Separate v19 admission classification from settlement

[flyingrobots]

Goal

Freeze and implement the v19 phase boundary:

proposal -> derivation verification -> destination admission
                                      -> derived | plural | conflict | obstruction
plural or resolved coordinate -> previewSettlement() -> SettlementPlan -> settle()

Admission classifies how proposed history relates to the destination frontier. Settlement is the later, law-governed promotion of an admitted plural or resolved coordinate. Observation and runtime failure remain separate axes. This is a child slice of #712.

Required semantics

• AdmissionResult is a closed discriminated union of exactly derived, plural, conflict, and obstruction.
• Each variant requires a distinct typed witness and explicit source/destination participant, basis, proposal, law/profile, evaluation coordinate, and residual posture bindings.
• derived != plural, plural != conflict, and conflict != obstruction.
• Plurality is a lawful terminal posture and never implies required canonicalization.
• Conflict and obstruction expose distinct recovery inputs.
• Observation cardinality is orthogonal to admission outcome.
• Runtime/process/corruption failures live outside the semantic union.
• Source-derivation failure is explicitly classified as pre-admission failure or a qualified obstruction; the choice is documented and tested.
• Preview is non-authoritative. Settlement plans are immutable, digest- and basis-bound, and revalidated by settle(plan).
• Legacy accepted | obstructed | conflicted | underdetermined | rejected projection is explicitly lossy and unavailable from the v19 root.
• CRDT joins remain domain settlement policies where lawful; git-warp does not require every concurrent history to possess an automatic least upper bound.

Acceptance

• Normative API and architecture docs distinguish admission, settlement, observation, receipt, and witness.
• Existing admitted | staged | plural | conflict | obstruction fixture vocabulary is replaced or quarantined; plurality is not modeled as requiring resolution.
• Closed runtime-validated contracts prevent illegal outcome/witness combinations.
• Exhaustive matching has no default branch.
• Semantic matrix tests cover direct extension, disjoint concurrency, exclusive overlap, capability denial, unsupported evidence, invalid derivation, and stale settlement plans.
• Witness verification is independent of receipt-shell telemetry.
• Graft/publication checks show no accidental root exposure before the final Goalpost: v19 Runtime, Lane, and Observation public API #712 cutover.

Non-goals

This slice does not complete the Runtime/Lane root cutover, generated Wesley SDKs, or the streaming Observation implementation. Those remain subsequent #712 slices.

[coderabbitai]

🔗 Related PRs

#106 - Advance v18 release-candidate evidence [merged]
#726 - Move graph exports behind v19 public API boundary [merged]
#745 - Seal Git substrate out of v19 receipts and evidence [merged]
#751 - feat(materialize): add retained CAS materialization handles [merged]
#755 - fix: retain bounded materialization roots [merged]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!

[flyingrobots]

Contract checkpoint merged

PR #766 merged as c11d815f7d39116f92e6dc7af49b7230340ecfb8.

What is now source-backed:

• Admission is a closed four-way union: derived, plural, conflict, obstruction. [cite: src/domain/admission/AdmissionOutcome.ts#6-11@c11d815f7d39116f92e6dc7af49b7230340ecfb8]
• Each variant has required, variant-specific witness data rather than an optional generic blob. [cite: src/domain/admission/DerivationWitness.ts#5-32@c11d815f7d39116f92e6dc7af49b7230340ecfb8] [cite: src/domain/admission/PluralityWitness.ts#6-43@c11d815f7d39116f92e6dc7af49b7230340ecfb8] [cite: src/domain/admission/ConflictWitness.ts#6-55@c11d815f7d39116f92e6dc7af49b7230340ecfb8] [cite: src/domain/admission/ObstructionWitness.ts#8-44@c11d815f7d39116f92e6dc7af49b7230340ecfb8]
• Runtime failure remains outside completed causal classification. [cite: src/domain/admission/AdmissionExecution.ts#1-4@c11d815f7d39116f92e6dc7af49b7230340ecfb8]
• Settlement plans are immutable, non-authoritative contracts bound to exact lanes, frontiers, proposal, law, and policy. [cite: src/domain/settlement/SettlementPlan.ts#4-53@c11d815f7d39116f92e6dc7af49b7230340ecfb8]
• Public doctrine now explicitly separates admission from settlement and preserves plurality as a lawful terminal posture. [cite: docs/topics/api/README.md#319-377@c11d815f7d39116f92e6dc7af49b7230340ecfb8] [cite: docs/topics/api/README.md#424-472@c11d815f7d39116f92e6dc7af49b7230340ecfb8]
• CRDT join is documented as a domain settlement law, not a universal merge guarantee. [cite: README.md#239-264@c11d815f7d39116f92e6dc7af49b7230340ecfb8]

This issue remains open. The next slice must integrate the semantic matrix into real intent/suffix admission paths, replace transitional runtime outcomes, and prove each classification with integration tests.

[flyingrobots]

PR #767 landed the runtime-backed admission-classifier checkpoint.

Implemented evidence:

• The classifier is exhaustive over derivation, plurality, conflict, and obstruction witnesses; malformed inputs remain outside the causal union. [cite: src/domain/admission/AdmissionClassifier.ts#14-34@54d0c25c4a2b465106742677d4757e81ed52ed8e]
• Plural suffix admission is lawfully admitted but cannot materialize a canonical target; conflict and obstruction remain distinct operational postures. [cite: src/domain/continuum/GitWarpWitnessedSuffixAdmissionShell.ts#70-93@54d0c25c4a2b465106742677d4757e81ed52ed8e]
• Suffix outcomes are rejected unless participant, destination runtime, source/destination bases, proposal, law, profile, and evaluation coordinate all match the shell. [cite: src/domain/continuum/GitWarpWitnessedSuffixAdmissionShell.ts#160-195@54d0c25c4a2b465106742677d4757e81ed52ed8e]
• Guarded descriptor admission captures one checkpoint/frontier coordinate and evaluates every property guard through that pinned bounded optic. [cite: src/domain/services/admission/BoundedIntentGuardReader.ts#36-78@54d0c25c4a2b465106742677d4757e81ed52ed8e]
• Derived and obstructed compatibility receipts now require the actual evaluation coordinate and typed witness evidence. [cite: src/domain/services/admission/IntentAdmissionReceiptFactory.ts#22-74@54d0c25c4a2b465106742677d4757e81ed52ed8e]
• Descriptor publication is retained through git-cas and returns exact pre-append basis, post-append frontier, publication identity, and retention witness. [cite: src/infrastructure/adapters/GitCasIntentStoreAdapter.ts#59-93@54d0c25c4a2b465106742677d4757e81ed52ed8e] [cite: src/infrastructure/adapters/GitCasIntentStoreAdapter.ts#124-137@54d0c25c4a2b465106742677d4757e81ed52ed8e]

This issue remains open. The root Timeline.write() / WriteReceipt path still uses the transitional public receipt outcome and must be converted before #765 is complete.