# Frozen semantic audit — EM-FIN-04

## Verdict

**Conditional accept of the decision; artifacts not publishable.** The supplied evidence does not disprove the intended decision, and it is preserved: profile WM-ECO-018 for the consolidated statement; keep **Consolidation Scope** and **Consolidation Run** as independent identifier-unassigned candidates (both carry lifecycles that outlive and precede any statement issue, and both satisfy the version-identity test in the supplied `identityTest` blocks); profile **Elimination Entry** on WM-ECO-016 within one consolidation book and one run; leave source ledgers, organizations, control, holdings and policy externally mastered; allocate no catalogue, model or runtime ID.

Three convergent studies agree on the allocation shape, so the allocation is not the weak point. The weak point is that the reconciled artifacts under-specify the fields their own invariants require. Grok's stated failure condition for the elimination profile (a run-scoped adjustment discriminator that does not share source-journal identity) is **unmet in the supplied artifacts** — this is a specification gap, not a disproof, so the profile stands with defect 7 as a hard gate rather than being downgraded. No additional root is justified by any defect below.

## Material defects

**1. Reference-direction inversion between the candidates and WM-ECO-018.** Both `allocation-candidate.json` files list WM-ECO-018 in `boundary.references` ("Statements citing a scope revision"; "Statements citing selected run outputs"), while the profile asserts that WM-ECO-018 cites consolidation outputs. That is a cycle, and it couples scope/run lifecycle to the statement issue lifecycle that both files `exclude`.
*Remediation:* delete the WM-ECO-018 entry from `boundary.references` in both files; append to each `boundary.excludes`: `"inbound statement citation (WM-ECO-018 cites this root; this root never references a statement issue)"`. Citation direction is recorded only in `profile-candidate.json.constraints`.

**2. Run requires a scope pin it does not declare.** `ConsolidationRun.required` includes `scopeRevisionRef`, but Consolidation Scope appears nowhere in the run's `boundary.references`, and `excludes` says only "scope identity". A required pin to an undeclared target is dangling. Nothing forbids pinning a `draft` revision either, which contradicts "Every run pins one immutable scope revision".
*Remediation:* add to run `boundary.references`: `{"target":"candidate:consolidation-scope","purpose":"Pinned immutable scope revision consumed by the run","allocationState":"unassigned"}`; change the excludes item to `"scope identity and scope lifecycle (pinned by reference only)"`; add run invariant `"A run pins exactly one scope revision whose status is approved or effective at the run knowledge cut; draft revisions are not pinnable."`

**3. Mastership leak: scope owns control evidence.** Scope `boundary.owns` includes `"control basis, authority and evidence"`, which contradicts `profile-candidate.json` constraint 3 and grok's "Holdings, policy and organizations are cited, not re-decided inside the consolidation model."
*Remediation:* replace that `owns` item with `"citation of control basis, authority and evidence as versioned external references"`; append to `boundary.excludes`: `"control assessment, voting-power determination and economic-ownership determination"`.

**4. Unsafe inference channel left open on WM-ECO-038.** The scope candidate labels WM-ECO-038 `"Ownership and control assertions"` while an invariant in the same file states that economic ownership, voting power, control and consolidation treatment are separate assertions. WM-ORG-012 is simultaneously demoted to `"Enterprise group context"`. This is exactly the inference grok's counterexample attacks (60% with protective rights only; de facto control below 50%), and no invariant blocks percentage-driven inclusion — only *common ownership* is blocked.
*Remediation:* set the WM-ECO-038 purpose to `"Equity holding assertions used as inputs only; never a control basis"`; set the WM-ORG-012 purpose to `"Control and inter-organizational relationship assertions"`; add invariant `"Neither an ownership percentage nor any threshold establishes or refutes membership; membership requires an evidenced control basis valid in the membership interval."`

**5. No knowledge-time field exists anywhere.** `ScopeRevision` carries only `effectiveFrom`/`effectiveTo`; `ConsolidationRun` carries only `cutoff`/`executedAt`. Yet both files assert that valid and knowledge time stay distinct, and the acceptance result requires reproduction at a prior knowledge time. The invariants are unsupported by any field, so prior-knowledge replay is unimplementable as specified.
*Remediation:* add required `recordedAt` (RFC 3339, explicit offset) to `ScopeRevision`; add required `knowledgeCutAt`, `periodStart`, `periodEnd` to `ConsolidationRun`; add to both invariant sets: `"Replay at knowledge time T resolves only revisions and pins whose recordedAt is less than or equal to T, never current configuration."`

**6. Membership is an unstructured field, so purpose and mid-period intervals are unrepresentable.** `ScopeRevision.required.membership` has no declared structure. `purpose` sits on `ConsolidationScope`, while the invariant demands purpose per membership — making silent purpose reuse representable despite the `silent-purpose-reuse` fixture. Grok's mid-period full→equity change cannot be expressed at all.
*Remediation:* replace `membership` with `membershipRefs` and add object `ScopeMembership`: `identity ["consolidationScopeId","revision","memberOrgRef"]`; `required ["purpose","consolidationApproach","controlBasisRef","authorityRef","evidenceRefs","validFrom","recordedAt"]`; `optional ["validTo","ownershipAssertionRefs","nonComparabilityMarker"]`. Add invariant `"Statutory and management purposes never share a membership list, even when membership overlaps."`

**7. The elimination profile has no adjustment discriminator — grok's declared failure condition.** `profile-candidate.json` constrains eliminations "to one consolidation book and run" but names no field; claude-study records that WM-ECO-016 itself declares intercompany elimination unmodelled. Source and consolidation identity can therefore collapse, and `tolerance` is referenced by invariant while pinned nowhere.
*Remediation:* add a `profileFields` block for WM-ECO-016 with required `bookClass` (fixed value `consolidation`), `adjustmentClass` ∈ {`intercompanyRevenueCost`,`receivablePayable`,`investmentEquity`,`unrealisedProfit`,`dividend`}, `consolidationRunRef`, `scopeRevisionRef`, `counterpartyLegRefs` (exactly two, each `{bookRef, entryRef, lineRef}`), `matchKey`, `matchedAmount`, `unmatchedAmount`, `residualReason` ∈ {`timing`,`fx`,`inTransit`,`cutoff`,`none`}, `tolerancePolicyRef`, `initiatorRef`, `authorizationRef`. Add constraint: `"If WM-ECO-016 cannot carry bookClass and consolidationRunRef without sharing source-journal identity, this profile fails and no identifier is allocated."` Add hold: `"WM-ECO-016's self-declared omission of intercompany elimination structure is unclosed in the base."`

**8. The balancing invariant is incoherent.** "Entries balance within one book, currency, scope and tolerance" (local-evidence invariant 8, run invariant 6) treats scope as a balancing dimension. A perimeter is not a balancing dimension; this weakens the no-cross-ledger-balancing rule it is meant to restate.
*Remediation:* replace in all three artifacts with: `"Each entry balances within one consolidation book and one currency, inside one run, against one pinned tolerance policy revision; no cross-book or cross-currency netting; scope is not a balancing dimension."`

**9. Required run pins target masters that do not exist, with a contradictory home for mapping.** `mappingRefs` and `rateSetRef` are required; the only candidate home offered is WM-KNW-012 ("Accounting, mapping and transformation policy revisions"), while the holds simultaneously declare chart-of-accounts/mapping and FX rate set unallocated. `taxonomyRef` and `tolerancePolicyRef` are demanded by invariants but absent from the field list, and the run has no `contentDigest`, so its immutability is unverifiable. This is grok's version-addressability blocker.
*Remediation:* add required `taxonomyRef`, `tolerancePolicyRef`, `contentDigest`; re-type `mappingRefs`, `rateSetRef`, `taxonomyRef`, `tolerancePolicyRef`, `sourceRevisionRefs` as `ExternalVersionPin {masterRef|null, identifier, version, digest}` with `version` and `digest` required; narrow the WM-KNW-012 purpose to `"Accounting, consolidation-method and transformation policy revisions"`; add hold: `"Chart-of-accounts/group mapping, FX rate set, taxonomy, tolerance policy, intercompany match and trial-balance sets have no allocated master; they are carried as opaque external version pins and no identifier is allocated for them in this contour."`

**10. Lineage is one-directional and restatement semantics are missing.** `ConsolidationRun.optional` offers only `successorRunRef` — from a successor you cannot resolve the original, defeating "Restatement references and does not overwrite it". No `restatementClass`/`reason` field exists despite being required by the restatement section. `ScopeRevision.supersedesRevision` carries no reason.
*Remediation:* add to `ConsolidationRun.optional`: `supersedesRunRef`; make `restatementClass` and `restatementReason` required whenever `supersedesRunRef` is present. Add to `ScopeRevision`: `changeReason`, required whenever `supersedesRevision` is present. Add invariant to both: `"A successor resolves its predecessor and never replaces it; both editions remain resolvable."`

**11. Lifecycle is attached to the wrong object, and `failed`/`retired` are unspecified against citation.** `ConsolidationScope` holds the full `draft…superseded…retired` lifecycle while `ScopeRevision` — the object actually superseded — has no status field, so defect 2's pinnability rule has nothing to read. The run lifecycle admits `failed` and `retired` with no rule on whether their outputs are citable, so a statement's pin can dangle or cite a failed execution.
*Remediation:* set `ConsolidationScope.lifecycle` to `["draft","active","retired"]`; add `ScopeRevision.required.status` with `lifecycle ["draft","approved","effective","superseded"]`. Add run invariants: `"A failed run emits no citable output."` and `"A retired run remains immutable and resolvable for every statement that already cites it; retirement never invalidates an existing citation."` Add the same resolvability invariant for retired scope revisions (present in the scope file, absent in the run file).

**12. Authorization and segregation are unenforceable as specified.** `ConsolidationRun.executorRef` is optional, there is no run-level `authorizationRef`, and `TransformationStep.authorizationRef` is optional — while governance requires authority for run execution, elimination posting, post-cutoff adjustment, scope change, issue and restatement, with initiator/authorizer separation. The scope candidate has `authorityRef` but no initiator.
*Remediation:* make `executorRef` and `authorizationRef` required on `ConsolidationRun`; make `TransformationStep.authorizationRef` required when the step is a post-cutoff adjustment; add required `initiatorRef` and `authorizerRef` to `ScopeRevision`. Add to both invariant sets: `"initiatorRef differs from authorizerRef, or compensatingControlRef is present."`

**13. The profile states a correction as accomplished while holding it as pending.** `profile-candidate.json` constraint 1 asserts "WM-ECO-018 owns report and issue identity and cites consolidation outputs without executing consolidation", which the base does not currently declare; the same file holds that the WM-ECO-018 boundary "require[s] correction". A profile cannot narrow a base by assertion.
*Remediation:* rewrite constraint 1 as: `"WM-ECO-018 must be narrowed to report and issue identity plus citation of consolidation outputs; until that narrowing is recorded in the base, this profile is non-installable."` Add hold: `"WM-ECO-018's serviceLayers role claiming ownership of entity perimeter, ledger and position bindings, eliminations, transformations and lineage contradicts its own out_of_scope declaration; unresolved."`

**14. Missing publishability holds and fields.** `profile-candidate.json` carries neither `canonicalPublishable` nor `allocationState`. None of the three artifacts records: all bases being non-canonical reviewable drafts with four single-provider waivers and dual-provider timeouts on WM-ECO-018/017/038 and WM-ORG-012; the WM-ECO-018 COMPOSE WM-ECO-017 versus WM-ECO-017 REFERENCE WM-ECO-018 direction conflict (absent from the run candidate, which references WM-ECO-017); WM-ORG-012 parentage and WM-ECO-038 extension semantics (absent from the scope candidate, which references both); WM-REC-002 unfrozen parent; WM-ECO-018 marking every checklist dimension covered while admitting no external review. The explicit no-installability statement appears only in `local-evidence.md`.
*Remediation:* add `"canonicalPublishable": false, "allocationState": "unassigned"` to `profile-candidate.json`; append all six holds above to the `holds` array of whichever artifacts reference the affected base (run: composition direction, WM-ECO-017 evidence; scope: WM-ORG-012 parentage, WM-ECO-038 extension; all three: base draft status, waivers/timeouts, WM-REC-002); append to all three: `"No installability, canonical-completeness or publication-readiness claim is made."`

**15. Stale hold contradicted by the supplied evidence.** All three artifacts hold "Independent Grok review is pending" while `grok-study.raw.md` is supplied and records a conditional accept with five named blockers.
*Remediation:* replace that hold in all three with: `"Independent review recorded (grok-study.raw.md): conditional accept of the allocation. Open blockers: elimination adjustment discriminator; scope control-evidence version, perimeter type and effective date as consumable pins; version-addressable external references; restatement as a new run citing the original without a new identifier; separate statutory and management membership lists."` No further provider run is requested or required.

**16. Duplicate mastership of the comparability bridge.** Scope `owns` "effective periods and comparability lineage" plus `ScopeRevision.comparabilityBridgeRef`, while the run `owns` "contained run outputs and comparability bridge". Two roots master one artifact, and the bridge has no declared structure in either.
*Remediation:* assign the bridge to Consolidation Run alone (it decomposes pinned figures across two runs). Change the scope `owns` item to `"effective periods and revision lineage"`; delete `comparabilityBridgeRef` from `ScopeRevision.optional` and add `bridgeRequired` (boolean, true whenever `supersedesRevision` is present). Add run object `ComparabilityBridge`: `identity ["consolidationRunId","comparedRunRef"]`; `required ["scopeDelta","methodDelta","rateDelta","activityDelta","nonComparabilityMarker"]`.

**17. Non-deterministic and boundary-crossing fixtures.** (a) Run fixture `two-ledger-run` names "rate set FX1" where the shared acceptance scenario uses `FX-2026Q2`. (b) `paired-elimination` states no amounts, currencies, book or tolerance, so "documented FX residual" is not decidable. (c) `late-adjustment` asserts statement-version behaviour and cites "statement A1", both outside the run boundary, which excludes statement issue lifecycle. (d) `current-rate-replay` names no replay operation and no knowledge time. (e) Both fixture files key cases to the mutable `candidateName` and omit `contourId`. (f) `profile-candidate.json` carries six constraints and zero fixtures.
*Remediation:* add `"contourId":"EM-FIN-04"` and `"candidateKey":"candidate-allocation-offline-consolidation-scope"` / `"candidate-allocation-offline-consolidation-run"` to the two fixture files; state every amount, currency, RFC 3339 instant with offset, book, mapping, rate-set and tolerance identifier literally; change `FX1` to `FX-2026Q2`; rewrite `late-adjustment.expect` to `"A successor run R2 is created; R1 remains immutable and resolvable at its own knowledge cut."`; create `candidate-profile-offline-consolidated-statement/fixtures.json` with `"format":"vercy-enterprise-allocation-fixtures/v1"`, `"contourId":"EM-FIN-04"`, `"candidateKey":"candidate-profile-offline-consolidated-statement"` and carry the statement-version assertion there; add an `invariantRefs` array to every case naming the invariants it exercises.

## Exact additional fixtures

```json
[
  {"candidateKey":"candidate-allocation-offline-consolidation-scope","id":"knowledge-time-replay","kind":"positive","input":"Scope S-1 revision 2 has effectiveFrom 2026-01-01T00:00:00+02:00 and recordedAt 2026-02-10T09:00:00+02:00. Revision 3 has effectiveFrom 2026-01-01T00:00:00+02:00 and recordedAt 2026-05-01T09:00:00+02:00. Replay is requested at knowledge time 2026-03-01T00:00:00+02:00.","expect":"Only revision 2 resolves; revision 3 is invisible at that knowledge cut even though its valid time covers the period.","invariantRefs":["Valid time and knowledge time remain distinct","Replay at knowledge time T resolves only revisions recorded at or before T"]},
  {"candidateKey":"candidate-allocation-offline-consolidation-scope","id":"draft-revision-not-pinnable","kind":"negative","input":"Run R1 pins S-1 revision 4 whose status is draft.","expect":"The pin is rejected; only approved or effective revisions are pinnable.","invariantRefs":["Every run pins one immutable scope revision"]},
  {"candidateKey":"candidate-allocation-offline-consolidation-scope","id":"protective-rights-only","kind":"negative","input":"ORG-P holds 60.00% of ORG-C ordinary shares; the only recorded instrument grants protective rights and no control basis is asserted.","expect":"Membership is rejected; an ownership percentage neither establishes nor refutes inclusion.","invariantRefs":["Neither an ownership percentage nor any threshold establishes or refutes membership","Economic ownership, voting power, control and consolidation treatment remain separate assertions"]},
  {"candidateKey":"candidate-allocation-offline-consolidation-scope","id":"de-facto-control-below-majority","kind":"positive","input":"ORG-P holds 35.00% of ORG-D ordinary shares (denominator: issued voting ordinary shares) and an evidenced de facto control instrument valid from 2026-03-01T00:00:00+02:00.","expect":"Membership is accepted with purpose, consolidation approach, controlBasisRef, authorityRef, evidenceRefs, validFrom and recordedAt recorded; the holding is cited as input only.","invariantRefs":["Membership requires an evidenced control basis valid in the membership interval","Ownership assertions state right type, class, denominator and time"]},
  {"candidateKey":"candidate-allocation-offline-consolidation-scope","id":"mid-period-method-change","kind":"positive","input":"ORG-S is consolidated full from 2026-01-01T00:00:00+02:00 and by equity method from 2026-04-16T00:00:00+02:00 inside reporting period 2026-01-01/2026-06-30.","expect":"Revision 3 records two ScopeMembership intervals for ORG-S with distinct consolidationApproach values; the post-change portion is isolable and the two intervals are not additive without a comparability bridge.","invariantRefs":["Membership states interval and consolidation approach","Scope changes produce comparability bridges"]},
  {"candidateKey":"candidate-allocation-offline-consolidation-scope","id":"membership-purpose-required","kind":"negative","input":"A ScopeMembership for ORG-S omits purpose and relies on the scope-level purpose value 'statutory'.","expect":"The membership is rejected; purpose is asserted per membership and never inherited silently.","invariantRefs":["Every membership states purpose","Management and statutory perimeters remain parallel and non-substitutable"]},
  {"candidateKey":"candidate-allocation-offline-consolidation-scope","id":"separate-membership-lists","kind":"negative","input":"The statutory and management perimeters of S-1 revision 2 are recorded as one membership list distinguished only by a per-member flag.","expect":"The shared list is rejected; statutory and management purposes require separate membership sets even where membership overlaps.","invariantRefs":["Statutory and management purposes never share a membership list"]},
  {"candidateKey":"candidate-allocation-offline-consolidation-scope","id":"retired-scope-resolvable","kind":"positive","input":"Scope S-9 is retired on 2026-09-30T23:59:59+02:00; statement edition A1.1 issued 2026-08-14T12:00:00+02:00 cites S-9 revision 4.","expect":"S-9 revision 4 remains resolvable and immutable; the identifier is never recycled.","invariantRefs":["Retired identifiers and revisions remain resolvable","Scope identifiers are never recycled"]},
  {"candidateKey":"candidate-allocation-offline-consolidation-scope","id":"control-evidence-restated","kind":"positive","input":"On 2026-11-02T10:00:00+02:00 the control evidence behind ORG-S inclusion is restated.","expect":"A successor revision with changeReason is created; the prior revision and every run already pinning it remain unchanged and resolvable.","invariantRefs":["A successor resolves its predecessor and never replaces it","Original and recalculated perimeters remain resolvable"]},
  {"candidateKey":"candidate-allocation-offline-consolidation-run","id":"run-complete-pin-set","kind":"positive","input":"Run R1 pins S-1 revision 2, framework IFRS-2026, taxonomy TX-2026, mapping M1, rate set FX-2026Q2, tolerance policy TOL-1, books L-STAT (EUR) revision 118 and L-MGMT (USD) revision 64, cutoff 2026-06-30T23:59:59+02:00, knowledgeCutAt 2026-07-05T09:00:00+02:00, executorRef U-41, authorizationRef U-07, contentDigest present.","expect":"The run is accepted and reproducible from its pins alone.","invariantRefs":["Every run pins scope, framework, taxonomy, rates, mappings, cutoff and source revisions"]},
  {"candidateKey":"candidate-allocation-offline-consolidation-run","id":"run-missing-taxonomy-pin","kind":"negative","input":"Run R4 pins framework IFRS-2026 but records no taxonomyRef and no tolerancePolicyRef.","expect":"The run is rejected as unreproducible; the pin set is incomplete.","invariantRefs":["Every run pins scope, framework, taxonomy, rates, mappings, cutoff and source revisions"]},
  {"candidateKey":"candidate-allocation-offline-consolidation-run","id":"unversioned-external-pin","kind":"negative","input":"Run R5 pins the rate set as identifier 'FX-2026Q2' with no version and no digest.","expect":"The pin is rejected; external references must be version-addressable with a digest.","invariantRefs":["Rate value, type, date, source and set version are pinned"]},
  {"candidateKey":"candidate-allocation-offline-consolidation-run","id":"elimination-discriminator-required","kind":"negative","input":"An entry is posted to consolidation book CB-GRP-STAT with no bookClass and no consolidationRunRef.","expect":"The entry is rejected; without the discriminator a consolidation adjustment is indistinguishable from a source posting.","invariantRefs":["Adjustments post only to consolidation books","Source postings remain immutable in their books"]},
  {"candidateKey":"candidate-allocation-offline-consolidation-run","id":"elimination-within-tolerance","kind":"positive","input":"Elimination E1 in CB-GRP-STAT (EUR), run R1, adjustmentClass intercompanyRevenueCost, removes revenue 100000.00 EUR and cost 70000.00 EUR, cites legs L-STAT entry 9912 line 3 and L-MGMT entry 4471 line 1, matchKey IC-8841, matchedAmount 100000.00 EUR, unmatchedAmount 120.00 EUR, residualReason fx, tolerance policy TOL-1 threshold 250.00 EUR, initiatorRef U-41, authorizationRef U-07.","expect":"The elimination is accepted; the 120.00 EUR residual is recorded with its reason and evaluated against TOL-1.","invariantRefs":["Every elimination cites paired evidence and explains residuals","Each entry balances within one consolidation book and one currency against one pinned tolerance policy revision"]},
  {"candidateKey":"candidate-allocation-offline-consolidation-run","id":"elimination-tolerance-unpinned","kind":"negative","input":"Elimination E2 carries unmatchedAmount 120.00 EUR and residualReason fx but no tolerancePolicyRef.","expect":"The elimination is rejected; tolerance is not implicit.","invariantRefs":["Each entry balances against one pinned tolerance policy revision"]},
  {"candidateKey":"candidate-allocation-offline-consolidation-run","id":"cross-book-netting","kind":"negative","input":"Elimination E3 nets a leg in source book L-STAT against a leg in consolidation book CB-GRP-STAT.","expect":"The entry is rejected; no cross-book netting and no posting into a source book.","invariantRefs":["Eliminations post only to consolidation books","No cross-book or cross-currency netting"]},
  {"candidateKey":"candidate-allocation-offline-consolidation-run","id":"cross-currency-balance","kind":"negative","input":"Elimination E4 balances a 100000.00 EUR leg against a 108000.00 USD leg with no transaction, functional and presentation currency roles and no rate pin.","expect":"The entry is rejected; balancing is single-currency and currency roles plus rate pins are explicit.","invariantRefs":["Transaction, functional and presentation currencies remain explicit"]},
  {"candidateKey":"candidate-allocation-offline-consolidation-run","id":"failed-run-not-citable","kind":"negative","input":"Statement edition A1.1 cites run R6 whose status is failed.","expect":"The citation is rejected; a failed run emits no citable output.","invariantRefs":["A failed run emits no citable output"]},
  {"candidateKey":"candidate-allocation-offline-consolidation-run","id":"retired-run-citation-durability","kind":"positive","input":"Run R1 is retired on 2026-12-01T09:00:00+02:00 after A1.1 has cited it.","expect":"R1 remains immutable and resolvable; the existing citation stays valid and the identifier is never recycled.","invariantRefs":["A retired run remains immutable and resolvable for every statement that already cites it","Run identifiers and contained steps are never recycled"]},
  {"candidateKey":"candidate-allocation-offline-consolidation-run","id":"successor-lineage-bidirectional","kind":"positive","input":"Run R2 corrects R1 with restatementClass 'errorCorrection' and a recorded restatementReason.","expect":"R2 records supersedesRunRef R1 and R1 records successorRunRef R2; both runs resolve independently and neither is overwritten.","invariantRefs":["A successor resolves its predecessor and never replaces it","Completed runs are immutable and corrected by successors"]},
  {"candidateKey":"candidate-allocation-offline-consolidation-run","id":"post-cutoff-adjustment-authorized","kind":"negative","input":"A transformation step applying an adjustment dated 2026-07-12T10:00:00+02:00, after cutoff 2026-06-30T23:59:59+02:00, carries no authorizationRef.","expect":"The step is rejected; post-cutoff adjustments are dated and authorized and are never backdated into R1.","invariantRefs":["Post-cutoff adjustments are dated and authorized"]},
  {"candidateKey":"candidate-allocation-offline-consolidation-run","id":"initiator-equals-authorizer","kind":"negative","input":"Run R7 records executorRef U-41 and authorizationRef U-41 with no compensatingControlRef.","expect":"The run is rejected; initiator and authorizer are separated or a compensating control is recorded.","invariantRefs":["initiatorRef differs from authorizerRef, or compensatingControlRef is present"]},
  {"candidateKey":"candidate-allocation-offline-consolidation-run","id":"comparability-bridge-required","kind":"positive","input":"R2 pins S-1 revision 3, which removes a disposed subsidiary, and is compared with R1 on S-1 revision 2.","expect":"A ComparabilityBridge for (R2, R1) records scopeDelta, methodDelta, rateDelta, activityDelta and a nonComparabilityMarker; results across the two scope revisions are not additive.","invariantRefs":["Scope changes produce comparability bridges"]},
  {"candidateKey":"candidate-profile-offline-consolidated-statement","id":"statement-cites-not-owns","kind":"negative","input":"Statement edition A1.1 embeds the ORG-S membership list and the transformation steps of R1 as its own content.","expect":"The edition is rejected; WM-ECO-018 cites scopeRevisionRef and consolidationRunRef and never absorbs scope, run or transformation facts.","invariantRefs":["Statement identity does not contain scope, run, transformation or ledger facts"]},
  {"candidateKey":"candidate-profile-offline-consolidated-statement","id":"statement-pin-set","kind":"positive","input":"Statement edition A1.1 issued 2026-08-14T12:00:00+02:00 pins S-1 revision 2, framework IFRS-2026, taxonomy TX-2026, rate set FX-2026Q2, run R1 and ledger revisions L-STAT 118 and L-MGMT 64.","expect":"The edition is accepted and reproducible at its own knowledge cut from the pinned inputs alone.","invariantRefs":["Every statement pins scope, method/framework, taxonomy, rate set, run and ledger revisions"]},
  {"candidateKey":"candidate-profile-offline-consolidated-statement","id":"restatement-preserves-original","kind":"positive","input":"Edition A1.2, built on R2, is issued 2026-12-10T12:00:00+02:00 with restatementClass and reason and is published.","expect":"A1.1 remains resolvable and labelled as the original edition; publication erases neither edition and neither overwrites the other.","invariantRefs":["Restatements append versions and preserve originals","Publication never erases a prior or recalculated edition"]},
  {"candidateKey":"candidate-profile-offline-consolidated-statement","id":"state-independence","kind":"negative","input":"Edition A1.3 is treated as validated because filing was accepted on 2027-01-15T12:00:00+02:00.","expect":"The inference is rejected; approval, assurance, issue, filing and publication are independent states and none validates a figure.","invariantRefs":["Approval, assurance, issue, filing and publication remain independent states"]},
  {"candidateKey":"candidate-profile-offline-consolidated-statement","id":"assurance-pins-versions","kind":"positive","input":"An external assurance engagement cites run R1 by contentDigest and statement edition A1.1 by version.","expect":"The engagement remains externally mastered, pins exact versions, and relies on immutability at knowledge time rather than recomputation against later masters.","invariantRefs":["Assurance engagements remain external and pin exact run and statement versions"]},
  {"candidateKey":"candidate-profile-offline-consolidated-statement","id":"statement-owns-no-scope-history","kind":"negative","input":"A scope change is applied by editing statement edition A1.1 rather than creating S-1 revision 3.","expect":"The edit is rejected; a scope change is a new scope revision, never an edit of a statement.","invariantRefs":["A statement cites but never owns scope history"]}
]
```

## Final freeze decision

**FREEZE — decision frozen, publication withheld.** The boundary decision is frozen exactly as stated in the Verdict and is not reopened: no new root beyond the two identifier-unassigned candidates, no identifier allocated, no catalogue or runtime entry, no reassignment of external mastership. The three artifacts are frozen as **non-canonical, non-installable and non-publishable**: defects 1–17 are mandatory pre-publication edits, and defect 7 is a hard gate — if WM-ECO-016 cannot carry `bookClass` and `consolidationRunRef` without sharing source-journal identity, the Elimination Entry profile fails and still yields no identifier. Defects 2, 5, 6, 9, 10 and 17 must land before the two-ledger, scope-change and intercompany-sale acceptance result may be claimed as assured; it is not assured now. This audit is final for this contour and no further provider run is requested.

---

If you want this persisted, say so and I'll write it to `research/enterprise/runs/em-fin-04/frozen-audit.md` alongside the prompt and the raw studies; I haven't touched the working tree.