against post-write values,-/// and the commit would refuse itself.-///-/// `V8PopulationPass` converges the two homes, but only in `reconcileAfterSync`-/// and at bootstrap — never inside a commit. So the refresh lives at the write-/// site, and these are the tests that would fail without it.-@Suite("Citation blob refresh at the write site", .serialized)+/// The seventeen citation columns still exist in the V8 stored shape, but+/// nothing writes them any more: `Entry.init` seeds the blob, every writer goes+/// through `setCitations` or `editCitations`, and every reader — `Entry`'s own+/// provenance accessors included — reads it back. This suite pins the three+/// things that follow: a capture is born with a blob; an edit is value-guarded,+/// repairs bytes that will not decode (Q24) and leaves a nil blob nil (Q23);+/// and a row that has somehow lost its blob reads as the default and is+/// **counted** rather than throwing under whichever screen asked first, or+/// quarantining its hostname (Q6, Q25).+@Suite("The citation blob is the only home", .serialized) struct CitationBlobRefreshTests {     private let host = "blob.example"      // MARK: - The value guard itself -    @Test("Refreshing a converged row changes nothing; a column write moves the blob")-    func refreshIsValueGuarded() throws {+    @Test("A row is born with a blob, and an edit that changes nothing writes nothing")+    func editingIsValueGuarded() throws {         let store = try BlobStore()         let entry = store.insertEntry(hostname: host, seconds: 10)         try store.save() -        // First write: there is no blob, so one is minted from the columns.-        #expect(LegacyColumns.refreshCitations(on: entry))-        let minted = entry.citationsData-        #expect(minted != nil)-        // Second: the two homes agree, so nothing is written.-        #expect(!LegacyColumns.refreshCitations(on: entry))+        // Born with one: `init` seeds the default, so no row this build creates+        // is ever nil-blob.+        let minted = try #require(entry.citationsData)+        #expect(try entry.citations == EntryCitations())++        // An edit that changes nothing writes nothing.+        #expect(!entry.editCitations { $0.chapterTitle = .absent })         #expect(entry.citationsData == minted) -        // A column write makes them disagree, and the refresh converges them.+        // One that changes something moves the bytes, and the derived accessor+        // reads it back.         entry.chapterTitle = "Chapter 7"-        entry.chapterTitleProvenanceRaw = FieldProvenanceKind.pattern.rawValue-        entry.chapterPatternID = UUID()-        entry.chapterPatternVersion = 1-        #expect(try entry.citations != LegacyColumns.citations(from: entry))-        #expect(LegacyColumns.refreshCitations(on: entry))-        #expect(try entry.citations == LegacyColumns.citations(from: entry))-        #expect(try entry.citations.chapterTitle.kind == .pattern)+        #expect(entry.editCitations {+            $0.chapterTitle = FieldProvenance.tolerant(+                kind: .pattern, patternID: UUID(), patternVersion: 1)+        })+        #expect(entry.citationsData != minted)+        #expect(entry.chapterTitleProvenance == .pattern)     } -    /// Bytes that will not decode are repaired from the columns rather than-    /// standing as a permanent diagnosis.-    @Test("An undecodable blob is replaced by what the columns say")-    func refreshRepairsAnUndecodableBlob() throws {+    /// Bytes that will not decode are **repaired in place** (Q24): the edit+    /// lands over the default value rather than being dropped. Dropping it left+    /// the caller's surrounding write — a manual assignment, a re-teach — with+    /// its provenance stuck at `.none`, which is a state the validator refuses+    /// on the next save. What the row loses is citations nothing could read.+    @Test("An undecodable blob is repaired by the edit that lands on it")+    func editingRepairsAnUndecodableBlob() throws {         let store = try BlobStore()         let entry = store.insertEntry(hostname: host, seconds: 10)-        entry.citationsData = Data("not json".utf8)+        let corrupt = Data("not json".utf8)+        entry.citationsData = corrupt         try store.save()          #expect(throws: (any Error).self) { try entry.citations }-        #expect(LegacyColumns.refreshCitations(on: entry))-        #expect(try entry.citations == LegacyColumns.citations(from: entry))+        #expect(entry.editCitations { $0.workAssignment = .manual })+        #expect(entry.citationsData != corrupt)+        #expect(try entry.citations.workAssignment == .manual)+        #expect(entry.workAssignmentProvenance == .manual)+        // Every arm the edit did not touch is the default, not the unreadable+        // row's former contents — which is the cost the decision accepts.+        #expect(try entry.citations.identity == .rawURL)+    }++    /// The write the repair exists for: `applyManualAssignment` is the shared+    /// body behind `moveEntry` and the detach disposition, and a skipped edit+    /// left it saving an Entry that holds a Work with `.none` provenance — the+    /// exact tuple `LibraryValidator` throws on.+    @Test("A manual assignment over undecodable bytes lands with its provenance")+    func manualAssignmentLandsOverUndecodableBytes() throws {+        let store = try BlobStore()+        let entry = store.insertEntry(hostname: host, seconds: 10)+        entry.citationsData = Data("not json".utf8)+        try store.save()++        LibraryRepository.applyManualAssignment(+            to: entry, at: Date(timeIntervalSince1970: 1_800_000_000))++        #expect(entry.workAssignmentProvenance == .manual)+        #expect(try entry.citations.workAssignment == .manual)+        #expect(try entry.citations.workURL == nil)+        #expect(entry.workURLAssignmentKind == nil)+    }++    /// A nil blob is **not** undecodable: an edit that changes nothing leaves it+    /// nil (Q23). `SiteReconciler.rewriteCitations` walks every Entry on a+    /// consolidation and rewrites nothing in the default value, so a converting+    /// `editCitations` would zero `entriesWithoutCitationBlobCount` — the one+    /// counter that tells the reader which rows lost their provenance — on the+    /// first reconcile after the upgrade.+    @Test("A citation rewrite over a nil-blob Entry leaves the blob nil")+    func rewritingCitationsLeavesANilBlobNil() throws {+        let store = try BlobStore()+        let entry = store.insertEntry(hostname: host, seconds: 10)+        entry.citationsData = nil+        try store.save()++        #expect(!SiteReconciler.rewriteCitations(of: entry, [UUID(): 3]))+        #expect(entry.citationsData == nil)++        // A rewrite over a *real* nil-blob-read edit still writes: it is only+        // the no-op that leaves the row alone.+        #expect(entry.editCitations { $0.workAssignment = .manual })+        #expect(entry.citationsData != nil)+    }++    // MARK: - Capture (Req 4: the blob is written at creation)++    @Test("A capture is saved with a citation blob")+    func captureWritesTheBlob() async throws {+        let fixture = try BlobFixture()+        let repository = try fixture.diagnosedRepository()++        _ = try await repository.capture(+            CaptureDraft(+                captureTitle: "Chapter 7 - Real Work", captureTitleSource: .host,+                rawURLString: "https://\(host)/read?chapter=7"))++        let facts = try fixture.citationFacts()+        #expect(facts.count == 1)+        #expect(facts.first?.hasBlob == true)+    }++    // MARK: - A nil blob (Q6)++    @Test("A nil-blob Entry reads as the default and is counted, not quarantined")+    func aNilBlobReadsAsTheDefaultAndIsCounted() throws {+        let fixture = try BlobFixture()+        try fixture.seed { context in+            let site = Site(hostname: self.host)+            site.mode = .untaught+            context.insert(site)+            let entry = BlobFixture.insertEntry(context, hostname: self.host, seconds: 10)+            entry.site = site+            // What a row a V8 build wrote looks like once V9 has dropped the+            // columns it kept its citations in.+            entry.citationsData = nil+        }++        let context = ModelContext(fixture.container)+        let entry = try #require(try context.fetch(FetchDescriptor<Entry>()).first)+        // An ordinary read answers rather than throwing.+        #expect(try entry.citations == EntryCitations())+        #expect(entry.citationValues.identity == .rawURL)+        #expect(try LibraryRepository.snapshot(entry).identityKeyVersion == 1)++        // It is **counted**, and that is the whole of the report (Req 19, Q25).+        let scan = try LibraryToleranceScan.scan(context: ModelContext(fixture.container))+        #expect(scan.entriesWithoutCitationBlobCount == 1)++        // It is **not** quarantined. Refusing every write on the hostname+        // recovers nothing — the provenance went at the drop stage and no write+        // on this site brings it back — and it would take the reader's repair+        // (a re-teach, a manual assignment) away with it. Undecodable bytes+        // still throw; `MembershipValidationTests` pins that half.+        let diagnostics = try LibraryValidator.validate(context: ModelContext(fixture.container))+        #expect(diagnostics.diagnoses.isEmpty)+        #expect(diagnostics.quarantineMap()[self.host] == nil)     }      // MARK: - Composed teaching (Req 3.2) -    /// The blocker this suite exists for: on a library that has migrated, every-    /// Entry carries a blob, so the first re-teach reads the pre-write blob-    /// against the post-write columns and refuses itself with "absent chapter-    /// must have none provenance".-    @Test("A re-teach on a migrated library commits and leaves the blob equal to the columns")+    /// The blocker this suite exists for: a re-teach's own validation reads the+    /// citations back inside the commit, so a writer that left the blob behind+    /// refused itself with "absent chapter must have none provenance". It cannot+    /// now — the blob *is* what the writer wrote.+    @Test("A re-teach on a migrated library commits and leaves every citation in the blob")     func composedTeachingRefreshesTheBlob() async throws {         let fixture = try BlobFixture()         try fixture.seed { context in@@ -78,7 +182,8 @@ struct CitationBlobRefreshTests {             BlobFixture.insertEntry(context, hostname: self.host, seconds: 10)         }         // Exactly what the migration leaves behind (Req 2.1): a blob per Entry.-        try fixture.runPopulationPass()+        // It used to take a conversion pass over the seeded rows; `Entry.init`+        // seeds the default blob since V9 (Q13), so a row is born with one.         #expect(try fixture.citationFacts().allSatisfy(\.hasBlob))          let repository = try fixture.diagnosedRepository()@@ -95,8 +200,6 @@ struct CitationBlobRefreshTests {          for facts in try fixture.citationFacts() {             #expect(facts.hasBlob)-            // The blob is what the columns say, not what they said before.-            #expect(facts.matchesColumns)             #expect(facts.chapterKind == .pattern)             #expect(facts.workAssignmentKind == .pattern)         }@@ -105,7 +208,7 @@ struct CitationBlobRefreshTests {      // MARK: - Recalculation (the re-parse commit's writer) -    @Test("Recalculation on a migrated library commits and leaves the blob equal to the columns")+    @Test("Recalculation on a migrated library commits and leaves every citation in the blob")     func recalculationRefreshesTheBlob() async throws {         let fixture = try BlobFixture()         try fixture.seed { context in@@ -114,7 +217,6 @@ struct CitationBlobRefreshTests {             // recalculation has something to write.             BlobFixture.insertEntry(context, hostname: self.host, seconds: 10)         }-        try fixture.runPopulationPass()          let repository = try fixture.diagnosedRepository()         let contract = try await repository.previewRecalculation(hostname: host)@@ -125,7 +227,7 @@ struct CitationBlobRefreshTests {         }          for facts in try fixture.citationFacts() {-            #expect(facts.matchesColumns)+            #expect(facts.hasBlob)             #expect(facts.chapterKind == .pattern)         }     }@@ -143,12 +245,12 @@ private final class BlobStore {         directory = FileManager.default.temporaryDirectory             .appending(path: "AsterismCitationBlob-\(UUID())", directoryHint: .isDirectory)         try FileManager.default.createDirectory(at: directory, withIntermediateDirectories: true)-        let schema = Schema(versionedSchema: AsterismSchemaV8.self)+        let schema = Schema(versionedSchema: AsterismSchemaV9.self)         let configuration = ModelConfiguration(             "AsterismV3", schema: schema,             url: directory.appending(path: "library.store"), cloudKitDatabase: .none)         container = try ModelContainer(-            for: schema, migrationPlan: AsterismV8MigrationPlan.self,+            for: schema, migrationPlan: AsterismV9MigrationPlan.self,             configurations: [configuration])         context = ModelContext(container)     }@@ -168,7 +270,6 @@ private final class BlobStore { /// crosses out. private struct CitationFacts {     var hasBlob: Bool-    var matchesColumns: Bool     var chapterKind: FieldProvenanceKind     var workAssignmentKind: FieldProvenanceKind }@@ -199,20 +300,12 @@ private struct BlobFixture {         try context.save()     } -    func runPopulationPass() throws {-        let context = ModelContext(container)-        try V8PopulationPass.run(context: context)-        try context.save()-    }-     func citationFacts() throws -> [CitationFacts] {         let context = ModelContext(container)         return try context.fetch(FetchDescriptor<Entry>()).map { entry in-            let columns = LegacyColumns.citations(from: entry)             let blob = try? entry.citations             return CitationFacts(                 hasBlob: entry.citationsData != nil,-                matchesColumns: blob == columns,                 chapterKind: blob?.chapterTitle.kind ?? .none,                 workAssignmentKind: blob.map(Self.kind(of:)) ?? .none)         }

diff --git a/Packages/AsterismCore/Tests/AsterismCoreTests/CitationResolutionParityTests.swift b/Packages/AsterismCore/Tests/AsterismCoreTests/CitationResolutionParityTests.swiftindex 077c9e1..abc8514 100644--- a/Packages/AsterismCore/Tests/AsterismCoreTests/CitationResolutionParityTests.swift+++ b/Packages/AsterismCore/Tests/AsterismCoreTests/CitationResolutionParityTests.swift@@ -47,8 +47,9 @@ struct CitationResolutionParityTests {             site: fixture.site)         fixture.site.patterns = fixture.site.patternValues + [v2]         // The Entry still cites (v1 id, version 1) for its chapter.-        #expect(fixture.entry.chapterPatternID == fixture.titlePattern.id)-        #expect(fixture.entry.chapterPatternVersion == 1)+        #expect(+            fixture.entry.citationValues.chapterTitle.patternID == fixture.titlePattern.id)+        #expect(fixture.entry.citationValues.chapterTitle.patternVersion == 1)          let diagnostics = try LibraryValidator.validate(graph: fixture.graph)         #expect(diagnostics.quarantineMap().isEmpty)@@ -65,7 +66,7 @@ struct CitationResolutionParityTests {             version: 2, isActive: true, createdAt: Self.epoch,             definition: .wholeTitle, site: fixture.site)         fixture.site.patterns = fixture.site.patternValues + [v2]-        #expect(fixture.entry.identityNameTitleRuleVersion == 1)+        #expect(fixture.entry.citationValues.identity.nameTitleRule?.version == 1)          let diagnostics = try LibraryValidator.validate(graph: fixture.graph)         #expect(diagnostics.quarantineMap().isEmpty)@@ -87,8 +88,7 @@ struct CitationResolutionParityTests {                 sequence: URLFieldSelector(locator: .query(name: ExactScalarString("chapter")))),             site: fixture.site)         fixture.site.urlRules = fixture.site.urlRuleValues + [v3]-        #expect(fixture.work.urlIdentityRuleVersion == 2)-        #expect(fixture.entry.identityURLRuleVersion == 2)+        #expect(fixture.entry.citationValues.identity.urlRule?.version == 2)          let diagnostics = try LibraryValidator.validate(graph: fixture.graph)         #expect(diagnostics.quarantineMap().isEmpty)@@ -107,11 +107,10 @@ struct CitationResolutionParityTests {     /// A `WorkSiteMembership` cites its rule by UUID alone and carries no     /// version, so there is no `(id, version)` pair to resolve and no version to     /// mismatch — the version for display resolves by row lookup at read time.-    /// The retained column keeps its stale value until V9 and nothing reads it.+    /// The retained column that kept a stale value beside it went at V9.     @Test("The Work rule identity no longer resolves a cited version at all")     func workIdentityIsNoLongerACitedRuleSite() throws {         let fixture = try ValidatorFixtures.wcSegmentIdentitySequence()-        fixture.work.urlIdentityRuleVersion = 99         fixture.membership.urlIdentityRuleID = UUID()  // cites a rule no Site owns          let diagnostics = try LibraryValidator.validate(graph: fixture.graph)@@ -122,7 +121,7 @@ struct CitationResolutionParityTests {     @Test("A version mismatch on the assignment reference is diagnosed, not resolved")     func ruleVersionMismatchDiagnosesAtRequiredReference() throws {         let fixture = try ValidatorFixtures.wcSegmentIdentitySequence()-        fixture.entry.workURLRuleVersion = 99+        fixture.entry.citeWorkURLRule(version: 99)          let diagnostics = try LibraryValidator.validate(graph: fixture.graph)         #expect(diagnostics.quarantineMap()[fixture.site.hostname] != nil)@@ -148,9 +147,9 @@ struct CitationResolutionParityTests {             try store.insertTitlePattern(site: site, isActive: true, version: 2)             let entry = store.insertEntry(                 hostname: "cited.example", title: "A Cited Work - Chapter 3")-            entry.workAssignmentProvenance = .pattern-            entry.workPatternID = citedID-            entry.workPatternVersion = 1+            entry.editCitations {+                $0.workAssignment = .pattern(CitedRule(id: citedID, version: 1))+            }         }         let repository = try await library.openForApp() @@ -173,9 +172,9 @@ struct CitationResolutionParityTests {                 definition: .segmented)             let entry = store.insertEntry(                 hostname: "cited.example", title: "A Cited Work - Chapter 3")-            entry.workAssignmentProvenance = .pattern-            entry.workPatternID = citedID-            entry.workPatternVersion = 99+            entry.editCitations {+                $0.workAssignment = .pattern(CitedRule(id: citedID, version: 99))+            }         }         let repository = try await library.openForApp() @@ -197,9 +196,9 @@ struct CitationResolutionParityTests {             store.insertEntry(hostname: "present.example", title: "resolvable", offset: 10)             let orphan = store.insertEntry(                 hostname: "orphan.example", title: "orphaned citer")-            orphan.workAssignmentProvenance = .pattern-            orphan.workPatternID = UUID()-            orphan.workPatternVersion = 1+            orphan.editCitations {+                $0.workAssignment = .pattern(CitedRule(id: UUID(), version: 1))+            }         }         let repository = try await library.openForApp() @@ -230,9 +229,9 @@ struct CitationResolutionParityTests {             try store.insertTitlePattern(site: site, isActive: true, version: 2)             let entry = store.insertEntry(                 id: entryID, hostname: "cited.example", title: "A Cited Work - Chapter 3")-            entry.workAssignmentProvenance = .pattern-            entry.workPatternID = citedID-            entry.workPatternVersion = 1+            entry.editCitations {+                $0.workAssignment = .pattern(CitedRule(id: citedID, version: 1))+            }         }         let repository = try await library.openForApp() @@ -252,9 +251,9 @@ struct CitationResolutionParityTests {             store.insertSite(hostname: "present.example")             let orphan = store.insertEntry(                 id: entryID, hostname: "orphan.example", title: "Orphaned Citer")-            orphan.workAssignmentProvenance = .pattern-            orphan.workPatternID = citedID-            orphan.workPatternVersion = 1+            orphan.editCitations {+                $0.workAssignment = .pattern(CitedRule(id: citedID, version: 1))+            }         }         let repository = try await library.openForApp() @@ -317,17 +316,18 @@ struct CitationResolutionParityTests {         let entry = try #require(try context.fetch(FetchDescriptor<Entry>())             .first { $0.id == snapshot.id })         let assigned = try #require(entry.site, "the capture left its Entry unassigned")-        if let patternID = entry.chapterPatternID, let patternVersion = entry.chapterPatternVersion {+        let citations = entry.citationValues+        if let chapter = citations.chapterTitle.patternID,+           let chapterVersion = citations.chapterTitle.patternVersion {             #expect(assigned.patternValues.contains {-                $0.id == patternID && $0.version == patternVersion+                $0.id == chapter && $0.version == chapterVersion             }, "the cited chapter pattern is not owned by the assigned Site row")         } else {             Issue.record("the capture cited no chapter pattern; the search-space assertion proves nothing")         }-        let ruleID = try #require(entry.identityURLRuleID)-        let ruleVersion = try #require(entry.identityURLRuleVersion)+        let cited = try #require(citations.identity.urlRule)         #expect(assigned.urlRuleValues.contains {-            $0.id == ruleID && $0.version == ruleVersion+            $0.id == cited.id && $0.version == cited.version         }, "the cited URL rule is not owned by the assigned Site row")     } }

diff --git a/Packages/AsterismCore/Tests/AsterismCoreTests/CitationSurgery.swift b/Packages/AsterismCore/Tests/AsterismCoreTests/CitationSurgery.swiftnew file mode 100644index 0000000..567e61f--- /dev/null+++ b/Packages/AsterismCore/Tests/AsterismCoreTests/CitationSurgery.swift@@ -0,0 +1,91 @@+import Foundation++@testable import AsterismCore++/// **Test-only citation surgery.**+///+/// Several suites seed a *broken* citation — a version no rule holds, an id no+/// Site owns — to prove the validator reports it or the reconciler repairs it.+/// Each of those used to be a one-line write to a retired column. Since V9 the+/// blob is a citation's only home and its arms are typed, so breaking one means+/// naming the arm; these helpers say that once instead of at twenty call sites.+///+/// Nothing in production does any of this. A blob whose arms disagree is a state+/// only a partial write produced, and the columns that made one spellable are+/// gone.+extension EntryCitations.Identity {+    /// The same arm with the name contributor cited at a different version.+    func citingNameTitleVersion(_ version: Int) -> Self {+        guard let url = urlRule, let name = nameTitleRule else { return self }+        let replaced = CitedRule(id: name.id, version: version)+        switch self {+        case .rawURL: return self+        case .rule: return .rule(url: url, nameTitle: replaced)+        case .composed: return .composed(url: url, nameTitle: replaced)+        }+    }++    /// The same arm with no name contributor at all.+    var citingNoNameTitle: Self {+        guard let url = urlRule else { return self }+        switch self {+        case .rawURL: return self+        case .rule: return .rule(url: url, nameTitle: nil)+        case .composed: return .composed(url: url, nameTitle: nil)+        }+    }++    /// The same arm citing a different URL rule row.+    func citingURLRuleID(_ id: UUID) -> Self {+        guard let url = urlRule else { return self }+        let replaced = CitedRule(id: id, version: url.version)+        switch self {+        case .rawURL: return self+        case .rule: return .rule(url: replaced, nameTitle: nameTitleRule)+        case .composed: return .composed(url: replaced, nameTitle: nameTitleRule)+        }+    }+}++extension FieldProvenance {+    /// The same provenance citing its pattern at a different version.+    func citingPatternVersion(_ version: Int) -> FieldProvenance {+        FieldProvenance.tolerant(kind: kind, patternID: patternID, patternVersion: version)+    }++    /// The same provenance citing a different pattern row.+    func citingPatternID(_ id: UUID) -> FieldProvenance {+        FieldProvenance.tolerant(kind: kind, patternID: id, patternVersion: patternVersion)+    }+}++extension Entry {+    /// Re-points every URL-rule citation — the identity basis, the Work+    /// extraction and the chapter sequence — at one id, which is what it takes+    /// to reach the extraction replay: the tuple table requires all three to+    /// name the same rule.+    func citeURLRule(id: UUID) {+        editCitations { citations in+            citations.identity = citations.identity.citingURLRuleID(id)+            if let urlWork = citations.urlWork {+                citations.urlWork = CitedRule(id: id, version: urlWork.version)+            }+            if let sequence = citations.chapterSequence {+                citations.chapterSequence = CitedRule(id: id, version: sequence.version)+            }+        }+    }++    /// Re-points the Work-assignment URL rule — both the `.urlRule` arm and the+    /// `workURL` citation beside it, which are one column pair's worth of state.+    func citeWorkURLRule(id: UUID? = nil, version: Int? = nil) {+        editCitations { citations in+            guard let current = citations.workAssignment.urlRuleRule ?? citations.workURL+            else { return }+            let replaced = CitedRule(+                id: id ?? current.id, version: version ?? current.version)+            citations.workAssignment = .urlRule(replaced)+            citations.workURL = replaced+        }+    }+}

diff --git a/Packages/AsterismCore/Tests/AsterismCoreTests/CitedPatternResolutionTests.swift b/Packages/AsterismCore/Tests/AsterismCoreTests/CitedPatternResolutionTests.swiftindex 85c974a..f958c0e 100644--- a/Packages/AsterismCore/Tests/AsterismCoreTests/CitedPatternResolutionTests.swift+++ b/Packages/AsterismCore/Tests/AsterismCoreTests/CitedPatternResolutionTests.swift@@ -266,17 +266,16 @@ private final class CitedResolutionFixture {          let rawURL = "https://\(hostname)/read?\(workQuery)=\(workIdentity)&\(sequenceQuery)=\(sequence)"         let workTitle = "Work \(workIdentity)"-        let work = Work(displayTitle: workTitle, siteHostname: hostname, timestamp: epoch)-        work.setLegacyColumns {+        let work = Work(displayTitle: workTitle, timestamp: epoch)+        work.primaryMembershipEdit {             $0.urlIdentity = workIdentity             $0.urlIdentityState = .rule             $0.urlIdentityRuleID = rule.id         }-        work.urlIdentityRuleVersion = rule.version         context.insert(work)-        // Both halves in the same save (Req 1.4), pointing at *this* row — the-        // one that owns the rule the Work's identity cites.-        work.setLegacySite(site)+        // The membership is pinned at *this* row — the one that owns the rule+        // the Work's identity cites (Req 1.4).+        work.primaryMembershipEdit { $0.site = site }          let identity = try URLDerivedEntryIdentity(             hostname: ExactScalarString(hostname),@@ -287,25 +286,22 @@ private final class CitedResolutionFixture {             captureTitleSource: .host, rawURLString: rawURL, hostname: hostname,             entryIdentityKey: EntryIdentityKeyV2Codec.encode(identity),             timestamp: epoch, work: work)-        entry.identityKeyVersion = 2         entry.identityBasis = .urlRule         entry.conservativeIdentityKey = rawURL         entry.urlWorkIdentity = workIdentity-        entry.urlWorkRuleID = rule.id-        entry.urlWorkRuleVersion = rule.version         entry.chapterSequence = sequence-        entry.chapterSequenceRuleID = rule.id-        entry.chapterSequenceRuleVersion = rule.version-        entry.identityURLRuleID = rule.id-        entry.identityURLRuleVersion = rule.version         entry.chapterTitle = "Chapter \(sequence)"-        entry.chapterTitleProvenance = .pattern-        entry.chapterPatternID = pattern.id-        entry.chapterPatternVersion = pattern.version-        entry.workAssignmentProvenance = .urlRule-        entry.workURLAssignmentKind = .identity-        entry.workURLRuleID = rule.id-        entry.workURLRuleVersion = rule.version+        let citedRule = CitedRule(id: rule.id, version: rule.version)+        try entry.setCitations(+            EntryCitations(+                identity: .rule(url: citedRule, nameTitle: nil),+                urlWork: citedRule,+                chapterSequence: citedRule,+                chapterTitle: FieldProvenance.tolerant(+                    kind: .pattern, patternID: pattern.id, patternVersion: pattern.version),+                workAssignment: .urlRule(citedRule),+                workURL: citedRule,+                workURLAssignmentKind: .identity))         context.insert(entry)         // Same row again: this Entry cites this row's title pattern and URL         // rule, so this row is where its citations resolve.

diff --git a/Packages/AsterismCore/Tests/AsterismCoreTests/ComposedCaptureTests.swift b/Packages/AsterismCore/Tests/AsterismCoreTests/ComposedCaptureTests.swiftindex 495005a..fae5bcb 100644--- a/Packages/AsterismCore/Tests/AsterismCoreTests/ComposedCaptureTests.swift+++ b/Packages/AsterismCore/Tests/AsterismCoreTests/ComposedCaptureTests.swift@@ -38,13 +38,13 @@ struct ComposedCaptureTests {         let entry = try #require(try context.fetch(FetchDescriptor<Entry>()).first { $0.id == snapshot.id })         try LibraryValidator.validateEntryTuple(             entry: entry, site: fixture.site(context), works: entry.work.map { [$0] } ?? [])-        #expect(entry.identityKeyVersion == 2)+        #expect(entry.citationValues.identity.keyVersion == 2)         #expect(entry.conservativeIdentityKey == entry.rawURLString)         #expect(entry.chapterTitle == "Chapter 9")         #expect(entry.chapterSequence == "9")         #expect(entry.urlWorkIdentity == "42")         // Reused the Work created for identity 42 by the teach.-        #expect(entry.work?.legacyColumns.urlIdentity == "42")+        #expect(entry.work?.primaryMembership?.urlIdentity == "42")     }      @Test("Capture after whole-title + sequence teach: v3 key with the title-derived name")@@ -58,8 +58,8 @@ struct ComposedCaptureTests {          let context = fixture.freshContext()         let entry = try #require(try context.fetch(FetchDescriptor<Entry>()).first { $0.id == snapshot.id })-        #expect(entry.identityKeyVersion == 3)-        #expect(entry.identityNameTitleRuleID != nil)+        #expect(entry.citationValues.identity.keyVersion == 3)+        #expect(entry.citationValues.identity.nameTitleRule != nil)         #expect(entry.chapterSequence == "2")         #expect(entry.urlWorkIdentity == nil)         let expected = EntryIdentityKeyV3Codec.encode(try URLSequenceNameIdentity(@@ -84,7 +84,7 @@ struct ComposedCaptureTests {          let context = fixture.freshContext()         let entry = try #require(try context.fetch(FetchDescriptor<Entry>()).first { $0.id == snapshot.id })-        #expect(entry.identityKeyVersion == 1)                    // conservative+        #expect(entry.citationValues.identity.keyVersion == 1)                    // conservative         #expect(entry.entryIdentityKey == entry.rawURLString)         #expect(entry.chapterSequence == nil)         #expect(entry.chapterTitle == "Chapter 3")                // settled by the title@@ -107,7 +107,7 @@ struct ComposedCaptureTests {         let works = try context.fetch(FetchDescriptor<Work>())         #expect(works.count == 1)         let work = try #require(works.first)-        #expect(work.legacyColumns.urlIdentity == "42")+        #expect(work.primaryMembership?.urlIdentity == "42")         #expect(work.lastParsedTitle == "Real Work Renamed")         #expect(work.displayTitle == "Real Work Renamed")   // provenance is parsed     }@@ -119,7 +119,7 @@ struct ComposedCaptureTests {         let snapshot = try await fixture.capture(title: "Anything", rawURL: "https://ex.com/read?id=1")         let context = fixture.freshContext()         let entry = try #require(try context.fetch(FetchDescriptor<Entry>()).first { $0.id == snapshot.id })-        #expect(entry.identityKeyVersion == 1)+        #expect(entry.citationValues.identity.keyVersion == 1)         #expect(entry.entryIdentityKey == "https://ex.com/read?id=1")         #expect(entry.conservativeIdentityKey == "https://ex.com/read?id=1")         #expect(entry.work == nil)

diff --git a/Packages/AsterismCore/Tests/AsterismCoreTests/ComposedRecalculationTests.swift b/Packages/AsterismCore/Tests/AsterismCoreTests/ComposedRecalculationTests.swiftindex fe0e52e..cc2c2ea 100644--- a/Packages/AsterismCore/Tests/AsterismCoreTests/ComposedRecalculationTests.swift+++ b/Packages/AsterismCore/Tests/AsterismCoreTests/ComposedRecalculationTests.swift@@ -57,7 +57,7 @@ struct ComposedRecalculationTests {                 entryIdentityKey: "https://ex.com/read?id=42&chapter=9",                 timestamp: Date(timeIntervalSince1970: 99))             entry.conservativeIdentityKey = entry.rawURLString-            entry.identityKeyVersion = 1+            entry.editCitations { $0.identity = .rawURL }             entry.identityBasis = .conservative             context.insert(entry)         }@@ -71,7 +71,7 @@ struct ComposedRecalculationTests {         let context = fixture.freshContext()         #expect(try LibraryValidator.validate(context: context).tupleDiagnoses[host] == nil)         let entry = try #require(try context.fetch(FetchDescriptor<Entry>()).first { $0.id == drifted })-        #expect(entry.identityKeyVersion == 2)      // rule applied+        #expect(entry.citationValues.identity.keyVersion == 2)      // rule applied         #expect(entry.chapterSequence == "9")         #expect(entry.chapterTitle == "Chapter 9")         #expect(entry.work != nil)

diff --git a/Packages/AsterismCore/Tests/AsterismCoreTests/ComposedTeachingRepositoryTests.swift b/Packages/AsterismCore/Tests/AsterismCoreTests/ComposedTeachingRepositoryTests.swiftindex 1ad829a..735814f 100644--- a/Packages/AsterismCore/Tests/AsterismCoreTests/ComposedTeachingRepositoryTests.swift+++ b/Packages/AsterismCore/Tests/AsterismCoreTests/ComposedTeachingRepositoryTests.swift@@ -55,7 +55,7 @@ struct ComposedTeachingRepositoryTests {             #expect(entry.conservativeIdentityKey == entry.rawURLString)         }         let e1Entry = try #require(entries.first { $0.id == e1 })-        #expect(e1Entry.identityKeyVersion == 2)+        #expect(e1Entry.citationValues.identity.keyVersion == 2)         #expect(e1Entry.identityBasis == .urlRule)         #expect(e1Entry.chapterTitle == "Chapter 7")         #expect(e1Entry.chapterSequence == "7")@@ -88,9 +88,10 @@ struct ComposedTeachingRepositoryTests {         let context = fixture.freshContext()         #expect(try LibraryValidator.validate(context: context).tupleDiagnoses[host] == nil)         let entry = try #require(try context.fetch(FetchDescriptor<Entry>()).first { $0.id == e1 })-        #expect(entry.identityKeyVersion == 3)-        #expect(entry.identityNameTitleRuleID == titleID)-        #expect(entry.identityNameTitleRuleVersion == titleVersion)+        #expect(entry.citationValues.identity.keyVersion == 3)+        #expect(+            entry.citationValues.identity.nameTitleRule+                == CitedRule(id: titleID, version: titleVersion))         #expect(entry.urlWorkIdentity == nil)         #expect(entry.chapterSequence == "7")     }@@ -155,7 +156,7 @@ struct ComposedTeachingRepositoryTests {         let midContext = fixture.freshContext()         let midEntry = try #require(try midContext.fetch(FetchDescriptor<Entry>()).first { $0.id == e1 })         let firstKey = midEntry.entryIdentityKey-        let firstNameVersion = midEntry.identityNameTitleRuleVersion+        let firstNameVersion = midEntry.citationValues.identity.nameTitleRule?.version          // Re-teach the title rule with a leading trim → name "Solo Story".         let second = try await fixture.repository.projectComposedTeaching(@@ -173,8 +174,9 @@ struct ComposedTeachingRepositoryTests {         #expect(try LibraryValidator.validate(context: afterContext).tupleDiagnoses[host] == nil)         let afterEntry = try #require(try afterContext.fetch(FetchDescriptor<Entry>()).first { $0.id == e1 })         #expect(afterEntry.entryIdentityKey != firstKey)   // key recomputed with the trimmed name-        #expect(afterEntry.identityNameTitleRuleVersion == titleV2)-        #expect(afterEntry.identityNameTitleRuleVersion != firstNameVersion)+        let afterNameVersion = afterEntry.citationValues.identity.nameTitleRule?.version+        #expect(afterNameVersion == titleV2)+        #expect(afterNameVersion != firstNameVersion)         let expected = EntryIdentityKeyV3Codec.encode(try URLSequenceNameIdentity(             hostname: ExactScalarString(host), workName: ExactScalarString("Solo Story"),             chapterSequence: ExactScalarString("7")))@@ -246,7 +248,7 @@ struct ComposedTeachingRepositoryTests {                 timestamp: Date(timeIntervalSince1970: 5))             entry.conservativeIdentityKey = entry.rawURLString             entry.chapterTitle = ""-            entry.chapterTitleProvenanceRaw = FieldProvenanceKind.manual.rawValue+            entry.editCitations { $0.chapterTitle = .manual }             context.insert(entry)         } @@ -262,7 +264,7 @@ struct ComposedTeachingRepositoryTests {         let context = fixture.freshContext()         #expect(try context.fetch(FetchDescriptor<TitlePattern>()).isEmpty)         let e1Entry = try #require(try context.fetch(FetchDescriptor<Entry>()).first { $0.id == e1 })-        #expect(e1Entry.identityKeyVersion == 1)+        #expect(e1Entry.citationValues.identity.keyVersion == 1)     }      // MARK: - Identity-matched Work renaming (Req 3.21)@@ -311,7 +313,7 @@ struct ComposedTeachingRepositoryTests {         }         let seeded = fixture.freshContext()         let seededWork = try #require(try seeded.fetch(FetchDescriptor<Work>()).first)-        #expect(seededWork.legacyColumns.urlIdentity == "regressor")   // identity-matched from here on+        #expect(seededWork.primaryMembership?.urlIdentity == "regressor")   // identity-matched from here on         #expect(seededWork.displayTitle == "Read The Regressor Creates Everything")          // Re-teach the same rules with a leading trim.@@ -371,8 +373,8 @@ struct ComposedTeachingRepositoryTests {         #expect(membership.urlIdentityRuleID != nil)         // The retained columns hold the same answer until V9 (Decision 3), so         // neither home can be read as the Work having no identity.-        #expect(work.legacyColumns.urlIdentity == "regressor")-        #expect(work.legacyColumns.urlIdentityState == .rule)+        #expect(work.primaryMembership?.urlIdentity == "regressor")+        #expect(work.primaryMembership?.urlIdentityState == .rule)     }      @Test("A manual display title survives the rename an identity match applies (Req 3.21)")@@ -535,7 +537,7 @@ struct ComposedRepoFixture {                     rawURLString: spec.url, hostname: host, entryIdentityKey: spec.url,                     timestamp: Date(timeIntervalSince1970: seconds))                 entry.conservativeIdentityKey = spec.url-                entry.identityKeyVersion = 1+                entry.editCitations { $0.identity = .rawURL }                 entry.identityBasis = .conservative                 context.insert(entry)                 seconds += 1

diff --git a/Packages/AsterismCore/Tests/AsterismCoreTests/ConvergedRuleGroupValidationTests.swift b/Packages/AsterismCore/Tests/AsterismCoreTests/ConvergedRuleGroupValidationTests.swiftindex 92da693..fb1ca07 100644--- a/Packages/AsterismCore/Tests/AsterismCoreTests/ConvergedRuleGroupValidationTests.swift+++ b/Packages/AsterismCore/Tests/AsterismCoreTests/ConvergedRuleGroupValidationTests.swift@@ -348,12 +348,12 @@ private final class RuleGroupStore {         let directory = FileManager.default.temporaryDirectory             .appending(path: "AsterismConvergedRules-\(UUID())", directoryHint: .isDirectory)         try FileManager.default.createDirectory(at: directory, withIntermediateDirectories: true)-        let schema = Schema(versionedSchema: AsterismSchemaV8.self)+        let schema = Schema(versionedSchema: AsterismSchemaV9.self)         let configuration = ModelConfiguration(             "AsterismV3", schema: schema,             url: directory.appending(path: "library.store"), cloudKitDatabase: .none)         let container = try ModelContainer(-            for: schema, migrationPlan: AsterismV8MigrationPlan.self,+            for: schema, migrationPlan: AsterismV9MigrationPlan.self,             configurations: [configuration])         self.init(context: ModelContext(container))         retained = container

diff --git a/Packages/AsterismCore/Tests/AsterismCoreTests/CrossSiteDuplicateScanTests.swift b/Packages/AsterismCore/Tests/AsterismCoreTests/CrossSiteDuplicateScanTests.swiftindex 6aadc55..f1a9c00 100644--- a/Packages/AsterismCore/Tests/AsterismCoreTests/CrossSiteDuplicateScanTests.swift+++ b/Packages/AsterismCore/Tests/AsterismCoreTests/CrossSiteDuplicateScanTests.swift@@ -244,12 +244,12 @@ private final class ScanStore {         directory = FileManager.default.temporaryDirectory             .appending(path: "AsterismCrossSiteScan-\(UUID())", directoryHint: .isDirectory)         try FileManager.default.createDirectory(at: directory, withIntermediateDirectories: true)-        let schema = Schema(versionedSchema: AsterismSchemaV8.self)+        let schema = Schema(versionedSchema: AsterismSchemaV9.self)         let configuration = ModelConfiguration(             "AsterismV3", schema: schema,             url: directory.appending(path: "library.store"), cloudKitDatabase: .none)         container = try ModelContainer(-            for: schema, migrationPlan: AsterismV8MigrationPlan.self,+            for: schema, migrationPlan: AsterismV9MigrationPlan.self,             configurations: [configuration])         context = ModelContext(container)     }@@ -285,7 +285,6 @@ private final class ScanStore {             membership.urlIdentity = identity             membership.urlIdentityState = identity == nil ? .none : .rule         }-        LegacyColumns.refreshMembership(on: work)         return work     } 

diff --git a/Packages/AsterismCore/Tests/AsterismCoreTests/CrossSiteMergeTests.swift b/Packages/AsterismCore/Tests/AsterismCoreTests/CrossSiteMergeTests.swiftindex c6d72ad..5310934 100644--- a/Packages/AsterismCore/Tests/AsterismCoreTests/CrossSiteMergeTests.swift+++ b/Packages/AsterismCore/Tests/AsterismCoreTests/CrossSiteMergeTests.swift@@ -60,7 +60,6 @@ struct CrossSiteMergeTests {          // Q59's standing guard: the superseded columns still mirror the primary         // membership after every write this test made.-        try await fixture.repository.assertWorkColumnsMirrorMemberships()     }      // MARK: - Union (Req 4.2, 4.3)@@ -96,7 +95,6 @@ struct CrossSiteMergeTests {          // Q59's standing guard: the superseded columns still mirror the primary         // membership after every write this test made.-        try await fixture.repository.assertWorkColumnsMirrorMemberships()     }      /// Req 4.2's shared half: where both Works are on one site, that site's@@ -134,7 +132,6 @@ struct CrossSiteMergeTests {          // Q59's standing guard: the superseded columns still mirror the primary         // membership after every write this test made.-        try await fixture.repository.assertWorkColumnsMirrorMemberships()     }      /// Q78: the address a site's merge dropped is a field on the outcome, and@@ -190,7 +187,6 @@ struct CrossSiteMergeTests {          // Q59's standing guard: the superseded columns still mirror the primary         // membership after every write this test made.-        try await fixture.repository.assertWorkColumnsMirrorMemberships()     }      // MARK: - The pre-mutation refusal (Req 4.5)@@ -219,7 +215,6 @@ struct CrossSiteMergeTests {          // Q59's standing guard: the superseded columns still mirror the primary         // membership after every write this test made.-        try await fixture.repository.assertWorkColumnsMirrorMemberships()     }      // MARK: - Distinct pairs (Req 5.7, Q32)@@ -246,7 +241,6 @@ struct CrossSiteMergeTests {          // Q59's standing guard: the superseded columns still mirror the primary         // membership after every write this test made.-        try await fixture.repository.assertWorkColumnsMirrorMemberships()     } } 

diff --git a/Packages/AsterismCore/Tests/AsterismCoreTests/DrainedReShareTests.swift b/Packages/AsterismCore/Tests/AsterismCoreTests/DrainedReShareTests.swiftindex 4b9d96f..cdadc57 100644--- a/Packages/AsterismCore/Tests/AsterismCoreTests/DrainedReShareTests.swift+++ b/Packages/AsterismCore/Tests/AsterismCoreTests/DrainedReShareTests.swift@@ -288,7 +288,7 @@ private struct DrainedReShareFixture {         entry.modifiedAt = Date(timeIntervalSince1970: 1_660_000_000)         if let workTitle {             let work = Work(-                displayTitle: workTitle, siteHostname: host,+                displayTitle: workTitle,                 timestamp: Date(timeIntervalSince1970: 1_600_000_000))             context.insert(work)             entry.work = work

diff --git a/Packages/AsterismCore/Tests/AsterismCoreTests/DuplicatePropertyTests.swift b/Packages/AsterismCore/Tests/AsterismCoreTests/DuplicatePropertyTests.swiftindex 38f06e6..935d29f 100644--- a/Packages/AsterismCore/Tests/AsterismCoreTests/DuplicatePropertyTests.swift+++ b/Packages/AsterismCore/Tests/AsterismCoreTests/DuplicatePropertyTests.swift@@ -455,9 +455,9 @@ enum DuplicateShapes {                             id: id, key: key, capturedAt: captured, sharedAt: shared,                             note: note, work: work.flatMap { seededWorks.rows[$0] }, site: site)                         guard entry.work != nil else { return }-                        entry.workAssignmentProvenance = .pattern-                        entry.workPatternID = patternID-                        entry.workPatternVersion = 1+                        entry.editCitations {+                            $0.workAssignment = .pattern(CitedRule(id: patternID, version: 1))+                        }                     }                 }             }

diff --git a/Packages/AsterismCore/Tests/AsterismCoreTests/DuplicatePublicationTests.swift b/Packages/AsterismCore/Tests/AsterismCoreTests/DuplicatePublicationTests.swiftindex 11f4b42..e127e1e 100644--- a/Packages/AsterismCore/Tests/AsterismCoreTests/DuplicatePublicationTests.swift+++ b/Packages/AsterismCore/Tests/AsterismCoreTests/DuplicatePublicationTests.swift@@ -559,11 +559,11 @@ private final class PublicationSeedStore {         context.insert(entry)         if let work {             entry.work = work-            entry.workAssignmentProvenance = .manual+            entry.editCitations { $0.workAssignment = .manual }         }         if let chapterTitle {             entry.chapterTitle = chapterTitle-            entry.chapterTitleProvenance = .manual+            entry.editCitations { $0.chapterTitle = .manual }         }         return entry     }

diff --git a/Packages/AsterismCore/Tests/AsterismCoreTests/DuplicateReconcileAfterSyncTests.swift b/Packages/AsterismCore/Tests/AsterismCoreTests/DuplicateReconcileAfterSyncTests.swiftindex 574b9c5..5e1155f 100644--- a/Packages/AsterismCore/Tests/AsterismCoreTests/DuplicateReconcileAfterSyncTests.swift+++ b/Packages/AsterismCore/Tests/AsterismCoreTests/DuplicateReconcileAfterSyncTests.swift@@ -290,15 +290,15 @@ extension LibraryRepository {             context.insert(site)             var works: [Work] = []             for (index, notes) in ["notes from A", "notes from B"].enumerated() {-                let work = Work(-                    displayTitle: "The Serial", siteHostname: hostname,+                // Through `create`, because the scan buckets a Work by its+                // **membership** and the identity has to land on that row.+                let work = Work.create(+                    in: context, title: "The Serial", hostname: hostname, site: site,                     timestamp: Self.probeEpoch.addingTimeInterval(Double(index)))-                work.setLegacyColumns { $0.urlIdentity = "series-a" }+                work.primaryMembershipEdit { $0.urlIdentity = "series-a" }                 work.lastParsedTitle = "The Serial"                 work.titleProvenance = .parsed                 work.genericNotes = notes-                context.insert(work)-                work.setLegacySite(site)                 works.append(work)             }             for (index, work) in works.enumerated() {

diff --git a/Packages/AsterismCore/Tests/AsterismCoreTests/DuplicateReconcilerTestSupport.swift b/Packages/AsterismCore/Tests/AsterismCoreTests/DuplicateReconcilerTestSupport.swiftindex cc2fc1b..ff048e1 100644--- a/Packages/AsterismCore/Tests/AsterismCoreTests/DuplicateReconcilerTestSupport.swift+++ b/Packages/AsterismCore/Tests/AsterismCoreTests/DuplicateReconcilerTestSupport.swift@@ -44,12 +44,12 @@ final class DuplicateStore {         directory = FileManager.default.temporaryDirectory             .appending(path: "AsterismDuplicateReconciler-\(UUID())", directoryHint: .isDirectory)         try FileManager.default.createDirectory(at: directory, withIntermediateDirectories: true)-        let schema = Schema(versionedSchema: AsterismSchemaV8.self)+        let schema = Schema(versionedSchema: AsterismSchemaV9.self)         let configuration = ModelConfiguration(             "AsterismV3", schema: schema,             url: directory.appending(path: "library.store"), cloudKitDatabase: .none)         container = try ModelContainer(-            for: schema, migrationPlan: AsterismV8MigrationPlan.self,+            for: schema, migrationPlan: AsterismV9MigrationPlan.self,             configurations: [configuration])         seed = ModelContext(container)         if let saveStrategy {@@ -139,7 +139,7 @@ final class DuplicateStore {             in: seed, id: id, title: title, hostname: hostname, site: site,             timestamp: Self.epoch.addingTimeInterval(createdAt))         work.modifiedAt = Self.epoch.addingTimeInterval(modifiedAt ?? createdAt)-        work.setLegacyColumns { $0.urlIdentity = urlIdentity }+        work.primaryMembershipEdit { $0.urlIdentity = urlIdentity }         work.genericNotes = notes         if parsed {             work.lastParsedTitle = title@@ -359,8 +359,8 @@ struct EntryFacts: Equatable, Sendable {         firstCapturedAt = entry.firstCapturedAt         lastSharedAt = entry.lastSharedAt         modifiedAt = entry.modifiedAt-        chapterPatternID = entry.chapterPatternID-        chapterPatternVersion = entry.chapterPatternVersion+        chapterPatternID = entry.citationValues.chapterTitle.patternID+        chapterPatternVersion = entry.citationValues.chapterTitle.patternVersion     } } @@ -380,7 +380,7 @@ struct WorkFacts: Equatable, Sendable {         id = work.id         displayTitle = work.displayTitle         genericNotes = work.genericNotes-        workURLString = work.legacyColumns.workURLString+        workURLString = work.primaryMembership?.workURLString         genreTags = work.genreTags         workTypeID = work.workTypeID         titleProvenance = work.titleProvenance

diff --git a/Packages/AsterismCore/Tests/AsterismCoreTests/DuplicateReconcilerTests.swift b/Packages/AsterismCore/Tests/AsterismCoreTests/DuplicateReconcilerTests.swiftindex 482972a..fca963b 100644--- a/Packages/AsterismCore/Tests/AsterismCoreTests/DuplicateReconcilerTests.swift+++ b/Packages/AsterismCore/Tests/AsterismCoreTests/DuplicateReconcilerTests.swift@@ -77,9 +77,10 @@ struct DuplicateReconcilerTests {         try store.addPattern(id: ruleID, site: twinRow, version: 7, active: true, createdAt: 10)         let entry = store.addEntry(key: "chapter-1", capturedAt: 0, site: site)         entry.chapterTitle = "Chapter 1"-        entry.chapterTitleProvenance = .pattern-        entry.chapterPatternID = ruleID-        entry.chapterPatternVersion = 7+        entry.editCitations {+            $0.chapterTitle = FieldProvenance.tolerant(+                kind: .pattern, patternID: ruleID, patternVersion: 7)+        }         try store.commit()          let outcome = try store.reconcile()@@ -225,13 +226,9 @@ struct DuplicateReconcilerTests {     /// which cites a rule **by UUID only** and carries no version — so the     /// membership has nothing to renumber, and nothing here touches it.     ///-    /// **The retained column is left alone too, since task 21.** It moved with-    /// the renumbering while `LibraryValidator`'s `.rule` arm resolved-    /// `(urlIdentityRuleID, urlIdentityRuleVersion)` and the 6/7 archive-    /// exported the pair; task 8 moved the arm onto the membership and task 21-    /// dropped the version from the wire, so there is no reader left for the-    /// column and no reason to write it. V9 deletes it.-    @Test("Rule renumbering moves neither the Work's retained version nor its membership")+    /// The `Work.urlIdentityRuleVersion` column this also pinned as left alone+    /// went at V9, and so did the half of the assertion that read it.+    @Test("Rule renumbering leaves the Work's membership citation alone")     func workCitationColumnFollowsTheRenumbering() throws {         let store = try DuplicateStore()         let site = store.addSite(displayName: "first", mode: .taught)@@ -242,8 +239,7 @@ struct DuplicateReconcilerTests {         let work = store.addWork(             id: DuplicateStore.rankedID(2), title: "The Serial", urlIdentity: "series-a",             createdAt: 0, site: site)-        work.setLegacyColumns { $0.urlIdentityRuleID = ruleID }-        work.urlIdentityRuleVersion = 7+        work.primaryMembershipEdit { $0.urlIdentityRuleID = ruleID }         try store.commit()          let outcome = try store.reconcile()@@ -255,14 +251,11 @@ struct DuplicateReconcilerTests {             let works = try context.fetch(FetchDescriptor<Work>())             let versions = Set(try context.fetch(FetchDescriptor<URLRulePattern>()).map(\.version))             return (-                columns: works.map(\.urlIdentityRuleVersion),                 converged: versions,                 membershipRules: works.flatMap { $0.membershipValues.map(\.urlIdentityRuleID) }             )         }         #expect(cited.converged.count == 1, "the premise: the group converged on one version")-        #expect(cited.columns == [7],-                "the retained column has no reader left and is not written")         // The membership cites by UUID and carries no version, so renumbering         // leaves it exactly as it was.         #expect(cited.membershipRules.allSatisfy { $0 == nil || $0 == ruleID })@@ -384,7 +377,7 @@ struct DuplicateReconcilerTests {         store.addEntry(id: shared, key: "chapter-1", capturedAt: 0, site: site)         let carrier = store.addEntry(id: shared, key: "chapter-1", capturedAt: 0, site: site)         carrier.chapterTitle = "The Reader's Title"-        carrier.chapterTitleProvenance = .manual+        carrier.editCitations { $0.chapterTitle = .manual }         try store.commit()          try store.reconcileToFixedPoint()@@ -406,12 +399,14 @@ struct DuplicateReconcilerTests {         let otherWork = store.addWork(             title: "Other Work", urlIdentity: "series-b", createdAt: 0, site: site)         let shared = DuplicateStore.rankedID(1)-        let bare = store.addEntry(+        // Bare: no reader-authored assignment. It used to say so as a `.pattern`+        // kind with nothing cited, which the blob normalises to no assignment at+        // all (Q39) — the default a fresh row already carries.+        _ = store.addEntry(             id: shared, key: "chapter-1", capturedAt: 0, work: survivorWork, site: site)-        bare.workAssignmentProvenance = .pattern         let authored = store.addEntry(             id: shared, key: "chapter-1", capturedAt: 0, note: "note", work: otherWork, site: site)-        authored.workAssignmentProvenance = .manual+        authored.editCitations { $0.workAssignment = .manual }         try store.commit()          try store.reconcileToFixedPoint()@@ -441,7 +436,7 @@ struct DuplicateReconcilerTests {         let moved = store.addEntry(             key: "chapter-2", capturedAt: 5, sharedAt: 7, note: "chapter note", rating: .down,             work: loser, site: site)-        moved.workAssignmentProvenance = FieldProvenanceKind.manual+        moved.editCitations { $0.workAssignment = .manual }         store.addEntry(key: "chapter-1", capturedAt: 1, work: survivor, site: site)         try store.commit() 

diff --git a/Packages/AsterismCore/Tests/AsterismCoreTests/DuplicateResolutionTests.swift b/Packages/AsterismCore/Tests/AsterismCoreTests/DuplicateResolutionTests.swiftindex 6635f71..bcddaa6 100644--- a/Packages/AsterismCore/Tests/AsterismCoreTests/DuplicateResolutionTests.swift+++ b/Packages/AsterismCore/Tests/AsterismCoreTests/DuplicateResolutionTests.swift@@ -424,18 +424,21 @@ struct DuplicateResolutionTests {             displayTitle: "T", titleProvenance: .parsed, hostname: "one.example", workURLString: nil,             genericNotes: "", genreTags: [], typeDisplay: .untyped) +        // Every side here is on one site, so the fold's answer is that+        // hostname's entry — the single-site `workURL` facade went with the+        // columns at V9.         let adopted = WorkVariantUnion.fold(into: bare, others: [withURL])-        #expect(adopted.workURL == "https://a.example")+        #expect(adopted.workURLsByHostname == ["one.example": "https://a.example"])         #expect(adopted.retainedFields.contains(.sourceWorkURL))         #expect(adopted.discardedFields.isEmpty)          let kept = WorkVariantUnion.fold(into: withURL, others: [withOther])-        #expect(kept.workURL == "https://a.example")+        #expect(kept.workURLsByHostname == ["one.example": "https://a.example"])         #expect(kept.discardedFields.contains(.sourceWorkURL))         #expect(kept.auditBlock?.contains("https://b.example") == true)          let nothing = WorkVariantUnion.fold(into: bare, others: [bare])-        #expect(nothing.workURL == nil)+        #expect(nothing.workURLsByHostname.isEmpty)         #expect(nothing.auditBlocks.isEmpty)     } @@ -655,7 +658,6 @@ private final class ResolutionFixture {         // Q59's standing guard, on the seam every read-back in this suite goes         // through: a resolution that collapsed a set must leave every surviving         // Work's superseded columns mirroring its primary membership.-        try assertWorkColumnsMirrorMemberships(in: context, sourceLocation: sourceLocation)         return context     } @@ -746,7 +748,7 @@ private final class ResolutionSeedStore {         context.insert(entry)         if let work {             entry.work = work-            entry.workAssignmentProvenance = .manual+            entry.editCitations { $0.workAssignment = .manual }         }         return entry     }@@ -782,7 +784,7 @@ private final class ResolutionSeedStore {         work.titleProvenance = .parsed         work.genericNotes = notes         work.genreTags = tags-        work.setLegacyColumns { $0.workURLString = workURL }+        work.primaryMembershipEdit { $0.workURLString = workURL }         work.membershipValues.first?.workURLString = workURL         work.workTypeID = ResolutionSeedStore.typeID(for: type)         work.modifiedAt = ResolutionFixture.epoch.addingTimeInterval(offset)@@ -872,7 +874,6 @@ private final class AssignmentFixture {         // Q59's standing guard, on the seam every read-back in this suite goes         // through: a resolution that collapsed a set must leave every surviving         // Work's superseded columns mirroring its primary membership.-        try assertWorkColumnsMirrorMemberships(in: context, sourceLocation: sourceLocation)         return context     } @@ -926,7 +927,7 @@ private final class AssignmentSeedStore {         entry.lastSharedAt = AssignmentFixture.epoch.addingTimeInterval(offset)         context.insert(entry)         entry.work = work-        entry.workAssignmentProvenance = .manual+        entry.editCitations { $0.workAssignment = .manual }         return entry     } }

diff --git a/Packages/AsterismCore/Tests/AsterismCoreTests/DuplicateScanTests.swift b/Packages/AsterismCore/Tests/AsterismCoreTests/DuplicateScanTests.swiftindex 9984aa4..4dcee89 100644--- a/Packages/AsterismCore/Tests/AsterismCoreTests/DuplicateScanTests.swift+++ b/Packages/AsterismCore/Tests/AsterismCoreTests/DuplicateScanTests.swift@@ -350,10 +350,10 @@ struct DuplicateScanTests {         let shared = UUID()         let first = store.addEntry(id: shared, key: "chapter-1", offset: 0)         first.work = leftWork-        first.workAssignmentProvenance = .manual+        first.editCitations { $0.workAssignment = .manual }         let second = store.addEntry(id: shared, key: "chapter-1", offset: 60)         second.work = rightWork-        second.workAssignmentProvenance = .manual+        second.editCitations { $0.workAssignment = .manual }         try store.commit()          let result = try store.scan()@@ -374,10 +374,10 @@ struct DuplicateScanTests {         let shared = UUID()         let first = store.addEntry(id: shared, key: "chapter-1", offset: 0)         first.work = leftWork-        first.workAssignmentProvenance = .manual+        first.editCitations { $0.workAssignment = .manual }         let second = store.addEntry(id: shared, key: "chapter-1", offset: 60)         second.work = rightWork-        second.workAssignmentProvenance = .manual+        second.editCitations { $0.workAssignment = .manual }         try store.commit()          let result = try store.scan()@@ -516,12 +516,12 @@ private final class ScanStore {         directory = FileManager.default.temporaryDirectory             .appending(path: "AsterismDuplicateScan-\(UUID())", directoryHint: .isDirectory)         try FileManager.default.createDirectory(at: directory, withIntermediateDirectories: true)-        let schema = Schema(versionedSchema: AsterismSchemaV8.self)+        let schema = Schema(versionedSchema: AsterismSchemaV9.self)         let configuration = ModelConfiguration(             "AsterismV3", schema: schema,             url: directory.appending(path: "library.store"), cloudKitDatabase: .none)         container = try ModelContainer(-            for: schema, migrationPlan: AsterismV8MigrationPlan.self,+            for: schema, migrationPlan: AsterismV9MigrationPlan.self,             configurations: [configuration])         context = ModelContext(container)     }@@ -562,8 +562,8 @@ private final class ScanStore {             site: try? LibraryRepository.fetchSites(hostname: hostname, context: context).first,             timestamp: Self.epoch.addingTimeInterval(offset))         work.lastParsedTitle = parsedTitle-        work.setLegacyColumns { $0.urlIdentity = urlIdentity }-        if urlIdentity != nil { work.setLegacyColumns { $0.urlIdentityState = .rule } }+        work.primaryMembershipEdit { $0.urlIdentity = urlIdentity }+        if urlIdentity != nil { work.primaryMembershipEdit { $0.urlIdentityState = .rule } }         if let membership = work.membershipValues.first {             membership.urlIdentity = urlIdentity             membership.urlIdentityState = urlIdentity == nil ? .none : .rule

diff --git a/Packages/AsterismCore/Tests/AsterismCoreTests/EntryCitationsTests.swift b/Packages/AsterismCore/Tests/AsterismCoreTests/EntryCitationsTests.swiftindex 45cba83..4fa3fa5 100644--- a/Packages/AsterismCore/Tests/AsterismCoreTests/EntryCitationsTests.swift+++ b/Packages/AsterismCore/Tests/AsterismCoreTests/EntryCitationsTests.swift@@ -4,15 +4,15 @@ import Testing  @testable import AsterismCore -/// The two V8 blobs and the legacy-column readers that feed them (Q25, Q36).+/// The two blobs a citation and a rule definition live in (Q25, Q36). ///-/// **The seven-citation projection is pinned against the columns, not against-/// itself.** `EntryRuleCitations`'s key-path table is gone; the expectation-/// below is the same seven `(id, version, target, label)` rows read straight off-/// the columns, written out by hand so a projection that quietly reorders,-/// relabels or drops a slot fails here rather than in an archive refusal three-/// subsystems away.-@Suite("V8 citation and definition blobs", .serialized)+/// **The seven-citation projection is pinned against a written-out expectation,+/// not against itself.** `EntryRuleCitations`'s key-path table is gone, and so+/// are the seventeen columns this suite used to read the same seven+/// `(id, version, target, label)` rows off; the expectation is spelt by hand so+/// a projection that quietly reorders, relabels or drops a slot fails here+/// rather than in an archive refusal three subsystems away.+@Suite("Citation and definition blobs", .serialized) struct EntryCitationsTests {      // MARK: - Fixtures@@ -32,36 +32,10 @@ struct EntryCitationsTests {             timestamp: Date(timeIntervalSince1970: 1_800_000_000))     } -    /// The seven rows, read directly off the columns — the retired key-path-    /// table's answer, restated once so the projection has something to be-    /// measured against.-    ///-    /// Two of the seven are **arm-scoped**, and that is the whole of V8's-    /// normalisation (Q39): the stored key version picks the identity arm and-    /// the stored provenance kind picks the assignment arm, and a citation-    /// belonging to an arm the row did not choose is dropped. Only a partial-    /// write produces one — the validator rejects every such shape — and the-    /// columns still hold it until V9, so the blob normalises rather than-    /// inventing a case per mismatch.-    private static func expectedRows(of entry: Entry) -> [(UUID?, Int?, String)] {-        // `.rule`/`.composed` carry a **non-optional** cited URL rule, so a row-        // claiming v2 or v3 without one is the raw-URL basis and cites nothing —-        // its name contributor goes with it.-        let identityArm = entry.identityKeyVersion >= 2 && entry.identityURLRuleID != nil-        let patternArm = entry.workAssignmentProvenanceRaw == FieldProvenanceKind.pattern.rawValue-        return [-            (identityArm ? entry.identityURLRuleID : nil,-             identityArm ? entry.identityURLRuleVersion : nil, "its identity rule"),-            (identityArm ? entry.identityNameTitleRuleID : nil,-             identityArm ? entry.identityNameTitleRuleVersion : nil, "its naming title rule"),-            (entry.urlWorkRuleID, entry.urlWorkRuleVersion, "its work-extraction rule"),-            (entry.chapterSequenceRuleID, entry.chapterSequenceRuleVersion, "its sequence rule"),-            (entry.chapterPatternID, entry.chapterPatternVersion, "its chapter rule"),-            (patternArm ? entry.workPatternID : nil,-             patternArm ? entry.workPatternVersion : nil, "its work rule"),-            (entry.workURLRuleID, entry.workURLRuleVersion, "its work URL rule"),-        ]-    }+    private static let expectedLabels = [+        "its identity rule", "its naming title rule", "its work-extraction rule",+        "its sequence rule", "its chapter rule", "its work rule", "its work URL rule",+    ]      private static let expectedTargets: [Entry.RuleCitation.Target] = [         .urlRule, .titlePattern, .urlRule, .urlRule, .titlePattern, .titlePattern, .urlRule,@@ -69,196 +43,99 @@ struct EntryCitationsTests {      // MARK: - Req 10.2: the citation blob -    /// Every identity generation × every assignment provenance × both-    /// nil/non-nil states of the optional slots × **both the well-formed and the-    /// mismatched spelling of each arm**. The columns are read through-    /// `LegacyColumns.citations`, projected to the seven rows, and compared to-    /// what `expectedRows` says the normalisation owes.+    /// The seven `(id, version, target, label)` rows, written out by hand so a+    /// projection that quietly reorders, relabels or drops a slot fails here+    /// rather than in an archive refusal three subsystems away.     ///-    /// The `mismatched` axis is the one the first draft of this matrix never-    /// reached: it sets *every* work citation column whatever the provenance-    /// kind says, and drops the cited URL rule out from under a v2/v3 key-    /// version. Those are the shapes a partial write produces, and the point of-    /// running them is that all of them normalise by one rule rather than four-    /// arms behaving four ways.-    @Test(-        "The seven citation rows project from the columns under one normalisation",-        arguments: [1, 2, 3],-        [FieldProvenanceKind.none, .pattern, .urlRule, .manual])-    func sevenRowsMatchTheColumns(keyVersion: Int, assignment: FieldProvenanceKind) throws {-        for populated in [false, true] {-            for mismatched in [false, true] {-                let entry = Self.makeEntry()-                entry.identityKeyVersion = keyVersion-                // Mismatched: a rule-basis key version with no cited URL rule,-                // which the identity cases cannot represent.-                if keyVersion > 1, !mismatched {-                    entry.identityURLRuleID = Self.ruleA-                    entry.identityURLRuleVersion = 4-                }-                if keyVersion > 1 {-                    entry.identityNameTitleRuleID = Self.patternA-                    entry.identityNameTitleRuleVersion = 2-                }-                if populated {-                    entry.urlWorkRuleID = Self.ruleB-                    entry.urlWorkRuleVersion = 5-                    entry.chapterSequenceRuleID = Self.ruleB-                    entry.chapterSequenceRuleVersion = 5-                    entry.chapterTitleProvenanceRaw = FieldProvenanceKind.pattern.rawValue-                    entry.chapterPatternID = Self.patternB-                    entry.chapterPatternVersion = 3-                    entry.workURLAssignmentKindRaw = URLWorkAssignmentKind.identity.rawValue-                }-                entry.workAssignmentProvenanceRaw = assignment.rawValue-                // Mismatched: both work citations present whatever the kind is.-                if mismatched || assignment == .pattern {-                    entry.workPatternID = Self.patternA-                    entry.workPatternVersion = 7-                }-                if mismatched || assignment == .urlRule {-                    entry.workURLRuleID = Self.ruleA-                    entry.workURLRuleVersion = 9-                }--                let label = "populated=\(populated) mismatched=\(mismatched)"-                let citations = LegacyColumns.citations(from: entry)-                let rows = citations.ruleCitations-                let expected = Self.expectedRows(of: entry)-                #expect(rows.count == expected.count)-                for (index, row) in rows.enumerated() {-                    #expect(row.id == expected[index].0, "row \(index) id, \(label)")-                    #expect(row.version == expected[index].1, "row \(index) version, \(label)")-                    #expect(row.label == expected[index].2, "row \(index) label")-                    #expect(row.target == Self.expectedTargets[index], "row \(index) target")-                }-                // The case *is* the provenance now, so the value writes back the-                // kind it chose rather than the one the columns disagreed on.-                #expect(citations.workAssignment.provenanceKind-                        == (citations.workAssignment == .none ? .none : assignment),-                        "assignment kind, \(label)")-                // The blob is what the Entry answers with once it holds one, and-                // it answers the same rows.-                try entry.setCitations(citations)-                #expect(try entry.ruleCitations.map(\.id) == rows.map(\.id))-                // Normalisation is a fixed point: re-reading the blob and-                // re-projecting produces the same value, so the population pass-                // converges on the second run rather than oscillating.-                #expect(try entry.citations == citations, "round trip, \(label)")-            }-        }-    }--    /// The identity **case** replaces the `identityKeyVersion` switch (Q26), and-    /// carries the same integer back.-    @Test("Identity cases and key versions correspond", arguments: [1, 2, 3, 0, 9])-    func identityCases(keyVersion: Int) throws {+    /// It used to be pinned against the seventeen Entry columns the blob+    /// superseded, over a matrix of every identity generation × every assignment+    /// provenance × the well-formed and mismatched spelling of each arm. V9+    /// dropped the columns, and with them every mismatched spelling: `Identity`+    /// carries a **non-optional** cited URL rule and `WorkAssignment` carries its+    /// own citation inside the case (Q39), so an arm without its rule is a value+    /// that cannot be constructed rather than one that has to be normalised.+    @Test("The seven citation rows project in a fixed order, with fixed labels and targets")+    func sevenRowsProjectInOrder() throws {+        let citations = EntryCitations(+            identity: .composed(+                url: CitedRule(id: Self.ruleA, version: 4),+                nameTitle: CitedRule(id: Self.patternA, version: 2)),+            urlWork: CitedRule(id: Self.ruleB, version: 5),+            chapterSequence: CitedRule(id: Self.ruleB, version: 5),+            chapterTitle: FieldProvenance.tolerant(+                kind: .pattern, patternID: Self.patternB, patternVersion: 3),+            workAssignment: .pattern(CitedRule(id: Self.patternA, version: 7)),+            workURL: CitedRule(id: Self.ruleA, version: 9),+            workURLAssignmentKind: .identity)++        let rows = citations.ruleCitations+        #expect(rows.map(\.label) == Self.expectedLabels)+        #expect(rows.map(\.target) == Self.expectedTargets)+        #expect(+            rows.map(\.id) == [+                Self.ruleA, Self.patternA, Self.ruleB, Self.ruleB, Self.patternB,+                Self.patternA, Self.ruleA,+            ])+        #expect(rows.compactMap(\.version) == [4, 2, 5, 5, 3, 7, 9])++        // The blob is what the Entry answers with, and it answers the same rows.         let entry = Self.makeEntry()-        entry.identityKeyVersion = keyVersion-        entry.identityURLRuleID = Self.ruleA-        entry.identityURLRuleVersion = 4-        let identity = LegacyColumns.citations(from: entry).identity-        switch keyVersion {-        case 2:-            #expect(identity == .rule(url: CitedRule(id: Self.ruleA, version: 4), nameTitle: nil))-        case 3:-            #expect(-                identity == .composed(url: CitedRule(id: Self.ruleA, version: 4), nameTitle: nil))-        default:-            // A version this build has no case for reads as the conservative-            // basis rather than throwing, the tolerance every enum column has.-            #expect(identity == .rawURL)-        }-        #expect(identity.keyVersion == [2: 2, 3: 3][keyVersion, default: 1])+        try entry.setCitations(citations)+        #expect(try entry.citations == citations)+        #expect(try entry.ruleCitations.map(\.id) == rows.map(\.id))     } -    /// An identity generation whose rule citation is absent is not a-    /// `.rule`/`.composed`: the case carries a non-optional citation, so a row-    /// that has lost it reads as the conservative basis.-    @Test("A rule-basis version with no cited rule reads as the raw-URL basis")-    func identityWithoutARule() throws {-        let entry = Self.makeEntry()-        entry.identityKeyVersion = 3-        #expect(LegacyColumns.citations(from: entry).identity == .rawURL)+    /// An empty value cites nothing in all seven slots, which is what a row born+    /// today holds until a writer gives it something.+    @Test("The default value cites nothing in every slot")+    func defaultCitesNothing() {+        let rows = EntryCitations().ruleCitations+        #expect(rows.count == Self.expectedLabels.count)+        #expect(rows.allSatisfy { $0.id == nil && $0.version == nil })     } -    /// Q39, stated once as a table: the stored kind picks the arm, and a-    /// citation belonging to any other arm is dropped rather than smuggled into-    /// the case. Four rows, one rule.-    ///-    /// The alternative was a payload that let *one* of these round-trip — a work-    /// pattern under a disagreeing provenance — while the other three still-    /// normalised silently. Every one of them is a shape `LibraryValidator`-    /// rejects, the columns still hold the dropped citation until V9, and one-    /// rule that always holds beats one exception that mostly does not.-    @Test(-        "The stored kind picks the arm and foreign citations are dropped",-        arguments: [-            (FieldProvenanceKind.none, EntryCitations.WorkAssignment.none),-            (.manual, .manual),-            (.pattern, .pattern(CitedRule(id: patternA, version: 7))),-            (.urlRule, .urlRule(CitedRule(id: ruleA, version: 9))),-        ])-    func assignmentNormalisation(-        kind: FieldProvenanceKind, expected: EntryCitations.WorkAssignment-    ) throws {-        let entry = Self.makeEntry()-        entry.workAssignmentProvenanceRaw = kind.rawValue-        // Both citations present, whatever the kind says.-        entry.workPatternID = Self.patternA-        entry.workPatternVersion = 7-        entry.workURLRuleID = Self.ruleA-        entry.workURLRuleVersion = 9--        let citations = LegacyColumns.citations(from: entry) -        #expect(citations.workAssignment == expected)-        // `workURL` is its own slot and is read from its own column either way,-        // so dropping the *assignment's* copy loses no citation the row holds.-        #expect(citations.workURL == CitedRule(id: Self.ruleA, version: 9))+    /// The identity **case** replaces the `identityKeyVersion` switch (Q26), and+    /// carries the same integer back.+    ///+    /// It was driven from the column, over the out-of-range spellings a newer+    /// build could have written (0, 9) as well as the three this build has. V9+    /// dropped the column: the case is the only spelling of the basis now, so+    /// what is left to pin is the integer each one writes back for the+    /// archive's reverse projection.+    @Test("Identity cases carry their key version back")+    func identityCases() {+        let url = CitedRule(id: Self.ruleA, version: 4)+        #expect(EntryCitations.Identity.rawURL.keyVersion == 1)+        #expect(EntryCitations.Identity.rule(url: url, nameTitle: nil).keyVersion == 2)+        #expect(EntryCitations.Identity.composed(url: url, nameTitle: nil).keyVersion == 3)     } -    /// The identity half of the same rule: the stored key version picks the arm,-    /// and an arm with no cited URL rule degrades to `.rawURL` — taking its name-    /// contributor with it, because a name contributor without the rule that-    /// produced the key cites nothing replayable.-    @Test("A rule-basis version with a name contributor but no URL rule degrades whole")-    func identityNormalisation() throws {-        let entry = Self.makeEntry()-        entry.identityKeyVersion = 3-        entry.identityNameTitleRuleID = Self.patternA-        entry.identityNameTitleRuleVersion = 2--        let citations = LegacyColumns.citations(from: entry)--        #expect(citations.identity == .rawURL)-        #expect(citations.ruleCitations[1].id == nil)-    }+    // `identityWithoutARule`, `assignmentNormalisation` and+    // `identityNormalisation` stood here. All three drove+    // `LegacyColumns.citations`, which normalised the column shapes a partial+    // write could produce: a v2/v3 key version with no cited URL rule, a work+    // pattern cited under `.manual`, a name contributor with no rule beside it.+    // V9 dropped every column that could spell one, and `EntryCitations` cannot:+    // `Identity` carries a non-optional cited rule and `WorkAssignment` carries+    // its citation inside the case (Q39), so there is no mismatched value left+    // to normalise.      /// Rule renumbering rewrites versions and nothing else, and reports "no     /// change" when the map names no version the row cites.     @Test("Version rewriting touches every cited slot and only the versions")     func versionRewrite() throws {-        let entry = Self.makeEntry()-        entry.identityKeyVersion = 3-        entry.identityURLRuleID = Self.ruleA-        entry.identityURLRuleVersion = 1-        entry.identityNameTitleRuleID = Self.patternA-        entry.identityNameTitleRuleVersion = 1-        entry.urlWorkRuleID = Self.ruleA-        entry.urlWorkRuleVersion = 1-        entry.chapterSequenceRuleID = Self.ruleA-        entry.chapterSequenceRuleVersion = 1-        entry.chapterTitleProvenanceRaw = FieldProvenanceKind.pattern.rawValue-        entry.chapterPatternID = Self.patternA-        entry.chapterPatternVersion = 1-        entry.workAssignmentProvenanceRaw = FieldProvenanceKind.pattern.rawValue-        entry.workPatternID = Self.patternA-        entry.workPatternVersion = 1-        entry.workURLRuleID = Self.ruleA-        entry.workURLRuleVersion = 1+        let citations = EntryCitations(+            identity: .composed(+                url: CitedRule(id: Self.ruleA, version: 1),+                nameTitle: CitedRule(id: Self.patternA, version: 1)),+            urlWork: CitedRule(id: Self.ruleA, version: 1),+            chapterSequence: CitedRule(id: Self.ruleA, version: 1),+            chapterTitle: FieldProvenance.tolerant(+                kind: .pattern, patternID: Self.patternA, patternVersion: 1),+            workAssignment: .pattern(CitedRule(id: Self.patternA, version: 1)),+            workURL: CitedRule(id: Self.ruleA, version: 1)) -        let citations = LegacyColumns.citations(from: entry)         #expect(citations.rewritingVersions([:]) == nil)         #expect(citations.rewritingVersions([Self.ruleB: 9]) == nil)         let rewritten = try #require(citations.rewritingVersions([Self.ruleA: 6, Self.patternA: 8]))@@ -266,6 +143,7 @@ struct EntryCitationsTests {         #expect(rewritten.ruleCitations.map(\.id) == citations.ruleCitations.map(\.id))     } +     // MARK: - Req 10.1: the definition blob      private static let definitions: [PatternDefinition] = [@@ -279,10 +157,14 @@ struct EntryCitationsTests {         .wholeTitle,     ] -    /// Every arm, with and without trims: the ten columns read back as the same-    /// `StoredPatternDefinition` a freshly written blob holds, and `chapterless`-    /// and `form` are derived rather than stored.-    @Test("Every pattern arm round-trips through the columns", arguments: definitions)+    /// Every arm, with and without trims, round-trips through the blob, and+    /// `chapterless` and `form` are derived rather than stored.+    ///+    /// It used to check the same value against the ten decomposed columns too,+    /// through the one door that read them. V9 dropped the columns, so the blob+    /// is the whole of a definition and a row with none throws — which is what+    /// `nilDefinitionThrows` below pins.+    @Test("Every pattern arm round-trips through the blob", arguments: definitions)     func definitionRoundTrip(definition: PatternDefinition) throws {         for trims in [(nil, nil), ("Read: ", " | Site")] as [(String?, String?)] {             let written = try TitlePattern(@@ -294,58 +176,25 @@ struct EntryCitationsTests {             #expect(try written.definition == definition)             #expect(try written.storedDefinition.chapterless == !definition.producesChapter)             #expect(try written.storedDefinition.form == definition.form)--            // The same value spelled in the ten legacy columns, read back by the-            // fallback: this is what `V8PopulationPass` copies.-            let legacy = Self.legacyPattern(definition: definition, trims: trims)-            #expect(legacy.definitionData == nil)-            #expect(try legacy.storedDefinition == expected)-            #expect(try legacy.definition == definition)         }     } -    /// A pattern row in the V7 shape: the ten columns set, the blob nil.-    private static func legacyPattern(-        definition: PatternDefinition, trims: (String?, String?)-    ) -> TitlePattern {-        // Built through the writing initializer, then reduced to the V7 shape by-        // clearing the blob and spelling the arm out in the columns.-        let pattern = try! TitlePattern(-            version: 1, createdAt: Date(timeIntervalSince1970: 0), definition: .wholeTitle)-        pattern.definitionData = nil-        pattern.formRaw = definition.form.rawValue-        pattern.chapterless = !definition.producesChapter-        pattern.trimPrefix = trims.0-        pattern.trimSuffix = trims.1-        switch definition {-        case .segment(let work, let ignored), .chapterlessSegment(let work, let ignored):-            pattern.segmentWorkAnchor = work-            pattern.segmentIgnoredAnchors = ignored-        case .phrase(let prefix, let separator, let suffix, let order),-            .chapterlessPhrase(let prefix, let separator, let suffix, let order):-            pattern.phrasePrefix = prefix-            pattern.phraseSeparator = separator-            pattern.phraseSuffix = suffix-            pattern.fieldOrderRaw = order.rawValue-        case .wholeTitle:-            break-        }-        return pattern-    }--    /// A column combination that is not a legal arm throws rather than-    /// substituting a rule the reader never taught (Decision 5 of-    /// `library-integrity-tolerance`).-    @Test("An illegal column combination throws instead of substituting")-    func illegalColumns() throws {+    /// A pattern with no blob throws rather than substituting a rule the reader+    /// never taught (Decision 5 of `library-integrity-tolerance`).+    ///+    /// It used to fall back to the ten decomposed columns, and the case pinned+    /// here was a *column combination* that formed no legal arm. V9 dropped+    /// them: there is nothing behind the blob, so a nil one is the whole of the+    /// unreadable state and `GroupOrdering` gives it its own constant key (Q11).+    @Test("A pattern with no definition blob throws instead of substituting")+    func nilDefinitionThrows() throws {         let pattern = try TitlePattern(             version: 1, createdAt: Date(timeIntervalSince1970: 0), definition: .wholeTitle)         pattern.definitionData = nil-        pattern.formRaw = PatternForm.segment.rawValue-        pattern.segmentWorkAnchor = nil         #expect(throws: ModelInvariantError.self) { _ = try pattern.storedDefinition }     } +     // MARK: - Blob failure modes      @Test("Undecodable citation bytes throw rather than reading as no citations")@@ -395,17 +244,32 @@ struct EntryCitationsTests {         #expect(pattern.definitionData == bytes)     } -    /// Nil bytes fall back to the columns rather than reading as empty (Q36):-    /// this is what keeps a row a lagging V7 device syncs in after the migration-    /// readable (Req 2.7).-    @Test("A nil blob reads through the legacy columns")-    func nilBlobFallsBack() throws {+    /// The constant `Entry.init` seeds every new row with decodes back to the+    /// value it was encoded from.+    ///+    /// This is what licenses the `try!` behind `EntryCitations.defaultBlob`: the+    /// encode has no runtime input, so if it can ever fail it fails here.+    @Test("The default citation blob decodes back to the default value")+    func defaultBlobDecodes() throws {+        #expect(+            try JSONBlob.decode(EntryCitations.self, from: EntryCitations.defaultBlob)+                == EntryCitations())+    }++    /// Nil bytes read as the default — identity `.rawURL`, nothing cited (Q6).+    ///+    /// They used to fall back to the columns, which is what kept a row a lagging+    /// V7 device synced in readable (Req 2.7). Since V9 the blob is a citation's+    /// only home: a nil one means a row this build has not rewritten, the+    /// diagnosis counts it (a report, not a quarantine — Q25), and an ordinary+    /// read answers rather than failing whichever screen asked first.+    @Test("A nil blob reads as the default")+    func nilBlobReadsAsTheDefault() throws {         let entry = Self.makeEntry()-        entry.identityKeyVersion = 2-        entry.identityURLRuleID = Self.ruleA-        entry.identityURLRuleVersion = 4-        #expect(entry.citationsData == nil)-        #expect(try entry.citations == LegacyColumns.citations(from: entry))-        #expect(try entry.ruleCitations.first?.id == Self.ruleA)+        entry.citationsData = nil++        #expect(try entry.citations == EntryCitations())+        #expect(try entry.citations.identity == .rawURL)+        #expect(try entry.ruleCitations.allSatisfy { $0.id == nil })     } }