# Frozen no-tools semantic audit — EM-LND-17

## Verdict

**REVISE.** The identity decision and the boundary direction are sound and are accepted as audited; the revision is confined to object definitions and invariant enforceability within the two candidates and the projection boundary. Three of the supplied fixtures (`plan-observation-divergence`, `unknown-whereabouts`, `delegated-maintenance`) are **unsatisfiable against the objects as written**, and several stated invariants have no field to bind to. These are internal contradictions, not base or registry gaps, so they cannot be carried as holds.

## Material defects

1. **Observation provenance unenforceable.** The invariant requires observed placement to record observation time, ingestion time, **source**, precision and confidence, yet `observationTime`, `ingestionTime`, `precision`, `confidence` are all `optional` and no source/sensor field exists at all (`evidenceRefs` is optional and is not a source). An observed episode with none of these is admissible.
2. **Planned placement unanchored.** Synthesis and Grok both require a planned placement to belong to a named plan/scenario with authorizing context; `scenarioRef` and `basisRef` are both optional. A plan with no scenario and no basis is admissible, contradicting the mastership claim.
3. **Divergence owned but not representable.** `boundary.owns` includes "planned-versus-observed divergence" and an invariant asserts an "explicit divergence state", but no lifecycle value and no field carries it. Fixture `plan-observation-divergence` cannot pass.
4. **Lifecycle conflates mode, validity and epistemic state.** `status` repeats `placementMode` (`planned`/`observed`), permitting `placementMode: observed` with `status: planned`; `effective|corrected|superseded|closed` are record/validity states; `unknown` is an epistemic state about the asset, not a state of an episode.
5. **Unknown whereabouts unrepresentable.** `locusRef` and `locusKind` are required, so `status: unknown` is self-contradictory and the only escapes are a sentinel locus or omitting the fact. Fixture `unknown-whereabouts` cannot pass, and the required five-way distinction (**withheld / unknown / absent / disposed / never observed**) has no carrier — `disclosureClass` is optional and does not express it.
6. **No record-time axis and no version identity.** `versionIdentity` promises versions and the invariant requires corrections to "preserve the assertion that was previously effective", but there is no version id, no `assertedAt`/record interval, and no immutability rule. `ingestionTime` is optional and scoped to observations. Consequently `overwrite-move-history` is unenforceable and **reproducible history and as-of projection are unverifiable**.
7. **Lineage direction collides and is inconsistent across candidates.** `supersedesRef` serves both correction-versioning and successor-episode succession; the responsibility candidate exposes only `successorRef`. One direction, distinct from version lineage, must be used in both.
8. **No mutual exclusion over effective observed placements.** Nothing forbids two concurrently effective observed episodes at mutually exclusive loci at the same granularity for one asset; "a new effective locus closes or supersedes the prior episode" is prose, not a constraint.
9. **Gap semantics undeclared.** Episodes need not be contiguous (the in-transit leg of `leased-asset-move` has no locus), but no invariant states that *absence of an episode is not absence, disposal or non-placement* of the asset.
10. **`locusKind` is open, and granularity is conflated with precision.** The claimed "declared spatial granularity" needs a closed enumeration bound to the cited masters; `precision` carries no method and does not express granularity. Interior space (WM-BLT-002) is cited in synthesis as the finest level but is absent from `references` — the omission must be explicit, not silent. *(The WM-BLT-002 completion and multi-site facility apportionment gaps themselves remain holds.)*
11. **Responsibility: basis optional, transfer/suspension/revocation unenforced.** "Responsibility requires an authorizing authority **and governing basis**" while `governingBasisRef` is optional; `status: transferred` does not require `successorRef` (so `silent-transfer` cannot be rejected); suspension has no interval or resumption record; `revoked` vs `ended` are declared distinct but carry no revocation authority or reason, contradicting "retain authority provenance".
12. **Delegation cannot name a delegate.** Only `delegationConstraints` exists — no delegate party, no `delegatedFromRef`, no delegated validity. Fixture `delegated-maintenance` (bounded inspection to a contractor) cannot be expressed.
13. **Scope composition ambiguous.** `assetScopeRef` plus optional `locusScopeRef` admits two materially different readings (responsible for the asset everywhere vs only while at that locus), and no `scopeKind` distinguishes instance / class / locus-qualified set. No rule governs overlapping same-role assignments to different parties.
14. **Responsibility has no disclosure class.** A responsible party is frequently a natural person. Placement carries `disclosureClass`; responsibility carries none, so the projection boundary cannot suppress party identity.
15. **Projection constraints are owned by the wrong object.** "A projection never reconstructs a finer location than its authorized source rendition" is an invariant of the placement episode, which cannot enforce it; no projection object, pinned-input/as-of/digest requirement, suppression threshold, or cross-rendition composition rule exists. Equal-disclosure renditions at the same as-of can be differenced (generalized place ∩ count-of-one) to recover a withheld locus, and "withheld" has no output marker distinguishing it from absent.

## Required fixes

- Split `status` into `placementMode` (retained), a record/validity `status` (`effective|corrected|superseded|closed`) and an explicit `whereaboutsState` (`asserted|unknown|withheld|never-observed`); make `locusRef`/`locusKind` required only when `whereaboutsState = asserted`; forbid sentinel loci; add `lastKnownLocusRef` + `lastKnownAsOf` qualified separately.
- Make observation provenance (`observationTime`, `ingestionTime`, `sourceRef`, `precision` with method, `confidence`) conditionally required when `placementMode = observed`; make `scenarioRef` and `basisRef` conditionally required when `placementMode = planned`.
- Add a `divergence` assertion (planned episode ↔ observed episode, state, detected-at) satisfying the owned divergence fact.
- Add bitemporality to **both** candidates: `versionId`, `assertedAt`, record interval, immutability of previously effective versions, and one declared lineage direction (`supersedesRef` for succession, version chain separate).
- Add mutual-exclusion and gap invariants for placement; add overlap rules (or explicit joint accountability with apportionment) for same-role responsibility.
- Close `locusKind` over the cited masters; state interior-space deferral explicitly.
- Make `governingBasisRef` required; require `successorRef` when `transferred`; model suspension as an interval with authority and reason; separate `revoked` with revocation authority/reason.
- Model delegation as a related assignment with `delegateRef`, `delegatedFromRef`, delegated scope and validity, preserving accountability.
- Add `scopeKind` and declared scope-composition semantics for `assetScopeRef` × `locusScopeRef`; add `partyKind` + `disclosureClass`.
- Move all projection rules to a `LandscapeProjection` definition inside the landscape declaration: pinned input record-as-of, projection as-of, disclosure policy ref, digest, suppression threshold, no-refinement rule, cross-rendition composition ban, withheld-marker output, purpose-bound availability. It receives **no independent identity**.

## Additional fixtures

```json
[
{"target":"AssetPlacementEpisode","id":"observed-missing-provenance","kind":"negative","input":{"placementMode":"observed","assetRef":"asset/A1","locusKind":"facility","locusRef":"facility/F1","validFrom":"2026-03-01T00:00:00Z","assertingPartyRef":"party/P1","status":"effective","observationTime":null,"sourceRef":null},"expect":{"accepted":false},"expectedCode":"OBSERVED_PLACEMENT_MISSING_PROVENANCE"},
{"target":"AssetPlacementEpisode","id":"planned-missing-anchor","kind":"negative","input":{"placementMode":"planned","assetRef":"asset/A1","locusKind":"site","locusRef":"site/S2","validFrom":"2026-04-01T00:00:00Z","scenarioRef":null,"basisRef":null},"expect":{"accepted":false},"expectedCode":"PLANNED_PLACEMENT_MISSING_SCENARIO_OR_BASIS"},
{"target":"AssetPlacementEpisode","id":"mode-status-conflict","kind":"negative","input":{"placementMode":"observed","status":"planned"},"expect":{"accepted":false},"expectedCode":"PLACEMENT_MODE_STATUS_CONFLICT"},
{"target":"AssetPlacementEpisode","id":"divergence-explicit","kind":"positive","input":{"planned":{"placementMode":"planned","locusRef":"facility/FB","scenarioRef":"plan/MOVE1"},"observed":{"placementMode":"observed","locusRef":"facility/FA","observationTime":"2026-04-02T09:00:00Z"}},"expect":{"accepted":true,"bothRetained":true,"divergence":{"state":"diverged","plannedRef":"ep/1","observedRef":"ep/2"}}},
{"target":"AssetPlacementEpisode","id":"overlapping-observed-loci","kind":"negative","input":{"existing":{"placementMode":"observed","status":"effective","locusKind":"site","locusRef":"site/S1","validFrom":"2026-01-01T00:00:00Z","validTo":null},"incoming":{"placementMode":"observed","locusKind":"site","locusRef":"site/S2","validFrom":"2026-02-01T00:00:00Z"}},"expect":{"accepted":false},"expectedCode":"CONFLICTING_OVERLAPPING_OBSERVED_PLACEMENT"},
{"target":"AssetPlacementEpisode","id":"unknown-whereabouts-representable","kind":"positive","input":{"whereaboutsState":"unknown","locusRef":null,"lastKnownLocusRef":"facility/F1","lastKnownAsOf":"2026-02-10T00:00:00Z","assertingPartyRef":"party/P1"},"expect":{"accepted":true,"currentPlacement":null,"lastKnownQualifiedSeparately":true,"distinctFrom":["absent","disposed","withheld","never-observed"]}},
{"target":"AssetPlacementEpisode","id":"sentinel-unknown-locus","kind":"negative","input":{"whereaboutsState":"unknown","locusKind":"facility","locusRef":"facility/UNKNOWN"},"expect":{"accepted":false},"expectedCode":"SENTINEL_LOCUS_FORBIDDEN"},
{"target":"AssetPlacementEpisode","id":"withheld-distinct-from-unknown","kind":"positive","input":{"whereaboutsState":"withheld","disclosureClass":"restricted","basisRef":"policy/DISC1"},"expect":{"accepted":true,"storedLocusRetainedUnderPolicy":true,"outputMarker":"withheld"}},
{"target":"AssetPlacementEpisode","id":"correction-versions","kind":"positive","input":{"operation":"correct","episodeId":"ep/1","set":{"locusRef":"building/B2"},"assertedAt":"2026-03-05T00:00:00Z"},"expect":{"accepted":true,"versionCount":2,"priorVersionImmutable":true,"asOfRecordQuery":{"before":"building/B1","after":"building/B2"}}},
{"target":"AssetPlacementEpisode","id":"inplace-overwrite","kind":"negative","input":{"operation":"update","episodeId":"ep/1","set":{"locusRef":"site/S2"},"assertedAt":null,"supersedesRef":null},"expect":{"accepted":false},"expectedCode":"PLACEMENT_HISTORY_OVERWRITE_FORBIDDEN"},
{"target":"AssetPlacementEpisode","id":"gap-is-not-absence","kind":"positive","input":{"query":{"assetRef":"asset/A1","asOf":"2026-03-15T12:00:00Z"},"episodes":[{"status":"closed","locusRef":"site/S1","validTo":"2026-03-14T00:00:00Z"},{"placementMode":"planned","locusRef":"site/S2","validFrom":"2026-03-20T00:00:00Z"}]},"expect":{"accepted":true,"effectivePlacement":null,"interpretation":"no-asserted-placement","impliesAbsentOrDisposed":false}},
{"target":"AssetPlacementEpisode","id":"granularity-refinement","kind":"negative","input":{"derivedFrom":{"locusKind":"place","granularity":"jurisdiction"},"asserted":{"locusKind":"building","locusRef":"building/B7"}},"expect":{"accepted":false},"expectedCode":"GRANULARITY_REFINEMENT_FORBIDDEN"},
{"target":"OperationalResponsibilityAssignment","id":"missing-governing-basis","kind":"negative","input":{"responsiblePartyRef":"party/P2","assetScopeRef":"asset/A1","responsibilityRole":"operator","validFrom":"2026-03-01T00:00:00Z","authorityRef":"authority/G1","governingBasisRef":null},"expect":{"accepted":false},"expectedCode":"RESPONSIBILITY_MISSING_GOVERNING_BASIS"},
{"target":"OperationalResponsibilityAssignment","id":"transfer-without-successor","kind":"negative","input":{"status":"transferred","successorRef":null,"validTo":"2026-04-01T00:00:00Z"},"expect":{"accepted":false},"expectedCode":"TRANSFER_MISSING_AUTHORIZED_SUCCESSOR"},
{"target":"OperationalResponsibilityAssignment","id":"delegation-names-delegate","kind":"positive","input":{"accountable":{"id":"ora/1","responsiblePartyRef":"party/OP","status":"active"},"delegation":{"delegatedFromRef":"ora/1","delegateRef":"party/C1","delegatedScope":"inspection","validFrom":"2026-03-02T00:00:00Z","authorityRef":"authority/G1"}},"expect":{"accepted":true,"accountableUnchanged":true,"workPerformedAsserted":false}},
{"target":"OperationalResponsibilityAssignment","id":"delegation-without-delegate","kind":"negative","input":{"id":"ora/1","delegationConstraints":"inspection only","delegateRef":null},"expect":{"accepted":false},"expectedCode":"DELEGATION_MISSING_DELEGATE_PARTY"},
{"target":"OperationalResponsibilityAssignment","id":"suspension-interval","kind":"positive","input":{"status":"suspended","suspension":{"from":"2026-05-01T00:00:00Z","until":null,"authorityRef":"authority/G1","reason":"safety-hold"}},"expect":{"accepted":true,"resumptionCreatesVersion":true,"suspensionHistoryRetained":true,"distinctFromRevoked":true}},
{"target":"OperationalResponsibilityAssignment","id":"revocation-as-end","kind":"negative","input":{"status":"ended","revocation":{"authorityRef":"authority/G1","reason":"authority-withdrawn"}},"expect":{"accepted":false},"expectedCode":"REVOCATION_MISREPRESENTED_AS_END"},
{"target":"OperationalResponsibilityAssignment","id":"scope-composition-undeclared","kind":"negative","input":{"assetScopeRef":"asset/A1","locusScopeRef":"site/S1","scopeKind":null},"expect":{"accepted":false},"expectedCode":"SCOPE_COMPOSITION_UNDECLARED"},
{"target":"OperationalResponsibilityAssignment","id":"locus-qualified-scope","kind":"positive","input":{"scopeKind":"asset-instance-while-at-locus","assetScopeRef":"asset/A1","locusScopeRef":"site/S1","authorityRef":"authority/G1","governingBasisRef":"agreement/A9"},"expect":{"accepted":true,"placementChangeTransfersResponsibility":false,"outOfScopeLapseExplicit":true}},
{"target":"OperationalResponsibilityAssignment","id":"undeclared-same-role-overlap","kind":"negative","input":{"existing":{"status":"active","responsibilityRole":"operator","assetScopeRef":"asset/A1","validFrom":"2026-01-01T00:00:00Z"},"incoming":{"status":"active","responsibilityRole":"operator","assetScopeRef":"asset/A1","responsiblePartyRef":"party/P3","validFrom":"2026-02-01T00:00:00Z","jointAccountability":null}},"expect":{"accepted":false},"expectedCode":"UNDECLARED_OVERLAPPING_SAME_ROLE_ASSIGNMENT"},
{"target":"OperationalResponsibilityAssignment","id":"natural-person-no-disclosure","kind":"negative","input":{"responsiblePartyRef":"person/N1","partyKind":"natural-person","disclosureClass":null},"expect":{"accepted":false},"expectedCode":"PERSONAL_PARTY_MISSING_DISCLOSURE_CLASS"},
{"target":"LandscapeProjection","id":"reproducible-asof","kind":"positive","input":{"asOf":"2026-03-31T23:59:59Z","pinnedInputs":[{"candidate":"AssetPlacementEpisode","recordAsOf":"2026-04-01T00:00:00Z"},{"candidate":"OperationalResponsibilityAssignment","recordAsOf":"2026-04-01T00:00:00Z"}],"disclosurePolicyRef":"policy/DISC1","digest":"sha256:…"},"expect":{"accepted":true,"independentIdentity":false,"rerunDigestStable":true}},
{"target":"LandscapeProjection","id":"unpinned-inputs","kind":"negative","input":{"asOf":"2026-03-31T23:59:59Z","pinnedInputs":[],"digest":null},"expect":{"accepted":false},"expectedCode":"PROJECTION_INPUTS_UNPINNED"},
{"target":"LandscapeProjection","id":"refine-withheld-locus","kind":"negative","input":{"sourceRendition":{"locusKind":"place","granularity":"jurisdiction","whereaboutsState":"withheld"},"output":{"locusKind":"building","locusRef":"building/B7"}},"expect":{"accepted":false},"expectedCode":"PROJECTION_LOCATION_REFINEMENT"},
{"target":"LandscapeProjection","id":"small-cell-occupancy","kind":"negative","input":{"aggregation":"count","cell":{"locusKind":"building","locusRef":"building/B7"},"count":1,"minimumCell":5},"expect":{"accepted":false},"expectedCode":"SUPPRESSION_THRESHOLD_BREACH"},
{"target":"LandscapeProjection","id":"cross-rendition-differencing","kind":"negative","input":{"operation":"join","asOf":"2026-03-31T23:59:59Z","renditions":[{"disclosureClass":"public","granularity":"jurisdiction"},{"disclosureClass":"public","granularity":"facility","aggregate":{"count":1}}]},"expect":{"accepted":false},"expectedCode":"DIFFERENCING_DISCLOSURE"},
{"target":"LandscapeProjection","id":"withheld-marked-not-absent","kind":"positive","input":{"source":{"whereaboutsState":"withheld"},"disclosurePolicyRef":"policy/DISC1"},"expect":{"accepted":true,"output":{"locus":null,"marker":"withheld","distinctFrom":["absent","unknown","disposed","never-observed"]}}},
{"target":"LandscapeProjection","id":"availability-stored-timeless","kind":"negative","input":{"store":{"assetRef":"asset/A1","available":true,"purpose":null,"asOf":null}},"expect":{"accepted":false},"expectedCode":"AVAILABILITY_NOT_PURPOSE_BOUND"},
{"target":"LandscapeProjection","id":"view-identity-allocation","kind":"negative","input":{"occupancyView":{"requestIndependentIdentifier":true}},"expect":{"accepted":false},"expectedCode":"PROJECTION_IDENTITY_FORBIDDEN"},
{"target":"LandscapeProjection","id":"responsibility-from-placement","kind":"negative","input":{"derive":{"responsiblePartyRef":"operatorOf(effectivePlacement.locus)"}},"expect":{"accepted":false},"expectedCode":"RESPONSIBILITY_INFERRED_FROM_PLACEMENT"},
{"target":"LandscapeProjection","id":"completion-from-order","kind":"negative","input":{"derive":{"maintenanceStatus":"completed","from":["workOrderRef","activeResponsibilityAssignment"]}},"expect":{"accepted":false},"expectedCode":"COMPLETION_INFERRED_FROM_ORDER"}
]
```

## Identifier decision

**Both candidates genuinely require independent identity and both remain `allocationState: unassigned`.** `AssetPlacementEpisode` and `OperationalResponsibilityAssignment` are time-bounded, authority-bearing, externally referenceable facts whose history must survive changes to the asset, locus, party, declaration and view; they cannot be folded into WM-OBJ-001 custody, WM-BLT-* loci, or the landscape artifact. This audit **allocates no registry identifier, reserves no namespace, and confers no publication authority**; no WM-* identifier may be borrowed or guessed. `assetPlacementEpisodeId` and `operationalResponsibilityAssignmentId` are candidate-local semantic keys only. **Asset Place Landscape** keeps local governed-artifact identity only (scope, viewpoint, owner, pinned inputs, as-of, disclosure, digest); **Occupancy View / LandscapeProjection** receives **no independent identity**.

## Freeze decision

This is the single frozen semantic audit and it is **closed**; it will not be repeated. It discharges the "one frozen semantic audit" hold and records **REVISE**. The required fixes are a bounded editorial revision of the two candidates' object definitions, invariants and the relocated projection boundary, to be verified locally against the supplied plus additional fixtures — not a new review cycle. All other holds remain open and unaffected: registry allocation and namespace, WM-BLT-002 completion and interior-space authority, multi-site facility apportionment, WM-BLT-006/WM-BLT-008 publication holds, source crosswalks, privacy and employment-law review, canonical validation, package conversion and live verification. Both candidates stay `canonicalPublishable: false`; the artifact remains a declaration plus projection, not an operational placement or responsibility store.