# FROZEN SEMANTIC AUDIT — EM-ORG-04 "Организационная единица и мандат"  Single independent frozen auditor. No tools used. Every statement below is grounded in the frozen dossier, the two provider studies, the comparison note, the candidate and the fixtures. No identifiers or external facts are introduced; where a provider introduced one, that is recorded as a defect rather than adopted.  ---  ## 1. Verdict  **REVISE.**  The boundary decision is right and the artifacts are not releasable. Fifty defects below are load-bearing: the mandate cardinality in the pinned base contradicts the candidate's own mandate contract (D31), the scenario qualifier the candidate reasons with does not exist in the base and is written in the indicative as if it did (D19), the axis enum is partly invented and conflates containment with reporting lines (D13/D14), the team boundary rests on an identifier absent from the frozen material (D26), the relation plane disagrees with the spec on both neighbour edges (D11/D12), three composition targets are `required: true` with no identifier or pin (D48), and the fixture set carries digests over an undeclared preimage while `fixturesExecuted` is false (D42). None of these is fatal to the decision; all of them are fatal to publication.  ## 2. PROFILE over WM-ORG-002 — **CONFIRMED**, no new identifier  Confirmed on the pinned base, not on provider consensus.  - **No residue.** All four candidate types resolve to existing base constructs: `OrganizationalUnit` → `de-unit-id`/`de-unit-id-scheme` with parent-scoped minting; `UnitType` → `de-unit-kind` + `de-classification-scheme` (versioned, `1..n`); `UnitMandate` → `remitStatement`/`purposeCode`/`mandateValidity` plus the `assign-unit-mandate` function; `StructuralPlacement` → `de-hierarchy-edge`, already defined as "a parent-child edge qualified by hierarchy identifier and validity period". - **No independent lifecycle.** Mandate has no identity apart from (unit, delegating instrument, interval) and no existence without its unit; type is an assignment against an external scheme; placement is a relation. Only the unit is a persistent identified thing — which is exactly the base's accepted `entry_kind: entity`. - **A second model would create the harm the dossier forbids.** Specific question 3 asks how to reconcile OUMM with WM-ORG-002 "без двух владельцев unit". Minting `EM-ORG-04` as a model, or minting registry/runtime ids for the four types, produces a second unit master and a second authored parent path — the precise dual-write the profile exists to close. - **Registry state supports constraint, not creation.** `vr.wm-org-002` is reserved, `nav_path` assigned, `contains_ids` populated; `parent_ids` is empty and `review_state` is `migration-boundary-review` — an open boundary on an existing reservation, not a vacancy.  **Confirmed with three conditions.** (a) `profileTypes` are profile-local labels only; they receive no registry id, no `registry_id`, no `nav_path`, no runtime id. (b) The profile adds constraints and one qualifier dimension; it redefines no base element. (c) Every added element — scenario, axis mode, reified mandate key — is declared as an explicit delta against digest `9e3e80da…` and is not described as base behaviour.  **Evidence ceiling on the confirmation.** The EM-ORG-04 → WM-ORG-002 link is `conceptual-candidate` at `index-and-publication-metadata` depth; both ledger relations are `review_state: candidate`; the reviewer projection is 20 of 28 findings. The confirmation is a boundary finding. It is not a crosswalk verification, and the dossier's blocking decision "Подтвердить semantic crosswalk, права и source mastership" remains open.  ---  ## 3. Defect register  Each entry: defect → exact remediation → fixture expectation. Fixture ids in `code` are existing cases to amend; others are new.  ### A. Identity drift  **D01 — Identifier reassignment unstated.** `unit-identifier-scheme` asks "is it guaranteed never to be reassigned" and no artifact answers. *Fix:* Profile invariant — `unitIdentifier` is never reassigned to a different unit, including after disbandment, tombstoning or withdrawal-as-error; the minting act is recorded. *Fixture (`id-no-reuse`, negative):* minting a unit with an identifier previously held by a disbanded or withdrawn unit → refused, with the prior tombstone cited.  **D02 — Continuity decision non-deterministic.** `merge-lineage` expects "new or retained ID follows explicit continuity decision"; a fixture whose expectation is a disjunction cannot fail. *Fix:* `continuityDecision ∈ {retain, mint-new}` is a required field on merge, split, transfer and disband acts. *Fixture:* split `merge-lineage` into `merge-retain` (same id, predecessor edges on absorbed units) and `merge-mint` (new id, predecessor edges to both); add `merge-no-decision` (negative) → act refused.  **D03 — Cross-organization transfer vs immutable owner link.** `parent-child-containment` asks whether the WM-ORG-001 link is "mandatory and immutable for the unit's lifetime"; `reorganization-act` admits "transfer between organizations"; Grok asserts lifetime immutability *and* transfer in the same study. *Fix:* Choose one and record it: either `parentOrganizationRef` is immutable ⇒ transfer mints a new unit with lineage, or it is mutable only through an act that closes and opens intervals. No third reading. *Fixture (`transfer-owner`):* under immutability, transfer retaining the id → refused; transfer minting a successor with lineage → accepted. Add `transfer-no-lineage` (negative) → refused.  **D04 — `resolve-unit-identity` has no ambiguity contract.** It accepts aliases, former names, LDAP DNs and IdP group ids; name reuse after disbandment and DN instability are open deferred items. *Fix:* Only `unitIdentifier`+scheme and the ISO/IEC 6523 OPI are resolution keys; `alternateIdentifiers`, aliases and former names are advisory; resolution MUST refuse when more than one candidate matches. *Fixture (`resolve-ambiguous`, negative):* two units sharing a former name → refused with the candidate set returned, never an arbitrary pick. `resolve-stale-dn` (negative): reparented LDAP DN does not resolve as identity.  **D05 — Unpinned second definition of the same model.** Registry cites `models/organizations/O2-organizational-unit.md` (`legacy_alias: O2`); only `publications/…/spec.yaml` is digest-pinned. *Fix:* Mark the O2 path superseded and non-authoritative in the profile pins, or pin it by digest. *Fixture (`pin-set`, gate):* fails if any base spec path is referenced without a digest or a superseded marker.  **D06 — Base version lineage inconsistent.** Registry `status: described-previous-version` against `metaModel.previousVersions: []`; `source_version_or_year: 2026-08-22` against `generatedAt: 2026-08-23T23:43:44Z`. (Claude treats this as a reconciliation item; on a digest-pinned base it is a pin-integrity defect, because `invalidationRule` covers "reservation drift" but nothing compares the planes.) *Fix:* Reconcile registry and spec version/date fields before pinning; extend `invalidationRule` to registry fields explicitly. *Fixture (`pin-consistency`, gate):* fails on any registry/spec version or date mismatch.  **D07 — Status is a single current slot.** `unitStatus` `1` + `statusEffectiveFrom` `1`, no interval history, while the profile promises append-only correction. *Fix:* Status becomes an interval-keyed bitemporal assertion; the singleton becomes a derived current view. *Fixture (`status-history`):* after a status change, the prior status is retrievable at its own as-of; in-place overwrite refused.  **D08 — Reclassification identity untested.** Constraint 2 promises reclassification preserves identity; no fixture exercises it. *Fixture (`reclassify`):* same `unitIdentifier`, new dated `UnitType` assignment, prior classification retained as a closed interval.  ### B. Parent dual-write  **D09 — Unqualified authored parent survives, and its remediation is a disjunction.** `de-parent-unit-ref` (`0..1`) sits on the unit record; candidate constraint 6 says "removed **or** becomes a derived read projection" — unresolvable as a frozen rule. *Fix:* Remove it from the authored schema. If retained for compatibility, it is read-only and derived from placements under one named default (managerial axis, authoritative scenario, as-of now); writes to it are refused. *Fixture:* amend `parent-dual-write` so neither side wins — the write is refused, not reconciled; add `parent-read-derived` (positive): the read equals the derived default and changes when the default placement changes.  **D10 — `hierarchyPath` derivation source unspecified.** It is "derived not asserted" from a parent pointer that is about to be removed; no artifact repoints it. *Fix:* `hierarchyPath` derives solely from placement edges under (axis, scenario, as-of). *Fixture (`path-derivation`):* asserted path refused; derived path matches the placement chain; the same unit yields different paths on two axes and both resolve correctly.  **D11 — Axis membership asserted twice.** `de-hierarchy-id` is `1..n` **required on the unit** while `de-hierarchy-edge` also carries the hierarchy identifier — two sources for "which axes this unit participates in". *Fix:* The axis register is organization-level; unit-level `hierarchyIdentifier` becomes derived or non-authoritative. *Fixture (`axis-membership-drift`, negative):* unit declaring an axis on which it holds no placement → flagged and refused.  **D12 — Relation plane disagrees with the spec on the WM-ORG-001 edge.** Registry `composition_role: CONTAINS` and ledger `WM-ORG-001 CONTAINS WM-ORG-002` against spec composition `relation: REFERENCE`; registry `parent_ids` is empty while the ledger asserts the parent. *Fix:* One relation vocabulary. Adopt the digest-pinned spec (`REFERENCE`, `required: true`) and correct ledger and registry; both remain `candidate`. *Fixture (`relation-plane`, gate):* fails when registry, ledger and spec composition diverge on any neighbour edge.  **D13 — The WM-ORG-004 edge is labelled four ways.** Registry `contains_ids: WM-ORG-004`; ledger `CONTAINS`; spec composition `relation: CHILD, required: false`; boundary note "CONTAINS by reference rather than by copy". *Fix:* Same single vocabulary; state reference-not-copy once, in the composition entry. *Fixture:* same `relation-plane` gate.  ### C. Graph cardinality and cycles  **D14 — No axis-mode attribute, so cardinality rules are unenforceable.** `de-hierarchy-id` carries "identifier and purpose" only. Fixture `graph-multiple` expects "accept if acyclic" on an axis profile that has no home in any artifact, and its expectation is conditional. *Fix:* Add `axisMode ∈ {tree, dag}` and a parent-cardinality bound to the axis declaration; tree axes bind ≤1 parent per (child, scenario, instant). *Fixture:* replace `graph-multiple` with `axis-mode-tree` (negative — two parents on a tree axis refused) and `axis-mode-dag` (positive — identical input accepted on a dag axis, acyclicity still enforced).  **D15 — Candidate axis enum is partly invented and partly conflated.** `placementContract.axes` lists `administrative` (base says managerial), `project` (absent from the base; imported from Grok prose), and `reporting` — which collapses the CODM internal-reporting hierarchy together with `reportingLine` edges that the base models as a separate, explicitly non-conformant relation. *Fix:* Bind the enum to the base's hierarchies — managerial, legal-entity roll-up, cost/budget roll-up, functional/professional, internal-reporting (CODM). Keep `reportingLine` a relation, never an axis. Drop `project`, or admit it as a declared profile addition with its own justification. *Fixture (`axis-enum`, negative):* placement on an undeclared axis refused. (`reporting-as-placement`, negative): a reporting line written as a placement refused; written as a `reportingLine` accepted.  **D16 — `isCodmReportingHierarchy` unconstrained.** `0..1` boolean with no uniqueness rule, while IFRS 8 alignment depends on exactly one. *Fix:* At most one axis flagged CODM per organization per overlapping period. *Fixture (`codm-unique`, negative):* a second CODM-flagged axis in an overlapping period refused.  **D17 — Gap policy unresolved.** `effective-dating-bitemporality` asks whether gaps *or* overlaps are permitted between successive parent assignments; the candidate rules on overlap only. *Fix:* Decide and state: on tree axes, a gap is permitted only while the unit is non-active (proposed, dormant, suspended, disbanded); otherwise refused. *Fixture (`placement-gap-active`, negative):* gap between successive managerial placements of an active unit refused. (`placement-gap-dormant`, positive): the same gap accepted while dormant.  **D18 — No root or orphan rule.** `parentUnitRef` `0..1` makes every unit a candidate root; orphan rate appears only as a quality measure, not a constraint. *Fix:* Exactly one root per (organization, axis, scenario, interval) on tree axes; every active non-root unit holds a parent placement. *Fixture (`second-root`, negative) and (`orphan-active`, negative):* both refused; `orphan-dormant` accepted under D17.  **D19 — `validate-structure-graph` has no scenario dimension.** Its stated rule is "single parent per hierarchy per validity interval" — scenario is absent, so as-is and to-be edges would be evaluated as one graph. *Fix:* Key every rule on (axis, scenario, interval). *Fixture:* extend `axis-cycle` and `union-cycle` with `scenario-joint-eval` (negative — joint evaluation across branches refused) and `scenario-per-branch` (positive — each branch validates independently).  ### D. Scenario leakage  **D20 — The scenario qualifier does not exist in the base, and the candidate states it in the indicative.** No data element carries it: `hierarchyEdge` is qualified by hierarchy id and validity only; `asOfParameters` holds world-time and record-time only. Candidate constraints read "StructuralPlacement **is** the only authored parent path". The publication gate correctly lists the field as absent, so the constraints contradict the gate. Claude records this as the single material capability gap; Grok describes hypotheticals as "first-class 002 facts". On the frozen evidence Claude is right. *Fix:* Rewrite all constraints in normative modal form ("MUST, once the delta is applied") and attach an explicit delta list against digest `9e3e80da…` naming scenario as an addition, not a base feature. *Fixture (`scenario-required`, negative):* placement written without a scenario refused; silent default-injection to authoritative forbidden.  **D21 — Twelve function signatures lack scenario.** `validate-structure-graph`, `reconstruct-structure-as-of`, `derive-org-chart`, `compute-headcount-rollup`, `evaluate-mandate-conflict`, `emit-standards-mapping`, `reconcile-external-directory`, `apply-reorganization-act`, `assign-unit-mandate`, `assert-reporting-line`, `seat-post-in-unit`, `record-staffing-snapshot`. Claude names three; Grok names none; the candidate names none. *Fix:* Scenario is a required parameter on every read and write; there is no implicit authoritative default. *Fixture (`scenario-fn-matrix`):* one case per function — a hypothetical branch is excluded from rollup, from directory push, from standards export, from the org chart, and from mandate-conflict evaluation.  **D22 — A hypothetical act would fire real downstream obligations.** `apply-reorganization-act` "registers downstream obligations"; `reorganization-act` names segment restatement, employee consultation, directory reprovisioning and contract novation. Unscoped, a what-if emits all four. *Fix:* Hypothetical acts are branch-local: no authoritative lineage edge, no obligation emission, no external signal. Approval materialises both. *Fixture (`hypothetical-act-no-obligations`):* hypothetical act → zero obligations and zero authoritative lineage; on approval, both appear with the act's own record time.  **D23 — Version identity collides across branches.** `structureVersionId` (`1`, required), `contentDigest` and `asOfParameters` omit scenario, so two consumers can "prove they are looking at the same state" while on different branches. *Fix:* Scenario enters `asOfParameters` and the digest preimage, with a declared canonicalisation. *Fixture (`version-branch-distinct`):* identical world-time and record-time instants on two branches yield distinct version ids and distinct digests.  **D24 — The acceptance scenario is only half tested.** The dossier's acceptance case is as-is/to-be restructuring; `as-is-to-be` tests approved-future only. Claude states the case passes under the approved-future reading and fails under the hypothetical reading; the candidate does not record that split. *Fix:* Two acceptance paths, both mandatory. *Fixture:* keep `as-is-to-be` for approved-future; add `as-is-to-be-branch` — hypothetical to-be validates on its branch, the authoritative read at `t < t₁` returns as-is unchanged, and prior mandates, placements and staffing remain retrievable as closed intervals.  **D25 — Backdating is unresolved.** `reorganization-act` asks "may an act be recorded with an effective date in the past, and what compensating controls apply" — unanswered in every artifact. This is the cleanest history-rewrite vector left open. *Fix:* Retroactive effective dates require a named compensating approval and preserve record time; otherwise refused. *Fixture (`backdate-unapproved`, negative)* → refused; *(`backdate-approved`, positive)* → accepted, and earlier as-of reads remain reproducible at their original record time.  **D26 — `reconcile-external-directory` pushes outward.** "Push corrections outward" with no scenario guard exports a branch to LDAP/SCIM, where the loss manifest cannot mark it hypothetical. *Fix:* Push is permitted only from the authoritative branch. *Fixture (`directory-push-branch`, negative):* push from a non-authoritative branch refused.  ### E. Team / unit collapse  **D27 — `Body mode` is optional, so the default is "unit".** `collaboration-vs-unit-typing-data03` is `0..1`, `required: false` — the field the adjudication accepted specifically to keep cross-organization bodies out of the unit set can simply be omitted. *Fix:* Required, single-valued, governed enum `{unit, committee-as-unit, collaboration}`; absent value refuses the write. *Fixture (`body-mode-required`, negative):* body created without mode refused.  **D28 — "team" sits in the unit-kind code list.** `unit-kind-classification` enumerates "team" among department, division, directorate, branch, committee, board — the type-code leak Grok flags and the candidate's constraint 11 does not close. *Fix:* Remove "team" from the unit-kind list, or bind it: `unitKind = team` requires `bodyMode = collaboration` and forbids tree-axis placement. *Fixture (`team-kind-placement`, negative):* `unitKind = team` plus a managerial placement refused.  **D29 — Duplicate classification slots.** `de-unit-kind` (`1..n`, required) and `de-classification-scheme` (`1..n`, required) coexist with the imported `collaboration-vs-unit-typing-data01` "Unit kind code" (`0..1`) and `data02` "Kind scheme" (`0..1`). The accepted import created a second, weaker classification write path. Neither provider records this. *Fix:* One required pair. Delete the imported duplicates or declare them read-only aliases. *Fixture (`kind-dual-write`, negative):* conflicting kind values across the two slots refused; single-slot write accepted.  **D30 — The candidate's team boundary rests on an identifier absent from the frozen material.** `WM-ORG-003` appears in `teamBoundary`, in constraint 11, and in fixture `team-as-unit` ("keep WM-ORG-003 affiliations"). It is nowhere in the dossier, registry, ledger, spec or evidence limits. Grok also introduces `EM-ORG-05`, `WM-ORG-005` and `EM-LND-01`; the comparison note passes all of them through as "refinements" without flagging them. The dossier's `related_research_contours` are EM-ORG-01, EM-ORG-06, EM-PEO-02. *Fix:* Express the boundary with in-spec constructs only — `bodyMode`, `unitAffiliation`, `affiliationInstrumentRef`, `isAlsoFormalOrganization`. Leave the external team model unnamed until a registry record is supplied. Strike `WM-ORG-003`, `WM-ORG-005`, `EM-ORG-05`, `EM-LND-01` from candidate and fixtures. *Fixture:* restate `team-as-unit` as "refused; contributing-unit relations retained as `unitAffiliation` edges", citing no external model id.  **D31 — Org-chart behaviour for unplaced bodies undefined.** `derive-org-chart` renders a hierarchy for a named axis; a collaboration holds no tree placement, which is exactly the pressure that produces the negative case. *Fix:* The projection omits unplaced bodies and declares that omission in `lossManifest`; it never synthesises a parent. *Fixture (`chart-unplaced`):* collaboration absent from the chart and present in the loss manifest.  **D32 — Rollup double-counting unguarded.** `compute-headcount-rollup` has no rule against attributing staffing to a collaboration whose members are established in other units — the second half of the negative case. *Fix:* Establishment and staffing attach only to `bodyMode = unit`; rollup runs on tree axes only. *Fixture (`rollup-team-doublecount`, negative):* cross-department team's members counted once in their home units; rollup on a dag axis refused or returned as explicitly non-additive.  ### F. Mandate–placement coupling  **D33 — The base cardinality contradicts the candidate's own mandate contract.** `remitStatement` `0..1`, `mandateValidity` `0..1`, `mandateScope` `0..1` are singletons on the unit record, while `assign-unit-mandate` attaches and withdraws "for a validity interval" and candidate constraint 4 calls mandate a temporal assignment. As written, a second mandate overwrites the first — mandate history rewrite by cardinality. Neither provider records this. *Fix:* Reify `UnitMandate` at `0..n` with key (unit, delegatingInstrument, validInterval, scenario); the unit-level singletons become derived current-mandate views. *Fixture (`mandate-succession`):* two successive mandates each retrievable at their own as-of; the second assignment does not close or alter the first's recorded content.  **D34 — The candidate defines no mandate key.** `placementContract` has a key; there is no `mandateContract`, yet `mandate-change` expects "new mandate version" with no version or key semantics defined. *Fix:* Add `mandateContract` with the D33 key plus provenance (record time, act/instrument ref, evidence). *Fixture (`mandate-key`, negative):* mandate write lacking delegating instrument or validity interval refused.  **D35 — No rule against inherited remit.** Grok's "fail if remit is stored only as the parent's purpose" reaches neither the candidate constraints nor the fixtures. *Fix:* Mandate exists only as an explicit assignment; no inheritance and no derivation from a parent's `purposeCode`. *Fixture (`mandate-no-inheritance`):* a unit with no mandate returns empty, never the parent's purpose. Keep `mandate-reparent` for the converse.  **D36 — `evaluate-mandate-conflict` is unscoped, and its normative basis is held.** It runs "before or after a proposed structural change" — i.e. across scenarios — and the delegation and segregation findings it depends on rest on paywalled ISO 37000 text reviewed only through committee decks. *Fix:* Scenario-scope the evaluation; label the delegation, assurance and segregation material guidance-grade until clause text is verified. *Fixture (`conflict-scope`):* branch evaluation reads only branch mandates and vice versa. (`iso-claim`, gate): publication fails if any delegation or SoD element is marked normatively sourced.  **D37 — Independent reporting lines could be written as second placements.** `requiresIndependentLine` demands a line bypassing the operational parent, which collides with tree-axis single-parent unless typed as a relation. *Fix:* Independence is a `reportingLine`, never a second placement. *Fixture (`independence-as-placement`, negative)* refused; *(`independence-as-line`, positive)* accepted.  ### G. Employer inference  **D38 — Only the administrative path is tested.** `management-employer` covers the administrative parent; the legal-entity roll-up axis and `isAlsoFormalOrganization` are untested, and the legal axis is the likelier inference route. *Fix:* Employer and legal subject derive only from the out-of-scope employment model bound to a WM-ORG-001 instance; no axis — legal roll-up included — and no dual-classification flag implies employer. *Fixture (`employer-from-legal-axis`, negative)* refused; *(`employer-from-dual-flag`, negative)* a branch with `isAlsoFormalOrganization = true` does not become employer by flag alone.  **D39 — Grok's employer master is an invented identifier.** "Employer is a `WM-ORG-005` fact bound to a 001 legal subject" has no basis in the frozen material. The candidate correctly says "employment remains externally mastered"; the comparison note nonetheless endorses the Grok framing wholesale. *Fix:* Strike `WM-ORG-005`; retain the spec's unnamed "Employment / role assignment model" composition target. Correct the comparison note so it flags rather than launders the invented ids. *Fixture:* none — provenance correction.  **D40 — The projection re-import prohibition is untested.** `projection-fidelity` forbids re-import as authoritative; no fixture enforces it, and a lossy directory re-import overwrites employer-adjacent and structural facts alike. *Fixture (`projection-reimport`, negative):* re-import of an LDAP/SCIM or org-chart projection as a source of truth refused, loss manifest cited.  ### H. History rewrite  **D41 — No negative fixture for amending a closed interval.** Candidate constraint 13 is append-only; nothing tests it. *Fixture (`closed-interval-amend`, negative):* update to a closed interval refused; a correction appends a superseding assertion with a new record time and preserves the original.  **D42 — Retention versus reconstruction floor unresolved.** `as-of-reconstruction` asks "what happens to reconstruction after retention-driven deletion"; `apply-disposition` destroys records while claiming to preserve tombstones and lineage. No artifact states a floor. *Fix:* Declare a reconstruction floor; disposition never removes intervals, tombstones or lineage inside it; beyond it, reads return an explicit partial-reconstruction result. *Fixture (`asof-below-floor`):* returns an explicit partial marker, never a silently truncated graph.  **D43 — Status-transition legality unresolved.** `unit-existence-status` asks which transitions require an act rather than a correction; withdrawal-as-error is distinguished in prose only. *Fix:* Publish the transition table; withdrawal-as-error never closes real-world intervals as disbandment. *Fixture (`withdraw-operating`, negative):* withdraw-as-error on a unit with active placements refused. (`disband-requires-act`, negative): disband without act and lineage refused.  **D44 — Disband/tombstone dereference untested.** `unit-lineage` asks what a consumer receives when dereferencing a disbanded unit — tombstone, redirect or error. Fixtures cover merge and split only. *Fix:* Fix one answer (tombstone with successor pointer, per `resolve-unit-identity`). *Fixture (`tombstone-deref`):* returns a tombstone plus successor pointer, never a 404 and never the successor silently.  ### I. Unsupported release claims  **D45 — The base says "published" while it is not publishable.** `publication.status: "published"` against `adjudicationStatus: reviewable-draft` and `publishableCanonical: false`; the dossier itself warns that "published не означает завершённую независимую экспертизу". *Fix:* Demote or qualify the status word wherever surfaced; the profile inherits no "published" language. *Fixture (`status-word`, gate):* fails if any surfaced status reads "published" while `publishableCanonical` is false.  **D46 — Fixture digests over an undeclared preimage.** Twenty cases carry `sha256` while `fixturesExecuted: false`, no carrier exists, no canonicalisation is declared, and `fixtureDigestRequired` refers to result digests — so the present values look like evidence of nothing identifiable. *Fix:* Declare exactly what is hashed (the case definition) and the canonicalisation, or remove the digests until a runner exists. Keep case digests and result digests as separate fields. *Fixture (`digest-preimage`, gate):* fails if any case digest lacks a declared preimage and canonicalisation.  **D47 — The source inventory does not reconcile.** `statistics.sources: 23`; the holds speak of "all sixteen base sources" plus two imported anchors; the highest referenced id is SRC-019. No crosswalk or alignment claim can stand on an inventory that disagrees with itself three ways. *Fix:* Publish a source register — id, tier, retrieval state, live-version pin — and reconcile the count; pin FHIR explicitly (base cites R5, secondary cites R4). *Fixture (`source-register`, gate):* fails while the count, the referenced ids and the register diverge, or while FHIR is unpinned.  **D48 — Three composition targets are `required: true` with no identifier.** Stewardship (S1) MIX-IN, Access grant (S2) REFERENCE and Audit trail (S4) MIX-IN are all required, all unidentified and all unpinned — and `out_of_scope` simultaneously excludes "Stewardship policy machinery and access-grant issuance (S1/S2 service models)". A profile cannot be releasable on required dependencies that have no registry record. *Fix:* Supply model ids and pins, or demote to `required: false` with the dependency stated as a precondition rather than a composition. *Fixture (`required-dep-pins`, gate):* fails on any `required: true` target lacking an id and digest.  **D49 — The audit projection is 20 of 28 findings, and the candidate constrains an unreviewed area.** The establishment-and-staffing bundle's findings are absent from the projection, yet candidate constraint 2 and fixture `split-lineage` govern establishment apportionment; `split-lineage` in fact mentions only mandates, while Grok's prose claims mandate *and* establishment. *Fix:* Either narrow the profile to reviewed findings or extend the projection before publication; mark establishment constraints unreviewed until then. *Fixture:* amend `split-lineage` to assert apportionment of mandate **and** establishment **and** staffing explicitly, or drop the establishment claim from the constraint set.  **D50 — Provenance and metadata claims unsupported.** (a) `queue_reservation` reads `status: queued`, `claude_status: not-started`, `grok_status: not-started`, `boundary_decision: pending`, `remaining_scope: "Entire research brief pending"` — while two provider studies, a reconciled candidate at revision 2 and a registry `provenance` string claiming "Grok review + Claude adversarial audit" all exist. (b) `priority_wave: 0` against contour `wave: W1`. (c) `priority_rationale: "AI foundation: high reuse across agents and domains"` with `factor_robotics: 0.00`, `priority_confidence: low` and `priority_score: 88` — cohort boilerplate, not a rationale for this model. (d) `owner_or_maintainer: "parent organization"` names the modelled subject as maintainer of the model record, conflating instance record authority with model stewardship and contradicting the dossier's `suggested_owner`. (e) `standardExtensionNote` is `0..1` optional while the adjudication decision requires `assert-reporting-line` to write the declaration — a silent conformance over-claim. (f) `deferredResearch` defers the unit-to-site decision while `composition` already carries a Site/Location REFERENCE entry. (g) CPOV ranges `unitOf` at Public Organisation and holds that a unit cannot exist on its own, narrower than the base's units-of-units, so `emit-standards-mapping` can emit invalid CPOV. *Fix:* (a) Reconcile the queue record and the provenance string, or treat the provider studies as unprovenanced. (b) Reconcile wave. (c) Restate the rationale for this model or mark the score cohort-proxy and non-normative. (d) Name a model steward distinct from `recordOwnerRole`. (e) Make the extension note required whenever a unit-to-unit reporting line is asserted. (f) Either withdraw the Site composition entry or close the deferral. (g) Add a CPOV range rule to the crosswalk. *Fixtures:* (`queue-provenance`, gate) fails on queue/artifact status mismatch; (`reporting-extension-note`, negative) unit-to-unit reporting line without the declaration refused; (`cpov-unit-of-unit`) export of a unit-of-unit to CPOV yields a declared fidelity failure, never silent output; (`site-deferral`, gate) fails while a deferred boundary is asserted in composition.  ---  ## 4. Contradictions among dossier, providers, candidate and fixtures  | # | Contradiction | Resolution on frozen evidence | |---|---|---| | 1 | Spec `publication.status: published` vs `reviewable-draft` / `publishableCanonical: false` | Draft governs; "published" is wrong (D45) | | 2 | Registry `described-previous-version` vs `previousVersions: []` | Unresolvable from the material; must be reconciled (D06) | | 3 | Registry `source_version_or_year` 2026-08-22 vs `generatedAt` 2026-08-23 | Pin-integrity defect, not a note (D06) | | 4 | Registry/ledger `CONTAINS` vs spec `REFERENCE` for WM-ORG-001; `parent_ids` empty | Digest-pinned spec governs (D12) | | 5 | Registry `contains_ids` / ledger `CONTAINS` / spec `CHILD` / note "CONTAINS by reference" for WM-ORG-004 | Spec `CHILD`, reference-not-copy (D13) | | 6 | Queue reservation `not-started` / `pending` vs two studies, candidate rev 2, registry provenance citing a prior Claude audit | Queue record is stale; provenance unverified (D50a) | | 7 | Registry `priority_wave: 0` vs contour `wave: W1` | Contour governs research sequencing (D50b) | | 8 | `statistics.sources: 23` vs "sixteen base sources" + two anchors vs max SRC-019 | Inventory unverifiable; blocks alignment claims (D47) | | 9 | Claude: hypothetical scenario **unsupported** vs Grok: hypotheticals are "first-class 002 facts" | Claude correct — no scenario element exists in the base (D20) | | 10 | Grok: the org chart "remains the EM-LND-01 projection" vs spec's own `derive-org-chart` function; EM-LND-01 absent from the dossier | Spec governs; EM-LND-01 struck (D30) | | 11 | `WM-ORG-003`, `WM-ORG-005`, `EM-ORG-05`, `EM-LND-01` in Grok and (partly) the candidate vs the frozen material | All invented; use in-spec constructs (D30, D39) | | 12 | Grok: "one parent organization for its lifetime" vs Grok's own "transfer between 001 organizations"; spec poses immutability as an open question | Open; must be decided (D03) | | 13 | Candidate axes (`administrative`, `project`, `reporting`) vs base hierarchies and `reportingLine` as a separate relation | Base enum governs; `project` unsupported (D15) | | 14 | Candidate "UnitMandate is a temporal assignment" vs base `0..1` singletons | Base cardinality blocks the contract (D33) | | 15 | Candidate constraint 6 internal disjunction ("removed **or** derived") | Not a frozen rule; choose removal (D09) | | 16 | Fixture `sha256` present vs `fixturesExecuted: false` and `fixtureDigestRequired` (results) | Preimage undeclared (D46) | | 17 | Fixture `merge-lineage` disjunctive expectation vs constraint requiring an explicit continuity decision | Split into deterministic cases (D02) | | 18 | Adjudication requires `assert-reporting-line` to write the extension declaration vs `standardExtensionNote` `0..1` | Make required (D50e) | | 19 | Adjudication accepted collaboration typing vs its data elements being optional and duplicative of `de-unit-kind` | Required + de-duplicated (D27, D29) | | 20 | Adjudication reclassifies measurement to extension-grade vs `in_scope` listing dated headcount/FTE as in scope | Extension-grade governs; scope text must say so (D49) | | 21 | `deferredResearch` defers unit-to-site vs `composition` already carrying a Site/Location REFERENCE | Deferral and assertion cannot both stand (D50f) | | 22 | `out_of_scope` excludes S1/S2 machinery vs `composition` marking S1/S2/S4 `required: true`, unidentified | Required-with-no-id is not releasable (D48) | | 23 | Both providers verdict "PROFILE"; the task asked for ACCEPT/REVISE | Neither study answered the verdict question; this audit supplies it | | 24 | Comparison note: Grok's refinements "preserve the PROFILE decision" | True of the decision, false of the artifacts — it passes four invented identifiers through unflagged (D39) |  ---  ## 5. Closed remediation checklist  Thirty items. Complete all thirty; no item is optional, and nothing outside this list is required by this audit.  1. Restate every candidate constraint in normative modal form and attach an explicit delta list against `9e3e80da…` naming scenario, axis mode and the reified mandate key as additions. (D20) 2. Strike `WM-ORG-003`, `WM-ORG-005`, `EM-ORG-05`, `EM-LND-01` from candidate, fixtures and comparison note; re-express the team boundary with `bodyMode`, `unitAffiliation`, `affiliationInstrumentRef`, `isAlsoFormalOrganization`; correct the comparison note to flag the invented ids. (D30, D39) 3. Declare `profileTypes` profile-local labels with no registry, nav or runtime identifier. (§2) 4. Remove `de-parent-unit-ref` from the authored schema, or make it read-only derived under one named default with writes refused. (D09) 5. Repoint `hierarchyPath` to derive solely from placements under (axis, scenario, as-of). (D10) 6. Make unit-level `hierarchyIdentifier` derived or non-authoritative; hold the axis register at organization level. (D11) 7. Adopt one relation vocabulary and correct registry and ledger to the spec on both neighbour edges. (D12, D13) 8. Add `axisMode ∈ {tree, dag}` with per-axis parent cardinality. (D14) 9. Bind the axis enum to the base hierarchies; drop `project`; keep `reportingLine` out of the axis set. (D15) 10. Constrain `isCodmReportingHierarchy` to at most one per organization per period. (D16) 11. Decide and state the gap policy for successive parent assignments. (D17) 12. Add the root and orphan rules per (organization, axis, scenario, interval). (D18) 13. Add scenario to the placement key rules in `validate-structure-graph`. (D19) 14. Add a required scenario parameter to all twelve listed functions. (D21) 15. Make hypothetical acts branch-local — no lineage, no downstream obligations, no external signal. (D22) 16. Add scenario to `asOfParameters` and to the digest preimage with a declared canonicalisation. (D23) 17. Reify `UnitMandate` at `0..n` on key (unit, instrument, interval, scenario); demote the unit-level singletons to derived views. (D33) 18. Add `mandateContract` to the candidate with that key plus provenance. (D34) 19. Add the no-inheritance rule for remit. (D35) 20. Scenario-scope `evaluate-mandate-conflict`; label delegation, assurance and SoD guidance-grade pending ISO clause verification. (D36) 21. State that independent reporting lines are relations, never second placements. (D37) 22. Make `bodyMode` required with a governed enum; remove or bind "team" in the unit-kind list; merge the duplicate classification slots. (D27, D28, D29) 23. Define org-chart handling of unplaced bodies and rollup attribution limited to `bodyMode = unit` on tree axes. (D31, D32) 24. State employer non-inference across all axes including the legal roll-up and the dual-classification flag. (D38) 25. State identifier non-reassignment, the required `continuityDecision`, the cross-organization transfer rule, the resolution ambiguity contract, interval-keyed status, the transition table and tombstone dereference. (D01–D04, D07, D43, D44) 26. Declare the reconstruction floor and disposition's non-removal guarantee inside it. (D42) 27. Reconcile the base pins: version lineage, registry dates, legacy O2 path, and extend `invalidationRule` to registry fields. (D05, D06) 28. Publish the source register, reconcile the count, pin FHIR, and add the CPOV `unitOf` range rule to the crosswalk. (D47, D50g) 29. Fix the release-claim surface: demote "published"; declare fixture digest preimage and canonicalisation; supply ids and pins for S1/S2/S4 or demote them to `required: false`; reconcile the queue record, provenance string, wave, priority rationale and maintainer field; make `standardExtensionNote` required; resolve the site deferral against the composition entry; mark establishment constraints unreviewed or extend the projection. (D45, D46, D48, D49, D50a–f) 30. Extend the fixture set with every case named above — `id-no-reuse`, `merge-retain`, `merge-mint`, `merge-no-decision`, `transfer-owner`, `transfer-no-lineage`, `resolve-ambiguous`, `resolve-stale-dn`, `status-history`, `reclassify`, `parent-read-derived`, `path-derivation`, `axis-membership-drift`, `axis-mode-tree`, `axis-mode-dag`, `axis-enum`, `reporting-as-placement`, `codm-unique`, `placement-gap-active`, `placement-gap-dormant`, `second-root`, `orphan-active`, `orphan-dormant`, `scenario-joint-eval`, `scenario-per-branch`, `scenario-required`, `scenario-fn-matrix`, `hypothetical-act-no-obligations`, `version-branch-distinct`, `as-is-to-be-branch`, `backdate-unapproved`, `backdate-approved`, `directory-push-branch`, `body-mode-required`, `team-kind-placement`, `kind-dual-write`, `chart-unplaced`, `rollup-team-doublecount`, `mandate-succession`, `mandate-key`, `mandate-no-inheritance`, `conflict-scope`, `independence-as-placement`, `independence-as-line`, `employer-from-legal-axis`, `employer-from-dual-flag`, `projection-reimport`, `closed-interval-amend`, `asof-below-floor`, `withdraw-operating`, `disband-requires-act`, `tombstone-deref`, `cpov-unit-of-unit`, `reporting-extension-note` — plus the gates `pin-set`, `pin-consistency`, `relation-plane`, `status-word`, `digest-preimage`, `source-register`, `required-dep-pins`, `queue-provenance`, `site-deferral`, `iso-claim`; amend `merge-lineage`, `split-lineage`, `graph-multiple`, `parent-dual-write` and `team-as-unit` as specified; keep `publishableCanonical: false` and `fixturesExecuted: false` until a carrier, validator and runner produce digest-verified results.  **Publication stance:** refused. `WM-ORG-002` is a non-canonical reviewable draft, seven base holds are open, the scenario and placement deltas are unapplied, the mandate cardinality contradiction is unresolved, invented identifiers are present in the candidate, and no fixture has executed. Nothing in this audit constitutes a W3C ORG, CPOV, FHIR, ISO or IFRS conformance claim, a canonical status, an approved relation, or an installability claim.