Alias / Same-as Mapping

Assertion identifier, version and weak host-dependent identity

The assertion is denoted by an identifier minted in a namespace disjoint from both endpoint namespaces, so it can never be mistaken for, nor substituted by, either endpoint identifier. Because this is a mixin, identity is weak and host-dependent: the addressable key is the host reference plus an assertion-local identifier, and the envelope has its own version series independent of any endpoint version. A change to any claim-bearing field is made by issuing a successor envelope that links to the one it supersedes, never by editing in place, so that consumers holding a cached copy can detect divergence.

1. Which identifier denotes this alias assertion itself, and which authority assigned it? identity
2. How is the assertion identifier kept structurally distinguishable from the identifiers cited at its endpoints? constraint
3. On which host record does this mixin instance depend, and what becomes of the assertion when the host is withdrawn? composition
4. How is a new version of the assertion issued, and how does it cite the version it supersedes? lifecycle
5. Which combination of recorded fields forms the structural key by which two envelopes would count as the same claim? validation

Issuer, authorship and the separated times of an assertion

An alias assertion is a speech act by a named agent, and issuing one confers no authority over either endpoint. The envelope records who asserted it, who authored and who reviewed or endorsed it as distinct roles, and keeps at least three time axes apart: when the issuer asserted it, the window over which it is declared effective, and when this Dimension observed or ingested it. Conflating these makes a stale ingest indistinguishable from a fresh claim and makes retraction unverifiable.

1. Who issued this assertion, and under what authority do they speak about both endpoints at once? authority
2. When was the assertion made, and over which window is it declared effective? temporal
3. How is the time this Dimension observed or ingested the assertion recorded separately from the time it was asserted? provenance
4. Which agents reviewed or endorsed the assertion, and is endorsement distinguished from authorship? ownership

Purpose, tenant, jurisdiction and applicable entity/type scope

An equivalence asserted for one purpose is not automatically valid for another. The envelope carries an explicit purpose statement, the owning tenant or adopting Dimension, the jurisdictions whose rules govern its use, the licence under which it may be redistributed, and value-set or type bounds on each side that say which classes of things the claim ranges over. This is a direct response to the standardised mapping formats that carry no context, and it means a consumer can reject an assertion as out of scope without disputing its truth.

1. For which declared purpose is this equivalence asserted, and which purposes are excluded from it? requirement
2. Which tenant or adopting Dimension owns this assertion instance, and may it be shared beyond that tenant? ownership
3. Which jurisdictions or regulatory contexts govern the use of this assertion? spatial
4. Which entity types or value sets bound the source side and the target side of the assertion? classification
5. Under which licence or usage terms may this assertion and its set be redistributed? access

Provenance locators and derivation lineage of the assertion

Provenance is recorded as locators, never as imported content. The envelope cites the set or link set it belongs to, the primary source document or dataset it came from, the prior assertion or upstream mapping set it was derived from, the activity or tool that produced it, and any issue reference where it is discussed. Set-level metadata is held once on the set descriptor and inherited by members rather than copied onto each envelope, and none of these locators is dereferenced by this model.

1. Which document, dataset or link set is the citable origin of this assertion? provenance
2. From which prior assertion or upstream mapping set was this one derived, and by which activity? process
3. How are provenance targets recorded as resolvable locators without copying the referenced records into this model? interoperability
4. Which set does this assertion belong to, and which set-level metadata does it inherit rather than restate? composition

Source and target roles, directionality and endpoint non-ownership

One reference occupies the source role and the other the target, in a canonical written order that survives serialization even when the recorded predicate is symmetric, because directionality is what makes one-to-many distinguishable from many-to-one and what lets a set declare which register supplies subjects and which supplies objects. The assertion cites the authority for each endpoint rather than assuming it, and states explicitly what it does not claim: no precedence, no preferred name, no ownership, no merge. Following the strongest available guidance, a pair is not treated as equivalent on the strength of a single unreciprocated claim.

1. Which reference occupies the source role and which the target, and does the recorded predicate make that order significant? relationship
2. What does this assertion explicitly not claim about ownership, naming or precedence of either endpoint? ownership
3. Is a reciprocal assertion from the target side required before the pair may be acted on as equivalent? validation
4. Which system is authoritative for each endpoint, and how is that authority cited rather than assumed? authority

Locator form, namespace binding and comparison discipline

Each endpoint locator is recorded in a declared form: an absolute IRI, a compact prefixed form expandable through a published binding map, or a local code paired with an explicit scheme. Comparison is not a free choice: RDF-facing use requires exact code-point comparison of absolute IRIs with no normalization beforehand, while URI and IRI guidance defines a graduated ladder whose whole design principle is to minimise false negatives while strictly avoiding false positives. The envelope therefore records which normalization level was applied, keeps character data in Normalization Form C, states how percent-encoding and fragment components were handled, and flags locators declared opaque so that no meaning is parsed out of their internal structure.

1. In what form is each endpoint locator recorded: absolute IRI, compact prefixed form, or local code plus scheme? definition
2. Which prefix or namespace binding expands a compact endpoint locator, and where is that binding published? interoperability
3. Which normalization level was applied before two locators were treated as the same string? validation
4. How are percent-encoding, Unicode normalization and fragment components handled when locators are compared? constraint
5. Which locators are declared opaque, so that no meaning may be parsed from their internal structure? quality

Version pins, composite keys, snapshots and endpoint resolution status

An endpoint reference is either pinned to a stated version of its source register or left to float to whatever is current, and the difference must be explicit because a floating reference can silently change the claim. Where an endpoint is identified by more than one field, the composite key is recorded as structured parts, not concatenated into an unparseable string. The envelope distinguishes an immutable snapshot capture, which fixes what was seen, from a live reference, which does not, and it records the last observed resolution status with the time of that observation, treating resolution as an observation made elsewhere rather than an act performed here.

1. Is each endpoint pinned to a stated version of its source register, or left to float to the current version? temporal
2. When an endpoint is identified by more than one field, how is the composite key recorded so it remains comparable? composition
3. Does the assertion cite an immutable snapshot of the endpoint or a live reference that may change beneath it? state
4. What was the last recorded resolution status of each endpoint, and when was that status observed? evidence
5. How is a retired or tombstoned endpoint distinguished from one that never existed? exception

Cardinality, ordered membership and conditional applicability

Cardinality is declared, not inferred. A bare two-column mapping cannot distinguish a genuine one-to-many claim from several independent one-to-one claims, so the envelope carries an explicit cardinality declaration covering one-to-one, one-to-many, many-to-one and many-to-many, together with a combination rule stating whether a multi-member side is a union, a set of alternatives or a ranked preference order, and an explicit rank where order matters. Conditional mappings are expressed as attribute-value guards naming externally defined attributes, with any attributes produced by applying the mapping recorded separately. This model declares the guards; evaluating them at runtime is done elsewhere.

1. What cardinality does this assertion declare, and is that declaration explicit or merely implied by repeated entries? classification
2. When several targets are asserted for one source, is the member set a union, a list of alternatives or a ranked preference? composition
3. Which conditions must hold for the assertion to apply, and how are they expressed as attribute-value guards? constraint
4. How is a member's rank within a multi-member side recorded so that it survives serialization? interoperability
5. Which combination of source and target members forms the smallest independently assertable unit? decision

Absence, explicit unknown, explicit not-same, dangling endpoints, self links, duplicates and conflicts

Three states must be kept apart and none may be inferred from silence: no assertion exists, an endpoint is explicitly recorded as unknown, and equivalence is explicitly denied. Explicit denial is a positive claim with its own justification and issuer, expressible either through an inequality predicate or a negation modifier on the predicate slot, and it must never degrade into an absent or weak claim. Alongside these, the envelope represents dangling and unresolved endpoints, malformed or unresolvable relative references, self links where both sides normalize to the same locator, structurally identical duplicate envelopes, and conflicts where two assertions about the same pair pin different endpoint versions or make opposing claims. Conflicts are recorded and linked here; adjudicating, remediating, retracting or enforcing them is done elsewhere.

1. How does the record distinguish a missing endpoint from an endpoint explicitly recorded as unknown? validation
2. How is an explicit denial of equivalence recorded so that it cannot be read as a weak or absent claim? definition
3. What is recorded when an endpoint locator is malformed or is a relative reference that cannot be resolved to an absolute form? exception
4. How is a self link, where both sides normalize to the same locator, detected and flagged? quality
5. When two assertions about the same pair pin different endpoint versions or make opposing claims, how is the conflict recorded without being resolved here? relationship

Governed register of mutually exclusive relation kinds

WM-XCT-036 recognises nine relation kinds, each with a normative definition and a discriminating test that separates it from its nearest neighbour: identifier-alias, where two identifiers designate the same subject within a declared identifier system; historical-identifier, a former identifier superseded by a current one for the same subject; referent-replacement, where the source resource or record is supplanted by a replacement that may be a different subject after a merge; exact-semantic-match, where terms are interchangeable across a wide range of retrieval applications; close-match, where terms are interchangeable in some applications only; equivalent-in-context, where equivalence is asserted only inside a declared context and is void outside it; probable-entity-match, an evidence-weighted, non-asserted hypothesis that two records denote one entity; not-same-assertion, an explicit negative claim; and strict-identity, a formal claim that both endpoints denote one and the same individual. Exactly one kind is assigned per assertion. Register status, effective interval and successor are held per kind so that retirement of a kind is itself governed.

1. Which relation kind in the register exactly matches the claim being made, and what is that kind's normative definition? definition
2. What discriminating test separates the selected relation kind from the adjacent kind that would otherwise be chosen? classification
3. Which role is authorised to add, amend or retire a relation kind in the register, and under which decision record? authority
4. Is exactly one relation kind carried on this assertion, and how is a multi-kind or blended claim rejected? constraint
5. What is the register status of the relation kind, and if it is deprecated which successor kind replaces it? lifecycle

Versioned alignment bindings to external vocabularies

Each relation kind carries zero or more bindings to external terms, declared as alignments with an explicit comparability verdict (narrower, broader, equivalent-as-used or incomparable) and the dated edition the binding was read from. Representative bindings: strict-identity to owl:sameAs and SameIndividual; not-same-assertion to owl:differentFrom, DifferentIndividuals and the SSSOM predicate modifier that negates a predicate; exact-semantic-match to skos:exactMatch; close-match to skos:closeMatch; referent-replacement to dcterms:isReplacedBy, to HTTP 301 and 308 responses and to FHIR Patient.link replaced-by; identifier-alias to database secondary keys and to the registered alternate relation; representation preference to rel=canonical and the registered duplicate relation; probable-entity-match to Wikidata P460 with SSSOM confidence and justification. Bindings never assert conformance and never import the target's operational behaviour.

1. Which external vocabulary term is this relation kind bound to, and is the binding recorded as an alignment rather than a conformance claim? interoperability
2. Is the external term narrower than, broader than, equivalent-as-used to, or incomparable with the local relation kind? relationship
3. Which dated edition or release of the external vocabulary was the binding taken from, and when was it last reconfirmed? provenance
4. What documented statement in the external specification supports the asserted binding strength? evidence

Per-kind directionality, symmetry, reflexivity, transitivity and invertibility

Every relation kind carries a property profile with four-valued property states (asserted, denied, not-asserted-by-source, not-applicable) so that silence in a source vocabulary is never recorded as a negative. Grounded profile examples: strict-identity is non-directional, symmetric, reflexive and transitive because the axiom is satisfied only when the named individuals map to the identical domain element; exact-semantic-match is symmetric and transitive under SKOS S44 and S45, with reflexivity not asserted by the source; close-match is symmetric under S44 but transitivity is deliberately withheld to prevent compound error, so it is recorded as denied rather than unstated; not-same-assertion is symmetric and irreflexive and is not transitive; referent-replacement and historical-identifier are directional and invertible through a declared inverse and are asserted as single hops, never as a chain closure; probable-entity-match is symmetric, consistent with the deployed symmetric said-to-be-the-same-as property, and its transitivity is denied.

1. Is symmetry or reflexivity asserted for this relation kind by its source vocabulary, denied, or simply left unstated? constraint
2. Is transitivity asserted, explicitly withheld, or unstated, and does the kind have a named inverse relation? relationship
3. For a directional kind, which endpoint is the subject and which is the object, and what does reversing them change? identity
4. Is inference permitted from this relation kind, and which externally owned entailment regime would perform it? decision

Ordinal semantic strength and inference permission

Each relation kind carries an ordinal strength rank on a single declared scale, from a non-asserted hypothesis (probable-entity-match), through scoped or retrieval-level interchangeability (close-match, equivalent-in-context, exact-semantic-match), through system-scoped designation (identifier-alias, historical-identifier, referent-replacement), to a maximal formal identity claim (strict-identity), with explicit negation (not-same-assertion) held on its own high-strength negative rank. Strength is a declared attribute of the kind, not a computed similarity score; a confidence value in the interval 0 to 1 may accompany an assertion but never upgrades its rank. The inference-permission flag states whether substitution or entailment is allowed at all, and any permitted inference is executed by an externally owned regime. Published analysis that identity behaves as a scale rather than a binary supports the ordinal treatment, while OWL semantics fix the maximal rank.

1. What ordinal semantic-strength rank does this relation kind carry on the declared scale, and what is the scale's top rank? measurement
2. Which downstream operations are prohibited at this strength rank without a higher-ranked assertion? constraint
3. Under what recorded exception may a lower-strength assertion be consumed as if it were stronger, and who authorises that exception? exception
4. Does a confidence value accompany this assertion, and is it prevented from altering the declared strength rank? decision

Six discriminated equivalence planes

Every assertion declares exactly one plane. Identifier equivalence: two identifier tokens designate the same subject within a declared identifier system, which web architecture treats as a URI alias with acknowledged costs. Record equivalence: two records or descriptions concern the same subject, as with a record-level link between patient resources that concern the same actual individual. Real-world entity identity: the endpoints denote one and the same individual in a domain of discourse. Name or label alias: a lexical variant of a label, which is a property of one subject and never an equivalence between two subjects. Representation equivalence: two representations or serialisations of one resource, covered by registered relations such as alternate, duplicate and canonical, which RDF and web architecture keep separate from the resource denoted. Referent replacement: the referent, record or resource is supplanted or superseded rather than equated. Cross-plane assertions are rejected by default; a plane change requires a new assertion.

1. On which of the six equivalence planes does this assertion operate? classification
2. What does each side of the assertion actually denote: an identifier token, a record, a resource, a label literal or a real-world entity? identity
3. Are the two endpoints on the same plane, and what is the rejection rule when they are not? constraint
4. How is a name or label alias kept distinct from an equivalence between two distinct subjects? definition

Admissible endpoint types and contextual scope of an assertion

Each relation kind declares which endpoint types it admits and the scope inside which the assertion holds. SKOS mapping properties are conventionally used between concepts in different concept schemes, so a semantic match asserted inside a single scheme is flagged. Identifier alias holds only within its declared identifier system or systems. Equivalent-in-context requires a named context such as jurisdiction, purpose, dataset or time window and is void outside it. Representation-level relations hold between a context IRI and a target IRI in the sense of the web-linking model. Strict identity admits only endpoints that denote individuals in a shared domain of discourse. Each assertion also declares a validity interval and what is recorded when an endpoint cannot be resolved, without this model attempting resolution.

1. Which endpoint entity types are admissible for the selected relation kind, and does each endpoint satisfy them? constraint
2. Over which validity interval and named context does this equivalence hold, and when does it lapse? temporal
3. Which authority owns each endpoint, and is a cross-authority assertion permitted for this relation kind? ownership
4. What is recorded when an endpoint reference cannot be resolved at the time the assertion is made? state

Applicability tests, counterexamples and overclaiming detection

Applicability is expressed as pass or fail tests bound to documented counterexamples so that misuse is detectable rather than merely discouraged. Standing counterexamples: asserting strict identity between a real-world entity and a web page describing it, which is a URI collision under web architecture and is exactly what schema.org sameAs points at when it names a reference page; asserting strict identity between two thesaurus concepts that are only interchangeable for retrieval, which SKOS separates from OWL identity; reading a permanent redirect as identity of the denoted things when the specification frames it as which URI to use for future requests; reading rel=canonical as sameness when it designates a preferred IRI for duplicative or superset content and is informational; chaining close-match transitively when SKOS withholds transitivity from it precisely to avoid compound error; attaching a probabilistic score to a strict-identity assertion. Each detected pattern names the lower-strength kind the assertion must be downgraded to. This model publishes the tests; running them and enforcing outcomes belongs to the adopting Dimension's validation and enforcement services.

1. Which applicability test does this assertion fail, and which documented counterexample does it match? validation
2. What evidence must exist before a kind at this strength rank may be asserted at all? evidence
3. Which overclaiming pattern is suspected, and which lower-strength relation kind is the correct replacement? quality
4. Which review step must complete before an assertion may be published at the top strength rank? process

Explicit not-same held apart from unknown, unassessed and absent

Four distinct states are recorded and never conflated. Explicit not-same is a positive assertion that the endpoints do not denote the same thing, projecting to owl:differentFrom and DifferentIndividuals, to the deployed different-from property, and to a negated mapping predicate in SSSOM. Unknown means the question was asked and no determination could be reached. Unassessed means the pair has never been examined. Absent means no record exists at all. Because OWL does not assume that different names denote different individuals, the absence of an alias assertion carries no negative content, and no consumer may read absence as a not-same claim. A not-same assertion carries its own justification category, evidence reference and validity interval, and is symmetric and irreflexive.

1. Is this pair explicitly not-same, unknown, unassessed, or simply absent from the record set? state
2. May the absence of an alias assertion be read as a not-same claim, and which open-world rule forbids it? constraint
3. What evidence supports an explicit not-same assertion, as distinct from a failure to find a match? evidence
4. How long is a not-same assertion retained after its endpoints are retired, and which policy owns that disposition? retention

Invalid combinations, cycles, contradictions and strength change control

Declarative integrity rules over sets of assertions. Contradiction: the same endpoint pair on the same plane and context may not carry both strict-identity and explicit not-same. Disjointness carried from SKOS: an exact match is disjoint with broad match and related match, so those combinations are invalid. Plane contradiction: strict identity on the entity plane conflicts with a referent-replacement assertion that treats the endpoints as distinct successive referents. Cycles: replacement and historical-identifier chains must be acyclic and must terminate in a current endpoint; a closed cycle is recorded as a defect for referral, not silently broken. Cardinality: strict identity on the entity plane implies a one-to-one pairing, while probable-entity-match may stand at many-to-many pending adjudication elsewhere. Change control: any change of relation kind is a new classification carrying the prior kind, the reason, the authorising role and effective and observation timestamps; upgrade to the top strength rank additionally requires an authority declaration and an evidence reference, and downgrade must preserve the superseded classification rather than overwrite it. Detection, adjudication and enforcement of these rules are performed by services outside this model.

1. Which relation-kind combinations are declared mutually invalid for the same endpoint pair, plane and context? validation
2. What must be recorded when an assertion's relation kind is downgraded or upgraded? lifecycle
3. Which effective interval and observation timestamp distinguish a superseded classification from the current one? temporal
4. How is a replacement or historical-identifier chain handled when it closes on itself? exception
5. What event obliges a mandatory re-classification review of an existing assertion? event

Distinct actor roles and authority mandate on one assertion

An alias assertion carries several separable responsibilities that are routinely collapsed in practice: the claimant or asserter that states the equivalence, the responsible authority accountable for it, the publisher that releases it, the reviewer of record who inspected it and the approving actor who authorised it. Each is a reference to an agent in an external registry, typed as person, organization or software agent, and each may be absent. The finding also carries the mandate or instrument giving an authority the standing to assert equivalence and the scope of that mandate, which is what makes an assertion authoritative rather than merely confident.

1. Which agent asserted this equivalence, and is that agent a person, an organization or a software agent? identity
2. Under what mandate or instrument does the responsible authority have standing to declare these identifiers equivalent, and over what scope? authority
3. Who published this assertion and who remains accountable for it after publication? ownership
4. Was the assertion approved by an actor distinct from the asserter, and what act recorded that approval? decision
5. How is each role attributed so that a consumer can resolve the agent without ambiguity? provenance

Source-system binding and derivation lineage

Each side of an equivalence assertion is bound to the source system that supplied the identifier and, where one exists, to the authoritative master-system record that governs the subject. The source version or edition matters because a mapping valid against one release of a source may be invalid against the next. The finding also records derivation from prior assertions, the primary source of a re-published claim, and the provenance container that lets provenance itself be described and attributed.

1. Which source system supplied each identifier in this assertion, and which version or edition of that source was in effect? identity
2. Does an authoritative master-system record govern either side, and how is it referenced rather than copied? provenance
3. Was this assertion derived from an earlier assertion or re-published from another mapping set, and what is its primary source? relationship
4. What must travel with the assertion so that lineage survives export to a different serialisation or repository? interoperability

Separately recorded assertion time points

Alias assertions have several genuinely different times that are routinely conflated: the moment the compared source states were observed, the moment the equivalence decision was reached, the moment the assertion entered this store, the moment the record was created, and the interval over which the equivalence is asserted to hold. Conflating them makes it impossible to tell a stale decision from a stale ingest, or to reason about an assertion that was correct when made and wrong now. All values follow RFC 3339 with seconds and an explicit offset or Z.

1. When was the equivalence decision reached, and when were the source states it compared actually observed? temporal
2. When did this assertion enter the current store, and how is that kept distinct from when it was decided? provenance
3. Over what interval is the equivalence asserted to hold, and what happens outside that interval? lifecycle
4. How is a timestamp with an unknown local offset represented without silently claiming UTC preference? validation

Method identity, justification category, tool version and configuration digest

Every assertion names the method that produced it, classified by justification category such as manual curation, lexical matching, logical inference or composite matching, and identified by tool name and exact version. Where the method is a deterministic rule set, the exact rule expression or a resolvable reference to it is carried, and rules that are local heuristics rather than governed standard methods are labelled as such. A configuration digest binds the assertion to the precise parameter set used, which is what makes the decision reproducible rather than merely describable.

1. Which method produced this assertion, and what tool and exact version executed it? identity
2. What category of justification underlies the assertion: manual curation, lexical or structural matching, logical inference, or composite? classification
3. For a deterministic method, what is the exact rule expression applied, and is it a governed standard method or a local heuristic? requirement
4. What must be recorded so an independent party can reproduce the decision without access to the original matching engine? validation

Feature inventory, normalization, comparison functions and candidate generation

What the method actually compared, how each field was standardised before comparison, which comparison function and parameters were applied per field, and which blocking or indexing keys generated the candidate set. Blocking is decisive because a pair never generated as a candidate can never be linked, so a missing blocking record makes false negatives uninterpretable. This finding also records whether features were held in cleartext, hashed or privacy-preserving encoded form, and which attributes were deliberately excluded and why.

1. Which fields were used as comparison features, and which available fields were deliberately excluded? composition
2. What normalization or standardization was applied to each field before comparison, and in what order? process
3. How was the candidate pair set generated, and what pairs could the blocking strategy never produce? constraint
4. Were features compared in cleartext, hashed or privacy-preserving encoded form, and what does that choice cost in interpretability? privacy
5. What was the assessed quality of each linkage variable in the sources, and how did that constrain the method? quality

Score, scale, thresholds and decision region

A confidence value is uninterpretable without its scale and the thresholds it was compared against. Fellegi-Sunter weights are unbounded log-likelihood ratios, SSSOM confidence is a bounded zero-to-one value and FHIR assurance is a four-point ordinal scale; these are not interchangeable. The decision region records whether the pair fell in the link, possible-link or non-link band, which preserves the possible-link outcome instead of forcing a binary answer. An explanation, such as per-field weight contributions or a rule trace, makes the outcome inspectable.

1. What is the score value and on which scale is it expressed, so it is not compared against an incompatible scale? measurement
2. Which upper and lower thresholds were in force, and in which decision region did the pair fall? decision
3. What per-feature contributions or rule trace explain how this score arose? evidence
4. What state does a pair in the possible-link band hold before any clerical review resolves it? state

Calibration, evaluation results, subgroup performance and cost asymmetry

A score deserves weight only insofar as it has been evaluated. This finding attaches evaluation evidence to the method or mapping set rather than inventing it per pair: the gold-standard or training reference used, estimated false-positive and false-negative rates with precision and recall, whether scores are calibrated probabilities or merely monotone rankings, performance disaggregated by subgroup to expose differential linkage error, and the declared relative cost of a false positive against a false negative that justifies where thresholds sit.

1. Are the reported scores calibrated probabilities, or only a monotone ranking that must not be read as a probability? quality
2. What false-positive and false-negative rates were estimated for this method, and against what reference? measurement
3. How was linkage quality evaluated where no representative gold standard was available? validation
4. Does linkage error differ across identifiable subgroups, and how is that disparity reported? evidence
5. What relative cost of a false positive against a false negative was assumed when the thresholds were placed? exception

Separation of statistical confidence, relation semantics and authority

Three independent axes are habitually collapsed and must be kept apart. The relation predicate carries formal semantics: an exact-match predicate is transitive and a same-individual axiom licenses full substitution, while a close-match predicate is deliberately non-transitive precisely to stop compound errors accumulating across schemes. Statistical confidence is a property of a method's output. Authority-derived assurance is a property of who asserted it. A score of 0.99 does not license substitution; an authoritative registry assertion carries no statistical error estimate; and a negative assertion of non-identity is a first-class claim rather than the absence of a positive one.

1. Which formal predicate is asserted, and does that predicate license transitive closure or full substitution? definition
2. How are statistical confidence, semantic strength and authority-derived assurance recorded so that none can be derived from another? classification
3. When an authority asserts equivalence without a method, what does that imply and not imply about error probability? authority
4. How is an explicit assertion that two identifiers are not the same represented, distinctly from an unproven or absent link? relationship

Positive, negative and contradictory evidence items with citation and integrity

Evidence is registered as discrete items rather than folded into a narrative, each with polarity (supporting, refuting or ambiguous), a resolvable citation or locator, a content digest so tampering or substitution is detectable, a graded strength, a sensitivity classification identifying special-category or restricted identifiers, and the jurisdiction the evidence originated in. Contradictory items are retained side by side; the model does not resolve them by discarding one.

1. Which items support the equivalence, which refute it, and which are ambiguous? evidence
2. How strong is each evidence item, and on what graded scale is that strength expressed? classification
3. How is each cited item identified and verified so that substitution or alteration is detectable? security
4. Which cited items contain sensitive or special-category identifiers, and from which jurisdiction did they originate? privacy
5. Who may read a given evidence item, and how is the assertion still usable when an item is not readable to a consumer? access

Evidence currency, retraction and declared absence

Evidence decays. An item that justified an equivalence three source-releases ago may since have been superseded, corrected or withdrawn by its issuer, and an equivalence may have rested on evidence that was never available at all. This finding records the instant each item speaks to, the freshness window beyond which it should not be relied on unreviewed, retraction and supersession pointers, an explicit declaration of evidence that is missing or was sought and not found, and the point at which the assertion is due for revalidation.

1. What instant does each evidence item speak to, as distinct from when it was cited? temporal
2. Beyond what age should an evidence item no longer be relied on without re-checking? quality
3. How is an item recorded once its issuer has corrected, superseded or withdrawn it? state
4. What evidence was expected but missing, and how is a deliberate absence distinguished from a silent gap? retention

Human review, adjudication outcome and reason

Clerical review is a defined part of linkage, not an afterthought, and reviewer sign-off is what separates a tool proposal from a curated assertion. This finding records why a pair reached review at all (a possible-link band, a random quality sample, an external challenge), who reviewed it and whether they were independent of the asserter, what outcome they reached (confirmed, rejected, amended or deferred) and the reason given. A deferred outcome is preserved rather than converted into a rejection.

1. Why did this pair enter human review rather than being accepted or rejected automatically? process
2. What outcome did the reviewer reach, and what reason was recorded for it? decision
3. When did the review occur and what activity record ties the outcome to the reviewer? event
4. Was the reviewer independent of the asserter, and who owns the adjudication outcome once recorded? ownership

Competing assertions, confidence revision and the undetermined state

Two authorities can assert incompatible things about the same pair, and a probabilistic method can land in a band where no decision is warranted. The model represents disagreement as a state over a set of coexisting assertions rather than as a single mutated record: each competing assertion keeps its own asserter, authority, method and evidence; a confidence revision adds a new statement and marks the prior one superseded rather than overwriting it; and undetermined is a first-class terminal-for-now state distinct from rejected and from unassessed. Selection of an operative assertion, where a consumer needs one, is a downstream decision recorded with its own attribution, not an inference this model performs.

1. How are two incompatible assertions about the same pair held together without either being discarded? state
2. When confidence changes, how is the prior confidence statement preserved rather than overwritten? lifecycle
3. What does an undetermined state assert, and how does it differ from rejected and from never assessed? exception
4. Who selects an operative assertion for downstream use, and how is that selection kept out of the evidence record? ownership
5. How is a disputed or undetermined pair exported to a vocabulary that has no way to express disagreement? interoperability

Relation-kind semantic profile

Every alias edge names exactly one governed predicate, and each predicate carries a normative profile taken from its owning specification. The profile records the semantic class actually asserted: referential identity of individuals (owl:sameAs, licensing substitution), class co-extension (owl:equivalentClass, not individual identity), graded cross-scheme equivalence (skos:exactMatch, skos:closeMatch), cross-scheme hierarchy (skos:broadMatch, skos:narrowMatch), cross-scheme association (skos:relatedMatch), documentary succession (dcterms:replaces, dcterms:isReplacedBy), resolution-level relocation (HTTP 301/308), reference-page identity indication with no declared entailment (schema.org sameAs), and statistical linkage results carrying a score rather than an axiom. The profile also records which entailments are licensed and which are commonly assumed but not licensed.

1. Which single governed relation predicate does this alias edge assert, and which specification and version owns its meaning? definition
2. Does the asserted predicate claim referential identity, class co-extension, graded equivalence, cross-scheme hierarchy, documentary succession, resolution-level relocation, or a statistical link? classification
3. Which body governs this predicate's normative semantics and may change them without the adopting Dimension's consent? authority
4. Which entailments does the owning specification actually license for this predicate, and which are widely assumed but unlicensed? interoperability

Strength ordering and preservation on carriage

The catalogue is partially ordered by asserted strength, and carriage of an external assertion must preserve the strongest semantics actually asserted and no stronger. Concretely: a schema.org sameAs value or a probabilistic linkage result must not be re-encoded as owl:sameAs; skos:closeMatch must not be promoted to skos:exactMatch; an HTTP 308 relocation or a dcterms:isReplacedBy succession must not be read as identity of the described thing; and a high confidence value never licenses promotion. Some pairs are incomparable rather than ordered (for example associative relatedness versus documentary succession), and unrepresentable incoming kinds are recorded as lossy with a justification instead of being approximated upward.

1. What is the strongest relation kind the originating authority actually asserted for this edge, as opposed to what a consumer inferred? evidence
2. Is re-encoding the incoming kind into a different local kind permitted here, and what justification must be recorded? decision
3. Which promotions between kinds are prohibited outright regardless of any confidence value? constraint
4. What must be recorded when an incoming assertion cannot be expressed in the local catalogue without loss of meaning? requirement

Symmetry, inversion and reflexivity declarations

Each kind declares, separately and with axiomatic force noted, whether it is symmetric, asymmetric or neither; whether it has a declared inverse predicate and whether the inverse edge may be materialised; and whether a self-edge is permitted, required or prohibited. SKOS declares relatedMatch, closeMatch and exactMatch symmetric and narrowMatch the inverse of broadMatch; owl:sameAs is symmetric and reflexive as equality; dcterms:replaces and isReplacedBy are a documentary inverse pair without an OWL axiom; HTTP relocation is directional; schema.org sameAs declares no inverse. Where the source records only one direction, the reverse must not be reported as asserted unless symmetry is declared for that kind.

1. Is this kind declared symmetric, asymmetric, or neither by its owning specification, and with what axiomatic force? relationship
2. Does this kind have a declared inverse predicate, and must the inverse edge be materialised or left implicit? relationship
3. Is a self-edge, where subject and object identifiers are the same, permitted, required or prohibited for this kind? constraint
4. When the originating record captures only one direction, may the reverse direction be reported as asserted rather than derived? validation

Composition, transitivity and path admissibility

Whether an edge A to B of kind K1 and an edge B to C of kind K2 yield anything about A to C is decided by a declared composition rule for the ordered kind pair, not assumed. owl:sameAs and skos:exactMatch are declared transitive; skos:closeMatch is deliberately not, so similarity does not propagate across schemes; mixed pairs yield at most the weaker kind, and many yield nothing. OWL property chain axioms are the formal device for stating such compositions. A result may never exceed the weakest link in the supplied sequence, and a formally composable chain is still inadmissible when adjacent edges are context-incompatible. Closure computation and path discovery are performed elsewhere; this model states the rule and evaluates it over a caller-supplied sequence.

1. For this ordered pair of declared kinds, what result kind, if any, does the declared composition rule yield? composition
2. Which ordered kind pairs are declared non-composable, so that no result may be reported at all? constraint
3. How does the weakest link in a supplied edge sequence bound the strength of any reported result? validation
4. Under what conditions is a formally composable chain still inadmissible because of context, conditionality or a negated edge? exception
5. Which component discovers paths and computes closure, and what does this model provide in its place? process

Applicability, functionality and cardinality force

Each kind declares which node kinds may occupy subject and object position, and what force any cardinality statement carries. OWL 2 DL restricts SameIndividual to individuals and equivalentClass to classes, so asserting identity between classes changes the reasoning regime; SKOS mapping properties relate concepts, which is why merging concepts with owl:sameAs conflicts with SKOS label constraints; schema.org sameAs takes a URL value on a Thing; relocation relations hold between resolvable locators, not between the things they describe. Separately, a mapping cardinality value such as one-to-one is descriptive metadata about an observed mapping set, whereas FunctionalProperty, InverseFunctionalProperty and HasKey are axioms — and HasKey applies only to explicitly named individuals. Declaring a mapping one-to-one therefore entails nothing.

1. Which node kinds may occupy the subject and object positions for this relation kind? constraint
2. Is the recorded cardinality descriptive metadata about an observed mapping set or an enforced axiom, and which specification gives it that force? requirement
3. What cardinality is actually observed for this mapping set, and over which subject and object sources and versions was it measured? measurement
4. Is each endpoint a real-world entity, a concept in a scheme, a document, or a resolvable locator, and does the kind respect that distinction? identity

Context and temporal binding of an assertion

An alias assertion is bound to the context in which it is claimed to hold: the adopting Dimension, an optional jurisdiction or territorial scope, one or more purposes of use, the subject-source and object-source versions in force, and an effective interval expressed with explicit offsets. Assertion time, the interval over which the equivalence is claimed to hold, and the time this model observed or ingested the assertion are recorded separately. An assertion submitted without a declared context is stored as scope-unknown and must never be read as globally valid, which follows from the absence of a unique name assumption and the open-world reading of the underlying data: silence is not a claim of universality.

1. Over which effective interval is this equivalence asserted to hold, expressed with seconds and an explicit offset? temporal
2. Which jurisdiction or territorial scope conditions this assertion, and is that scope exclusive? spatial
3. Which Dimension and which purposes does the assertion serve, and who owns the binding? ownership
4. Which subject-source and object-source versions were in force when the assertion was made? provenance
5. How is an assertion interpreted when no context at all is declared? definition

Context incompatibility and controlled strength change

Two assertions are context-incompatible when their declared scopes cannot both apply: disjoint jurisdictions, mutually exclusive purposes, non-overlapping effective intervals, or subject and object source versions that are not co-valid. Incompatible edges must not be composed and must not be treated as corroborating one another; a declared scope compared against a scope-unknown assertion is reported as undetermined, never as compatible. Strength or scope may change only through a superseding assertion carrying an authority reference, a reason and a new effective interval — never by silent mutation. Weakening and strengthening carry different evidence bars, since strengthening enlarges what may be substituted while weakening only reduces it.

1. Which declared scope attributes make two assertions incompatible rather than merely different? constraint
2. What state does an assertion enter when its effective interval has ended or its source version has been superseded? state
3. Who is authorised to weaken or strengthen a declared edge, and what evidence bar applies to strengthening? authority
4. How is a superseding assertion linked to the assertion it replaces without deleting the original? lifecycle
5. Which chains become inadmissible once one link is context-incompatible with the next? exception

Justification, confidence and asserting authority

Every edge carries a justification type stating how the mapping was arrived at — human curation, lexical or string similarity, logical derivation, or unspecified — plus the asserting agent and the activity or tool that generated it, with a generation time. Confidence, where present, is a value on a declared scale whose meaning and estimation method must be stated: a probabilistic linkage posterior derived from a statistical model with its own error rates and assumptions is not the same quantity as a curator's subjective degree of belief. Absence of confidence is recorded as unknown and never defaulted to certainty, and no confidence value ever changes the relation kind.

1. Which agent asserted this edge, under what activity or tool, and at what generation time? provenance
2. What justification type supports this assertion, and was it human-curated, lexical, logically derived or unspecified? evidence
3. What does the recorded confidence value mean, on what scale, and by which estimation method was it produced? measurement
4. How is the absence of any confidence estimate represented so that it cannot be read as certainty? quality
5. Who may read warrant fields when the underlying matching evidence is sensitive or re-identifying? access

Non-equivalence constraints, contradiction and contagion exposure

Explicit not-same declarations are first-class: difference axioms between individuals, a negated-predicate modifier stating that a mapping does not hold, and standard disjointness such as exact match being disjoint with broad match and with related match. Against these the model reports, without enforcing: direct contradiction where identity is asserted and denied over the same pair in compatible contexts; invalid combinations such as exact match together with related match, or identity together with difference; breaches of declared applicability or cardinality; and contagion exposure — indicators of how many distinct authoritative identifiers, sources or classes a strength-of-identity edge would draw together, because equality licenses substitution and one false strong assertion propagates to everything reachable from it. Reports are derived and non-authoritative; disposition, repair and retention belong elsewhere.

1. Which not-same or disjointness constraints are declared over this pair of identifiers or over this predicate set? constraint
2. Which declared combinations are reported as invalid, and at what severity? validation
3. What exposure indicators are reported for a strength-of-identity assertion before a consumer accepts it? measurement
4. When a contradiction is reported, who decides the disposition and who carries it out? decision
5. How long is a declared-semantics report kept, and which policy owns its retention and audit trail? retention

Alias graph node and edge structure

The alias graph is a directed multigraph whose nodes are endpoint identifiers held by external systems and whose edges are the alias assertions themselves. An edge carries its own identity so that it can be annotated, cited in a path, contradicted or retracted independently of its endpoints; endpoint identity remains owned by the endpoint's system of record. Nodes are not created by this model — a node exists in the graph only because at least one edge references it.

1. What constitutes a node in the alias graph, and does referencing an identifier in an edge create any claim about that identifier beyond the edge itself? definition
2. How is an individual alias edge identified so that it can be cited in a path, annotated or retracted without ambiguity? identity
3. Is the recorded direction of an edge semantically meaningful, or is it a storage artefact of a symmetric assertion? relationship
4. What annotations may be attached to an edge, and how are they kept distinct from the edge assertion itself? composition

Edge predicate strength and composition profile

Each alias edge binds a mapping predicate whose formal profile determines whether the edge is symmetric, whether it may be chained, and whether it licenses substitution of one endpoint for the other. OWL 2 SameIndividual is a full interchangeability claim; SKOS exactMatch is transitive while closeMatch is explicitly not, precisely to prevent compound error across schemes; ISO 25964-2 distinguishes exact from inexact and partial equivalence. Not-same edges are recorded in the same structure with a modifier, so that a contradiction is visible as data rather than inferred at read time.

1. Which mapping predicate does this edge bind, and from which governed vocabulary is that predicate drawn? classification
2. Does this predicate permit chaining with another edge, and under what composition rule? constraint
3. How is an explicit not-same assertion recorded so that it constrains rather than merely comments on the graph? evidence
4. How are strength classes ordered, and is that order defined for predicates drawn from different vocabularies? interoperability

Declared traversal policy, bounds and repeated-node handling

Traversal is never ad hoc: every walk executes under a named policy version that fixes the allowed predicate set, direction, maximum hop depth, maximum returned path count and result cap, and the treatment of cycles and repeated nodes. SPARQL 1.1 establishes the baseline that arbitrary-length connectivity matching does not introduce duplicates and does not count the number of ways a connection can be made, and that cycles must not lead to undefined or infinite results; this model makes those guarantees explicit and adds finite bounds so that runs are reproducible and citable. Every run reports a termination reason, distinguishing exhaustion from bound-limited truncation.

1. Who owns this traversal policy version, and what approval was required before results under it could be published? authority
2. What maximum hop depth and maximum path count apply, and what happens when a walk reaches either bound? requirement
3. How are cycles and repeated nodes handled so that a walk terminates and does not report the same connection more than once? constraint
4. In what state did the traversal terminate, and can a consumer tell truncation from exhaustion? state
5. What must be recorded for a traversal result to be reproducible by a different agent at a later time? quality

Path provenance and weakest-edge reporting

A returned path is a derived entity: it records the ordered list of edge identifiers traversed, the hop count, the policy version and input digest under which it was produced, the agent and activity that produced it, and its production instant. Its reported strength is the strength of its weakest edge and never higher, because a chain is only as good as its least certain link; where per-edge confidence values exist they are reported alongside, not multiplied into a single reassuring number. PROV-O supplies the derivation, attribution and generation vocabulary.

1. What exactly is recorded for a returned path so that a reader can re-inspect every link in it? provenance
2. Which edge on this path is the weakest, and how is the path-level strength derived from it? measurement
3. At what instant was the path produced, and over which state of the graph? temporal
4. Which agent ran this traversal and on whose behalf, and who is accountable for citing the result? ownership

Non-materialisation rule and contradiction markers

The controlling constraint of the whole traversal surface: a path is evidence of connectivity, not an assertion of identity, and running a traversal must never write a new alias edge back into the graph. OWL 2 SameIndividual is a strong interchangeability claim and DifferentIndividuals its explicit negation, with no unique name assumption making silence informative; SHACL processing likewise does not modify the graph it reads. Where a path or a cluster spans an explicit not-same edge, or joins a pair whose predicates are disjoint under SKOS S46, the result is marked with a contradiction marker that travels with it and blocks summarisation as a confirmed equivalence.

1. What prevents a traversal result from being written back as a new alias edge, and how is that state visible on the record? decision
2. Which contradiction conditions raise a marker on a path or cluster, and what does a marker forbid downstream? exception
3. If entailment closure over these edges is wanted, which component owns it and what does this model hand over? ownership
4. What must a consuming system be told so that it does not mistake a candidate path for an established equivalence? interoperability

Equivalence cluster as a registered derived view

An equivalence cluster is a view computed by an external reasoning or master-data process, not a fact this model holds. It enters the model only by registration, and only with the calculation rule identifier, the rule version, a digest of the input edge state, the snapshot instant and the membership evidence for each member. Snapshots are immutable: a corrected calculation yields a new snapshot linked as a revision of the prior one. Reproducibility is a property of the record — a snapshot that cannot be regenerated from its recorded inputs and rule version is marked unreproducible and may not be cited as membership evidence.

1. Which calculation rule and rule version produced this cluster, and which authority owns that rule? process
2. As of what instant does this cluster membership hold, and over what interval may it be cited? temporal
3. For each member of this cluster, what evidence places it in the cluster? evidence
4. What is stored so that an independent party can regenerate this exact cluster? validation
5. How stable is this cluster across successive calculations, and what does instability indicate? quality

Canonical representative as a referenced external decision

Naming one member of a cluster as the canonical representative is a preference decision taken by a master-data, curation or publication authority; no equivalence semantics support it, since OWL 2 makes co-denoting individuals interchangeable without privileging any name and RDF 1.2 gives every IRI equal standing as a denotation. This model therefore records only the reference: which authority decided, under which rule and version, for which scope, over which effective interval. Endpoint identities are never rewritten, non-representative members are never demoted to aliases of the representative, and preference is never upgraded into an equivalence assertion.

1. Which authority selected this representative, and under what named rule and version? authority
2. For which scope does this representative hold, and can different scopes name different representatives for the same cluster? ownership
3. Over what interval is this representative decision effective, and what is retained when it changes? temporal
4. What guarantees that naming a representative changes nothing about the identity or standing of the other members? decision

Split and merge lineage, retained aliases and downstream impact

Clusters split when a contaminating edge is retracted and merge when a new edge connects previously separate components. Each such change is recorded as a lineage event linking predecessor and successor snapshots, with the event time distinguished from the time the change was recorded here. Prior membership and prior representative decisions are preserved and remain queryable, aliases that stay valid across the change are marked retained, and the assertions and downstream references that cited the affected snapshot are enumerated in an impact report. This model reports impact; it does not update, notify or reconcile the downstream systems.

1. What kind of lineage event occurred, and which predecessor and successor snapshots does it connect? lifecycle
2. Which alias edges remain valid across this change, and which are now confined to a different successor cluster? relationship
3. How can a caller find out which cluster an identifier belonged to at a past instant, and which representative applied then? identity
4. Which downstream assertions and references cited the affected cluster, and what are they told? event
5. How long are superseded snapshots and closed representative decisions kept, and who sets that period? retention

Graph pathologies, contamination and safeguards

The recurring failure modes of identity graphs, detected and reported as results with severities rather than repaired. Covers false strong edges that collapse distinct subjects into one cluster; contradictory not-same edges found inside a cluster; disconnected subgraphs that a bounded policy cannot join; stale members whose endpoint has been withdrawn upstream; orphaned representatives no longer in their cluster; and breaches of the declared hop and path safeguards. Results follow the validation-report shape of focus node, source shape or condition, and severity, and no result triggers automatic correction.

1. How is a suspected false strong edge identified, and what happens to the clusters that depend on it? quality
2. How are disconnected subgraphs distinguished from an artefact of the traversal bounds in force? validation
3. What marks a cluster member or representative as stale or orphaned, and how is that surfaced without changing the snapshot? exception
4. Which access controls apply to integrity findings, given that they can expose links a reader is not entitled to see? access
5. What counts as a breach of the declared hop and path safeguards, and what must a run do when one occurs? constraint

Canonical assertion status vocabulary

Defines the governed status values for an alias/same-as assertion - candidate/proposed, under-review, active, disputed, superseded, retracted, rejected, expired, tombstoned - each with a normative definition, a category (progression versus terminal documentation status), and an explicit rule stating what a consuming agent may do with the equivalence while that status holds. Status qualifies the assertion record, never the identifiers it references.

1. What is the normative meaning of each status value, and what may a consuming agent do with the asserted equivalence while that status holds? definition
2. Is a given status a progression status that can still improve, or a terminal documentation status with no further progression? classification
3. Does the status apply to the whole assertion or only within a named scope, dataset or endpoint pair? state
4. Which external status or predicate vocabulary term does each local status map to, and where is that mapping only partial? interoperability

Change-kind taxonomy and non-destruction rule

Distinguishes the disjoint kinds of change that act on an assertion: correction (the record misstated the decision or facts), supersession (a newer assertion replaces this one), retraction (the assertion is withdrawn as wrong or unsupportable), endpoint-deprecation notice (a referenced endpoint was deprecated upstream), replacement/redirect notice (an endpoint was replaced upstream), authority withdrawal (the asserting party revokes its mandate or backing) and evidence expiry (the evidence validity horizon passed). No change kind may delete an endpoint reference, rewrite an earlier record or erase refuting evidence.

1. How does this change differ from a correction, a supersession, a retraction, an endpoint-deprecation notice, a replacement/redirect notice, an authority withdrawal and an evidence expiry? classification
2. Which facets of the assertion does this change alter, and which facets must remain unchanged afterwards? constraint
3. What must never occur as a side effect of this change kind? exception
4. Which upstream model reported the event that triggered this change, and what reference points to that upstream record? provenance

Allowed and forbidden transitions with entry and exit conditions

The normative from-status/to-status matrix for the assertion lifecycle, with per-transition entry conditions (mandatory attributes, required evidence, required reviewer role), exit conditions (open obligations that block departure), terminality, and the rule that a forbidden attempt is recorded as a rejected transition rather than silently discarded. Post-publication statuses are not deletable; only a never-published candidate may be discarded, and then only if it was never externally referenced.

1. Which target statuses are reachable from the current status, and which are explicitly forbidden? lifecycle
2. What entry conditions must hold before a transition into this status can be recorded? requirement
3. What open obligations block leaving this status? constraint
4. Is this status terminal, or may the assertion be re-opened, and on what recorded justification? state
5. How is an attempted transition that the matrix forbids recorded and reported back to the requester? validation

Responsible authority attribution for a status decision

Records which agent is held responsible for each status decision, in which role, under which mandate or delegation, and against which governing decision policy. Attribution is a provenance record: it names the responsible party and cites the policy, and it neither evaluates nor enforces whether that party was permitted to act, which the referenced access-policy model owns. Change control over the assertion record and over the status vocabulary is named separately per registry practice.

1. Which agent is recorded as responsible for this status decision, and in what role? authority
2. Which body holds change control over this assertion record and over the status vocabulary itself? ownership
3. Under which mandate, delegation or review policy was the deciding agent acting, and where is that policy referenced? decision
4. How is a multi-party or quorum review recorded when several reviewers contribute to one decision? relationship

Immutable transition record content and integrity

Each status decision produces exactly one append-only record carrying the assertion reference, monotonic ordinal, from-status, to-status, change kind, reason in the decider's own words, deciding agent and role, decision time, matrix version in force, and an integrity digest chained to its predecessor. Decided fields are never edited in place; a mistake is corrected by appending a correction record that references the target.

1. What identifier and ordinal uniquely denote this transition record within the assertion's history? identity
2. Which decision does the record describe, expressed as prior status, new status, change kind and outcome? event
3. What reason and rationale were given at decision time, in the decider's own words? provenance
4. By which recording procedure was the entry appended, checked and sealed? process
5. How would tampering with an already-appended record be detected? validation

Evidence polarity and assertion-to-assertion links

Every decision cites the evidence considered, separating supporting from refuting items with the strength assessed at decision time, and records the links between assertions: supersedes / superseded-by, disputes / disputed-by, corrects / corrected-by and replaced-by. Refuting evidence references are retained through retraction and tombstoning; a later positive decision never removes earlier negative evidence. Evidence content and its own lifecycle stay with the evidence and match models.

1. Which evidence items were considered supporting and which refuting at the time of the decision? evidence
2. What strength or confidence was assessed for each evidence item, and by which stated method? quality
3. Which assertion does this one supersede, and which assertion supersedes it? relationship
4. For how long must refuting evidence references be preserved after the assertion is retracted or tombstoned? retention

Effective interval and bitemporal timestamps

Each assertion carries an effective interval over which the equivalence is claimed to hold, and each transition record carries a decision/event time, an observation time and an ingestion time. All are RFC 3339 date-time values with seconds and an explicit numeric offset or Z; the originating offset is preserved alongside any normalised UTC value. Open-ended intervals are represented explicitly as unbounded-at-this-time rather than as an unqualified null, and evidence-validity horizons drive expiry.

1. Over which effective interval is the asserted equivalence claimed to hold? temporal
2. What are the decision time, the observation time and the ingestion time of this record, and where do they differ? event
3. How must each time value be expressed, and what precision and offset must be present? requirement
4. How is an unknown or open-ended interval endpoint represented without implying an unlimited claim? constraint
5. When does the assertion expire automatically because its evidence-validity horizon has passed? lifecycle

Late arrivals, retroactive corrections and as-of reconstruction

Handles events recorded after later events already exist and corrections that change what is believed to have been true in the past. Records are never reordered or overwritten: a late arrival is appended with its own decision time and a later ingestion time, and a retroactive correction appends a record that restates the effective interval or the corrected facts while pointing at the record it corrects. Two reconstructions are supported and must be distinguishable: the status as it was known at a past instant, and the status now believed to have applied at that instant.

1. How is an event recorded after a later event already exists reconciled without reordering the history? temporal
2. What procedure records a retroactive correction to a past effective interval or a past decision? process
3. How is the status as it was known at a past instant distinguished from the status now believed to have applied then? validation
4. What signals a late arrival or correction to downstream consumers that already acted on the earlier state? interoperability

Conflicting states, rollback requests, authority loss and post-retraction readability

Covers two or more simultaneously recorded, mutually inconsistent statuses for the same assertion (typically from different authorities or a partitioned write path), which are represented as an explicit disputed state naming the conflicting records rather than being silently reconciled; rollback requests, which are satisfied by appending a forward transition that restores an earlier status with its own justification, never by removing records; authority loss or withdrawal, which freezes further transitions by that authority and marks affected assertions for review while leaving their history intact; and the tombstone, which keeps the assertion identifier resolvable and carries the identifier, terminal status, reason, effective interval, links and history pointer after retraction.

1. How are two simultaneously recorded, mutually inconsistent statuses for one assertion detected and represented? exception
2. What happens to an assertion when the authority that made it loses or withdraws its mandate? state
3. How is a rollback request satisfied when the append-only rule forbids removing records? decision
4. Which fields remain readable, and to which audiences, after retraction or tombstoning? access
5. What minimum content must a tombstone retain, and under which retention class? retention

As-Of Time Basis and Dual Timeline

Every resolution request selects on two independent axes: the real-world validity or event time of the assertions being considered, and the observation or ingestion time at which this model came to hold the evidence. A current answer is the degenerate case where both axes are set to 'now'. Recording only one axis makes a historical answer irreproducible, because evidence that arrived late would silently change a past answer.

1. Which event or validity instant and which observation or ingestion instant does this as-of resolution request select on? temporal
2. Is the answer a current answer or a reconstructed historical answer, and how is that difference marked on the answer itself? state
3. How is a later answer for the same as-of instant distinguished from an earlier one after new evidence arrives? provenance
4. What rule applies when an assertion's validity interval is open-ended or the asserting authority supplied no time-zone offset? constraint
5. How is clock skew between the asserting authority and this model bounded and disclosed on the answer? quality

Source and Target Version Pins

An assertion is evaluated against particular states of its two endpoints. Recording which state was seen turns an unfalsifiable claim into a checkable one and lets a historical answer be re-derived. Where the endpoint authority publishes a version identifier or a time-based access mechanism, the pin binds to it; where it does not, the pin degrades explicitly to an observation timestamp plus a payload digest rather than being omitted.

1. Which version identifier of the source endpoint and which of the target endpoint was this assertion evaluated against? provenance
2. How is a pin expressed when the endpoint authority publishes no version identifier or time-based access mechanism? identity
3. Which external version or as-of mechanism is bound for each endpoint namespace, and who declares that binding? interoperability
4. How is a pin checked as still dereferenceable before an answer cites it, and what happens if it is not? validation

Deterministic Resolution Status and No-Answer Outcomes

A resolution answer carries a status drawn from a closed vocabulary. Where more than one endpoint remains admissible the answer returns the candidate set with an ambiguity status; it never silently elects a canonical endpoint. Where nothing is admissible at the requested instant it returns an explicit no-answer status with a reason, never an empty success. The inputs that determined the status are enumerated so the answer can be recomputed.

1. Which closed status vocabulary may an alias resolution answer carry, and who may extend it? classification
2. When several candidate endpoints remain admissible, is one selected as canonical or is the ambiguity returned to the caller? decision
3. What is emitted when no assertion is admissible at the requested as-of instant? exception
4. Which inputs must be enumerated on the answer so the same answer can be recomputed later? evidence
5. Which conditions make an answer non-deterministic and therefore invalid to emit? constraint

Endpoint Condition: Stale, Missing, Unresolved and Tombstoned

An assertion names two endpoints whose condition may have changed since the assertion was made. Registries such as ROR and DataCite keep identifiers resolvable while marking them inactive, withdrawn or tombstoned rather than deleting them, and HTTP distinguishes an absent resource from one deliberately gone. This model records the observed condition of each endpoint with its observation instant and evidence, and uses it to qualify rather than to erase assertions.

1. What condition did each endpoint present at the observation instant, and on what evidence? state
2. How does a deprecated, withdrawn or tombstoned endpoint change the admissibility of assertions naming it? lifecycle
3. What distinguishes an endpoint that was unreachable from one that is genuinely absent, in the recorded evidence? evidence
4. For how long may a prior endpoint condition observation be reused before re-observation is required? retention

Chain Traversal Budget, Loop Detection and Relocation Class

A hop sequence reported to this model is admitted as an ordered, terminating trace under an explicit hop budget. RFC 9110 only advises clients to detect cyclical redirections and notes a historical five-redirect recommendation, so the budget and the loop rule must be declared locally rather than assumed. Each hop is classified as permanent relocation, temporary relocation or non-relocating hint, because only the permanent class is even a candidate for promotion into an equivalence proposal.

1. How is an externally observed hop sequence admitted, ordered and declared terminated? process
2. What is the maximum hop budget for a chain and what outcome is emitted when it is exhausted? constraint
3. How is a cyclical chain detected, and what is recorded when a loop is found? exception
4. How is each hop classified as permanent relocation, temporary relocation or a non-relocating hint? classification
5. How is a hop observation bound to the as-of frame of an answer that relies on it? temporal

Transport Hints Are Evidence, Not Identity Proof

A permanent relocation response, a canonical link relation or a published alsoKnownAs statement is a preference or a claim about where content is served, not a demonstration that two identifiers denote the same real-world subject. RFC 6596 defines canonical as a preferred IRI over duplicative or superset content; RFC 8288 warns against inferring extra semantics from relation types; DID Core states that an alsoKnownAs assertion does not prove itself and advises independent verification and reciprocity. This model therefore captures hints as attributable evidence and requires a separate, authority-backed promotion step before any equivalence assertion exists.

1. What evidential weight may a permanent relocation or canonical link carry towards identifier equivalence? evidence
2. What additional confirmation is required before a captured hint becomes a proposed equivalence assertion? validation
3. Who observed the hint, from which endpoint and in which representation? provenance
4. Which hint relation vocabularies are recognised, and how are unregistered relation types handled? interoperability

Merge, Split and Withdrawal Consequences with Readiness Reporting

When an endpoint authority merges two identifiers, splits one into several, or withdraws one, the decision is theirs; the consequence for every assertion naming that endpoint is this model's. ROR keeps every identifier resolvable and expresses these events as predecessor and successor relationships that need not be bidirectional, which means a merge or split gives a hint about continuity but not an equivalence. This model records the change event, marks the affected assertions for re-evaluation, enumerates impacted downstream references and emits an impact and readiness report plus notification content.

1. Which externally decided endpoint change events are in-scope triggers for cluster re-evaluation? event
2. How are predecessor and successor endpoints recorded without themselves being treated as equivalence assertions? relationship
3. How is a cluster re-evaluation request raised, tracked and closed? process
4. Who decides the endpoint change, who owns the re-evaluation and who consumes the readiness report? ownership
5. How are impacted downstream references enumerated and how is the change made discoverable to them? interoperability

Concurrent Proposals, Idempotency and Duplicate Detection

Two proposals about the same endpoint pair may arrive simultaneously, and any one proposal may be retried after an ambiguous failure. Optimistic concurrency with an expected-version precondition rejects a blind overwrite; an idempotency key combined with a request fingerprint distinguishes a retry from a genuinely new proposal and lets the original outcome be replayed. Semantic duplicate detection is separate again, because two textually different payloads can assert the same equivalence.

1. Which precondition token must a proposal carry so that a lost update is rejected rather than applied? constraint
2. How is a retried proposal recognised as the same operation rather than accepted as a new one? process
3. How is a semantically duplicate assertion detected when its payload differs textually from an existing one? validation
4. What happens when two proposals for the same endpoint pair are in flight at the same moment? exception
5. How long is an idempotency key honoured, and what prevents its reuse with a different payload? security

Conflicting Active Assertions, Compensation and Emergency Quarantine

Two authorities may hold contradictory active assertions about the same endpoint pair, and a harmful assertion may need to stop influencing answers before its dispute is settled. Following registry practice that identifiers are never deleted and withdrawn items keep resolving to a tombstone that states the reason, containment here suppresses visibility and issues compensating actions while retaining every prior decision and evidence item unchanged.

1. What states may a contradictory pair of active assertions be placed in without deleting either? state
2. Who may raise an emergency quarantine, and on what evidence threshold? authority
3. How is a quarantine lifted, allowed to expire, or escalated to permanent withdrawal? lifecycle
4. What must be retained when an assertion is withdrawn or a prior action is compensated? retention
5. Which consumers may still see a quarantined assertion, and in which part of the answer does it appear? access

Separated control roles, delegation instruments and authority windows

Distinguishes the control roles that may act on an alias assertion — owner/steward, source authority, target authority, assertion publisher, matching operator, reviewer/adjudicator, policy authority, privacy officer and records authority — and for each records the holding agent, the party on whose behalf it acts, the instrument delegating the authority, the scope of that authority and the instant at which it lapses or requires re-attestation. It also records which role pairs may not be held by the same agent for the same assertion.

1. Which agent holds each control role for this assertion, and are those roles held by distinct agents? authority
2. On whose behalf does each role holder act, and which instrument delegates that authority? provenance
3. When does each role assignment take effect, and when does it expire or require re-attestation? temporal
4. Which namespace, tenant or identifier range does each authority cover, and what lies explicitly outside it? ownership
5. Which role combinations are prohibited for the same agent acting on the same assertion? security

Endpoint authority designation, precedence and contest

How competing authority claims over the same equivalence are ordered: which linked endpoint is designated authoritative source, which is alternate and which is historical; whether a publisher may assert equivalence over identifiers it does not govern and what acknowledgement each endpoint authority gives; which precedence rule resolves conflicting assertions; and how a contested or refuted assertion is represented without silently changing its declared relation strength.

1. Which linked endpoint is designated authoritative source, which is alternate and which is historical? classification
2. May a publisher assert equivalence over identifiers it does not govern, and what acknowledgement is required from each endpoint authority? requirement
3. Which precedence rule resolves conflicting assertions from different authorities, and what is recorded when no rule applies? decision
4. What states may a contested assertion occupy, and does an open contest suspend downstream use? state
5. Does an assertion inherit authority when it is chained through another party's equivalence, and how is that inheritance limited? interoperability

Approval tiers keyed to relation strength and evidence class

Binds each declared relation strength — strict identity, curated exact match, curated close or related match, local alias, unreviewed candidate hint — to a minimum evidence class, a minimum reviewer independence and an approval tier. Strict identity claims require documentary or authority-issued evidence and a reviewer independent of the matching operator and the publisher; weaker relations may be self-approved by the publisher and must then carry the weaker relation strength. It also records what is captured when an approval is refused or an assertion is downgraded, and which changes force re-review.

1. What evidence class is minimally sufficient to approve each declared relation strength? evidence
2. Which approvals require a reviewer independent of the matching operator and the publisher, and how is that independence demonstrated? validation
3. How is a numeric confidence value interpreted for approval, and who sets and periodically reviews that threshold? measurement
4. What is recorded when an approval is granted, refused or downgraded to a weaker relation? decision
5. Which changes to the endpoints, the evidence or the matching method invalidate an existing approval? lifecycle

Scoped, time-boxed and reviewable approval exceptions

An exception permits an assertion to be created or kept in use without the evidence or review its declared relation strength normally requires. Each exception names the requester, the granting policy authority, the exact scope, the mandatory expiry instant, any compensating condition and the post-hoc review due date. An exception may relax an approval requirement; it may never raise the declared relation strength, the recorded assurance level or the evidence class of the assertion it covers, and its presence remains visible on the assertion.

1. Which conditions justify granting an exception, and which authority alone may grant it? exception
2. What is the maximum duration of an exception, and what happens automatically when it expires? temporal
3. What must remain unchanged in the assertion while an exception is in force? constraint
4. Who reviews granted exceptions after the fact, on what cadence, and what must that review reference? process

Personal, special-category, protected-identity and protected-location content

Classifies each endpoint identifier, label, matching feature and reviewer note as personal data or not, flags any special category revealed by the link, records pseudonymisation state, and marks protected identity or protected location exposure. The controlling concern is emergent: an equivalence can defeat a pseudonym or reveal a sensitive affiliation even when neither endpoint does so alone, so the classification of the assertion is not simply the union of the endpoint classifications.

1. Which elements of this assertion are personal data, and which of them reveal a special category? privacy
2. Does linking these endpoints defeat a pseudonym or reveal a protected identity that neither endpoint reveals alone? security
3. Does the assertion expose a protected or restricted location, and at what granularity may that location be disclosed? spatial
4. How is an inaccurate or objected-to assertion about a person corrected or suppressed, and within what period? quality
5. How do the sensitivity labels of the two endpoints combine into the label carried by the assertion? classification

Declared purpose, lawful basis reference and tenant isolation

Records the purposes for which the equivalence may be used, the purposes explicitly excluded, the reference to the authority or lawful basis permitting the processing, and the tenant or compartment inside which the assertion is valid. Cross-tenant reuse is never inherited: it requires an explicit binding naming the receiving tenant, the purpose it may serve and the authority that permitted it.

1. For which declared purposes may this equivalence be used, and which uses are explicitly excluded? privacy
2. Which authority or lawful basis permits processing these identifiers for the declared purpose, and where is that record held? authority
3. Within which tenant, compartment or community is this assertion valid, and what is required to use it outside that boundary? access
4. How is a request to use the equivalence for a purpose that was not originally declared assessed and recorded? decision

Public mapping, restricted evidence and access scoping declarations

Splits an assertion into disclosure classes — the public equivalence statement, the private matching evidence and features, the reviewer notes, and reviewer identity — and declares for each which audience may receive it, at which scope level (bundle, layer, finding or artifact), with which handling obligation such as masking or redaction, and under which emergency release condition. Every declaration is an attribute or obligation statement consumed by an external decision and enforcement point; this model publishes no permit or deny result and executes no enforcement.

1. Which parts of the assertion are publishable, and which remain restricted evidence or reviewer material? access
2. At which scope — bundle, layer, finding or artifact — is each restricted part released, and what is the smallest grant that meets a legitimate need? requirement
3. Is the reviewer's identity published with the decision, pseudonymised or withheld, and what condition reveals it? privacy
4. Who may invoke emergency release of restricted evidence, which purpose of use must be declared, and when does that grant lapse? exception
5. What does this model publish in place of an allow or deny result, and which component consumes it? decision

Retention class, disposition authority citation and hold state

Binds each record this model owns — the assertion, its evidence, the review decision and the exception record — to a retention class and a citation of the disposition authority that governs it, and records the current hold state with the agent that applied it and the instant it took effect. The binding and the hold reference live here; approving the schedule, executing destruction or transfer, and lifting a hold are performed by the records authority.

1. Which retention class and disposition authority govern the assertion, its evidence and its review record? retention
2. What is the current hold state, who applied it, and what evidence is required to lift it? state
3. May private evidence be disposed of earlier than the published mapping, and what must survive that disposal? constraint
4. Which system executes destruction or transfer, and what remains in this model afterwards? process

Retraction, tombstone content and preserved provenance

Withdrawal of an assertion is an event, not an erasure: it produces a retraction record naming the retracting authority, the reason and the event time, and leaves a tombstone that lets downstream consumers detect that a previously published equivalence no longer holds. The tombstone carries the assertion identifier, the retraction reason, any superseding assertion and the audit event reference, while the substantive evidence may already have been disposed of under its own retention class.

1. What causes an assertion to be withdrawn, and which authority may withdraw it? event
2. What minimum record survives withdrawal so that downstream consumers can detect it? identity
3. Which provenance of the withdrawn assertion must be preserved, and under whose retention rule? provenance
4. Is the withdrawn assertion replaced by a corrected one, and how is that replacement expressed? lifecycle

Storage and Interface Projection Capability Matrix

A per-projection capability declaration covering Git-tracked file trees, MCP server resources, document-store collections, RDF graphs, tabular exports and HTTP APIs. For each projection it states which alias features are carried natively, which require an accompanying metadata document, which are unsupported, and which single projection is normative when two disagree. The matrix exists because a projection is a distribution of the alias set, never a variant of its meaning.

1. Which storage and interface projections are declared conformant for this alias set, and which alias features can each carry natively? interoperability
2. Which accompanying metadata document must travel with a projection that cannot embed alias-set metadata inline? composition
3. Which projection is normative when two projections of the same alias set disagree? constraint
4. What conformance evidence shows that a projection preserves the alias features it claims to carry? validation

Round-Trip and Information-Loss Register

An evidence-backed inventory of every information loss, semantic weakening, unsupported relation kind and round-trip limitation observed when an alias set is written to and re-read from each declared projection. Each entry names the affected feature, the projection, whether the loss is detectable by the reader, and the compensating carrier if one exists. Publication of a projection is blocked until its losses are declared here.

1. Which alias features are lost or silently weakened on each declared write-then-read cycle? quality
2. What round-trip test corpus and result set demonstrate that the loss inventory is current? evidence
3. What must an implementation do when it encounters a non-standard slot or an unsupported relation kind it cannot represent? exception
4. On what basis may a lossy projection still be accepted for publication rather than rejected? decision

External Equivalence Predicate Binding Profile

The declared mapping from each internal alias strength and kind to a predicate in a target vocabulary — owl:sameAs for strict individual identity, skos:exactMatch or skos:closeMatch for graded concept-level matches, alsoKnownAs for unverified subject-level claims, and an SSSOM predicate_id with an optional predicate_modifier for interchange — together with the exact downgrade recorded whenever the target predicate is weaker or the alias feature is inexpressible. Bindings are alignments, not conformance claims.

1. Which target-vocabulary predicate is bound to each internal alias strength, and how is negation expressed? classification
2. Which predicate combinations are prohibited because the target vocabulary declares them disjoint? constraint
3. How is an alias feature the target vocabulary cannot express carried alongside the exported statement? interoperability
4. Who may approve a binding that would export an assertion under a stronger predicate than the internal strength? authority

Entailment and Reciprocity Risk Controls

The guard settings that prevent an export from creating inference the alias record does not support. owl:sameAs licenses full substitution and unlimited closure; skos:exactMatch is symmetric and transitive within the mapping vocabulary but entails no individual identity; alsoKnownAs asserts nothing verified in the absence of a reciprocating assertion in the other subject's document. These controls set the thresholds and refusal conditions applied at export time and the invalidation signal sent when a previously exported equivalence is retracted.

1. Which entailment closure does each bound predicate license in the consuming system? constraint
2. What reciprocity evidence is required before an incoming third-party equivalence claim may be treated as equivalence? requirement
3. What guard prevents a graded or low-confidence alias from being emitted under a strict identity predicate? security
4. How is a consumer of a previously exported equivalence notified when that equivalence is retracted or contested? event

Redirect and Resolution Projection Binding

Binds alias status to HTTP behaviour: a superseded identifier whose canonical replacement is settled maps to a permanent redirect (301 or 308), a provisional or under-review equivalence maps to a temporary redirect (302 or 307), and a slash-namespace term that denotes a non-information resource is served with 303 See Other. Graded matches are never projected as permanent redirects. This model emits a server-agnostic redirect rule set and cache directives; the HTTP service that executes them is a referenced neighbour.

1. Which HTTP status class is bound to each alias status, and what is the Location target? interoperability
2. Who holds write authority over the namespace whose URIs a redirect projection claims to govern? ownership
3. What does this model emit for redirect behaviour, and which system actually performs the redirect? process
4. How long may a redirect projection be cached, and when must it be regenerated after an alias change? temporal

Namespace Ownership and Prefix Expansion Governance

Declares the namespaces the owner package owns outright versus those it merely references under another authority's control, and publishes the prefix-to-IRI map that lets every compact identifier in an alias set expand to a full IRI without consulting any external resource. Covers collision handling when two declarations bind one prefix to different stems, and pins which prefix-map edition was in force when a record was written.

1. Which namespaces does the adopting Dimension own outright, and which are referenced under another authority? ownership
2. How is every compact identifier in an alias set expanded to a full IRI without consulting an external registry? identity
3. What happens when two prefix declarations bind the same prefix to different IRI stems? exception
4. Which prefix-map edition was in force when a given alias record was written? provenance

Canonical Schema, Versioning and Compatibility Promise

The canonical schema an alias record and alias set are validated against, the version identifier they declare, which changes count as breaking for a consumer, how a released edition is superseded without being mutated, and what a consumer must do when it meets a version it does not fully recognise. This is the promise that makes safe evolution possible without renegotiating every consumer.

1. Which canonical schema and version does an alias set declare, and where is that schema dereferenced? requirement
2. Which schema changes are breaking for a consumer of an exported alias set? classification
3. How is a released schema or alias-set edition superseded without mutating what was already published? lifecycle
4. What must a consumer do when it reads a minor version whose additions it does not recognise? validation

Alias Record Identity and Time Discipline

Applies the identity priority to alias records and sets — an authoritative master-system identifier where one exists, otherwise a governed IRI in a controlled namespace, otherwise a Dimension-assigned UUID or ULID — and forbids dates, version strings, digests, file names and projection-local surrogate keys from acting as identity. Separately fixes the time discipline: the time the equivalence was asserted by its authority, the time this model first observed it, and the time it was written into a projection are three distinct values recorded whenever they differ.

1. Which identifier is authoritative for an alias record when a master system already assigns one? identity
2. How are the time an equivalence was asserted, first observed and written recorded distinctly? temporal
3. Why may a content digest, file name or version string never be promoted to a record identifier? constraint
4. Which clock and offset applied when a timestamp was recorded, and was the local offset known? provenance

Canonical Form, Digest and Integrity Verification

Defines the deterministic canonical form used for comparison, diffing, digesting and signing. Two regimes apply and are declared explicitly rather than merged: RDF projections are canonicalized to canonical N-Quads with deterministic blank-node labels, where two datasets share a canonical form if and only if they are isomorphic; slot-record projections are canonicalized by propagating set-level slots, ordering slots by the schema's slot order, sorting multi-valued slots, truncating floating-point confidence, and excluding identity and computed-cardinality fields. Digests verify integrity and detect drift only.

1. What is the canonical form of an alias record, and which fields are excluded from it? definition
2. Which digest algorithm and encoding are used, and what collision assumption is stated alongside them? measurement
3. How does a consumer verify that a received alias set matches the published edition byte for byte? evidence
4. How is canonical form computed for a graph projection that contains unlabelled nodes? interoperability

Idempotency key, request fingerprint and duplicate-command resolution

Every mutation command carries a client-generated idempotency key and is reduced to a canonical fingerprint. The register keeps a receipt series keyed by (submitting client, idempotency key) and uses it to classify an arriving command as a first occurrence, an in-flight duplicate, a completed replay whose recorded outcome is returned unchanged, or a key reuse with a differing payload. This makes retry safe for commands that are not naturally idempotent, without ever applying an effect twice.

1. What command identifier, idempotency key and command-type code must a mutation command carry before the alias register will accept it for processing? identity
2. Which parts of a command are included in the canonical fingerprint compared against a replayed idempotency key, and which are deliberately excluded? constraint
3. How is an incoming command classified as a first occurrence, an in-flight duplicate, a completed replay or a key reuse with a different payload? process
4. How long is a command receipt retained for replay resolution, and how is a retry that arrives after the key has expired treated? retention
5. Which outcome is recorded when the required idempotency key is absent, malformed or exceeds the declared length or entropy constraints? exception

Optimistic-concurrency precondition and stale-version detection

Every command that targets an existing assertion must supply a validator proving which version the submitter observed. The register compares that validator against the current version token of the target and refuses the command if they differ, so concurrent proposals cannot silently overwrite one another. Precondition failure is semantically distinct from idempotent replay: a replay returns the earlier outcome, a stale validator is a rejection that requires the submitter to re-read and re-derive.

1. Which validator does a mutation command supply to prove it observed the current assertion version, and how is that validator derived? state
2. What distinguishes a stale-version rejection from a duplicate-command replay when both arrive from the same submitting agent? exception
3. How are two concurrent proposals against the same endpoint pair ordered, and which one is recorded as losing the race? constraint
4. At what granularity is the concurrency token scoped: the individual assertion, the endpoint pair or the whole alias register? composition
5. When is a weak validator acceptable for an alias command and when must the validator be strong? validation

Declared validation check set for alias commands

A versioned catalogue of named checks with declared severity and applicability per command type. It covers endpoint reference and version presence, the relation-property contract and its vocabulary binding, type/scheme/context compatibility of the two endpoints, required evidence and review sufficiency, contradiction with existing active assertions, violation of declared not-same constraints, effective-interval well-formedness and overlap, and the declared access scope. The catalogue states what must be checked; it does not resolve endpoints, does not infer entailments and does not decide access.

1. Which checks must pass before a proposed alias assertion may be activated, and which are advisory only? requirement
2. How is the endpoint reference and its version verified without resolving or dereferencing the endpoint itself? validation
3. Which relation-property, type, scheme and context compatibility rules make a proposed endpoint pairing admissible? interoperability
4. How are contradictions with existing active assertions and with declared not-same constraints detected and reported? relationship
5. How are the effective interval and the declared access scope of a proposal checked against the target assertion? temporal

Validation outcome record and machine-readable failure report

Each validation run produces one outcome record stating whether the command conforms and, if not, one result per failed check naming the focus element, the path within it, the offending value, the check that produced the result and its severity. The same outcome projects into a machine-readable failure document for the calling interface. The report binds the digest of the exact command payload and catalogue version it judged, so a later edit of either is detectable.

1. What must a validation outcome record contain so a caller can tell exactly which check failed on which element? quality
2. How are check severities mapped to a machine-readable failure response and to an accept, hold or reject outcome? classification
3. Which evidence of the validated input is bound into the outcome so a later change to the proposal is detectable? evidence
4. How are multiple simultaneous check failures reported without collapsing them into a single opaque error? interoperability
5. Which validation and processing failures are retryable, and how is that signalled to the submitting agent? exception

Propose command and proposal versioning

The propose command records a candidate equivalence: the endpoint references and their versions, the declared relation property and its vocabulary binding, direction and canonical designation, proposed effective interval, declared confidence, asserting authority reference and declared access scope. It creates a new immutable proposal version; it never edits an earlier one. A re-proposal over the same endpoint pair appends a new version linked as a revision of its predecessor.

1. What minimum content must a propose command carry to create the first version of an alias assertion? requirement
2. How is a proposal identified and versioned when the same endpoint pair is proposed repeatedly by different agents? identity
3. Which state does a newly recorded proposal enter, and which commands are legal from that state? lifecycle
4. How are the proposing agent and the asserting authority recorded, and how do they differ? provenance
5. What happens to a pending proposal when a competing proposal over the same endpoint pair is recorded before any decision is taken? state

Evidence submission bound to a proposal version

The submit-evidence command appends an evidence item to a named proposal version rather than to the assertion as a whole, so a decision can be traced to exactly the material available when it was taken. Evidence items are immutable: a mistaken attachment is corrected by appending a withdrawal record, never by editing or removing the original entry.

1. How is a submitted evidence item bound to a specific proposal version rather than to the assertion as a whole? evidence
2. Which provenance attributes must accompany an evidence item for it to count toward the required-evidence check? provenance
3. Can an evidence item be withdrawn, and what record remains if the underlying material must be removed? retention
4. How is restricted or confidential evidence declared so the decision record stays readable when the evidence itself is not? access
5. Which command corrects an evidence item that was attached to the wrong proposal version? constraint

Approve and reject decision assertions

An approve or reject command appends a decision assertion naming the decided proposal version, the validation report relied on, the deciding authority reference, the decision outcome and reason code, and both decision event time and register observation time. Decision assertions are immutable; a reversal is expressed by appending a later decision or a retraction, never by editing the earlier record. The register records that a decision was made by a named authority; it does not determine whether that authority was competent to make it.

1. What does an approve or reject decision assertion record, and what does it deliberately not record? decision
2. How is the deciding authority referenced without this model determining whether that authority was competent to decide? authority
3. Why can a recorded decision never be edited, and how is a reversal expressed instead? constraint
4. How is a decision bound to the exact proposal version and validation report it relied on? provenance
5. How is a decision taken under delegated or emergency authority distinguished from an ordinary decision? classification

Activation and supersession with effective intervals

Activation makes an approved assertion version the one in force from a stated effective start, optionally until a stated end. Supersession appends a record relating a new version to the one it replaces and closes the predecessor's effective interval; the predecessor is retained and remains readable. Where two active assertions over the same endpoint pair would conflict, the register records the conflict and the supersession that resolves it, and does not attempt to decide the truth of either.

1. Which event marks an assertion as active, and what is recorded at that moment? event
2. How is the effective interval of an activation set, and what happens when it overlaps an existing active interval for the same endpoint pair? temporal
3. When two active assertions conflict, which one is superseded and by what recorded rule? relationship
4. How does supersession relate a new assertion version to the one it replaces without removing the replaced record? lifecycle
5. Which downstream systems learn of an activation, and who owns delivering that signal? ownership

Retraction, emergency quarantine and compensating records

Retraction records that an assertion previously in force is withdrawn by its asserting or deciding authority, closing its effective interval and marking it invalidated without removing it. Emergency quarantine marks an assertion as not to be relied upon pending review, and may be applied before or after a decision. When a command applies only partially, the register derives a compensating record set that restores a consistent state by appending counter-records; it never rewrites or deletes what was already appended.

1. What exactly does a retract command assert about an assertion that was previously in force? definition
2. Under what emergency conditions may an assertion be quarantined before a decision, and who may lift the hold? exception
3. When a command applies only partially, which compensating records are appended to restore a consistent state? process
4. What is retained after retraction or quarantine, and which model executes any physical erasure? retention
5. How is a retracted or quarantined assertion represented to readers so it is not silently missing from results? access

Explicit Query Parameter Set and Declared Capability

An alias read, resolution or traversal is meaningful only when relation kinds, direction, hop limit, maximum allowed strength loss, declared context, as-of instants, access scope and dataset or authority scope are explicit, and only when the answering service has published which of these it supports and with what hard limits. Every applied parameter, including service defaults, is echoed in the result.

1. Which request parameters must be supplied explicitly, and which have service defaults that must be echoed back in the result? requirement
2. How does the answering service publish its supported relation kinds, entailment stance, temporal coverage and hard hop and result limits before a request is built? interoperability
3. Which dataset, graph or authority scope was actually used to answer, and does a protocol-level scope override a scope embedded in the request? constraint
4. What makes a request malformed or refused, and how is that outcome distinguished from a well-formed request that returns no candidates? validation
5. How is a request record identified so that its result can be replayed later and compared with an earlier answer? identity

Access Scope Carried Into a Query

Every alias query carries an access scope reference and, where one exists, a reference to an externally produced access decision. The model binds those references to the request and to the disclosure statement and signals that content was withheld, but the decision itself and its enforcement are produced elsewhere. An Indeterminate or unavailable decision is treated as deny and reported as not answerable in scope, never as an absence of equivalence.

1. Which access scope, subject attributes and external decision reference were bound to this particular request? access
2. How does a result signal that candidates or evidence exist but were withheld, without revealing what was withheld? privacy
3. What does the query surface return when the external access decision is Indeterminate, NotApplicable or unavailable? exception
4. Who owns the policy that produced the decision, and where is that policy resolvable for review? ownership

Candidate Set Result Without Canonical Selection

Resolution returns the complete admitted candidate set with the supporting path and per-edge provenance for each candidate, plus an explicit answer state. The service never collapses the set to one preferred identifier. Where an authority publishes its own canonical or preferred identifier, that is carried as an attributed claim of that authority, not as a selection made by the query surface.

1. What is returned when several mutually inconsistent candidates satisfy the request, and how is that ambiguity state distinguished from a single-candidate answer? decision
2. How is no equivalent asserted distinguished from not answerable within the requested scope? exception
3. When an authority publishes its own canonical identifier for a subject, how is that recorded without the query surface adopting it? authority
4. Is the ordering of candidates meaningful, and which ordering key and tie-breaking rule were disclosed? quality

Relation Semantics and Entailment Stance of an Answer

Each answer declares the relation-kind semantics applied, including symmetry, transitivity and disjointness per kind, and the entailment stance under which it was computed. Every returned edge is labelled asserted or derived, derived edges exist only for the duration of the answer, and inconsistency detected under the requested stance is reported rather than resolved.

1. Under which entailment regime or closure rules was this answer computed, and was that regime requested by the caller or applied as a service default? classification
2. How is an asserted edge distinguished from an edge derived by symmetry or transitivity within a returned path? provenance
3. Which relation kinds in this answer are transitive, symmetric or mutually disjoint, and from which declaration is that sourced? definition
4. What is returned when the requested stance finds the underlying assertions inconsistent, for example an exact match that is also asserted as a not-same pair? exception

As-Of Read With Separate Assertion and Record Time

A read may be requested at an as-of instant on the assertion validity timeline, on the record or observation timeline, or on both. The answer reports which instants were used and on which timeline, whether the served state is an exact or nearest-preceding match, the interval that state covers, which lifecycle states were admitted, and whether any endpoint or evidence reference is stale or invalidated as at those instants.

1. Which as-of instants were supplied, on which timeline does each apply, and in which offset were they interpreted? temporal
2. Was the served assertion state an exact match for the requested instant or the nearest preceding state, and which interval does that state cover? measurement
3. How is an endpoint or evidence reference flagged as stale, unresolvable or invalidated as at the as-of instant? state
4. Which assertion lifecycle states are admitted by default at an as-of instant, and how is a retraction distinguished from a deletion? lifecycle
5. What must be recorded so that the same as-of query returns the same answer when it is run again later? evidence

Path Enumeration, Cycles and Truncation

Traversal returns every candidate path satisfying the request within the hop and result limits, in a cycle-safe way that neither loops nor drops genuine paths, and states explicitly whether the enumeration is complete, truncated by a limit, or truncated because a source was unreachable. Asymmetric relation kinds keep their direction on every returned path.

1. Is the returned path list complete for the requested parameters, and if not, which limit or failure truncated it? constraint
2. How are cycles detected and reported so that traversal terminates without duplicating or discarding a genuine path? process
3. How can a caller continue a truncated traversal deterministically without re-running the entire request? interoperability
4. What provenance must accompany each individual edge on each returned path? provenance
5. How is direction handled for asymmetric relation kinds such as broader or narrower match when traversal is requested in both directions? relationship

Strength Loss Budget and Contradictory Edges

A path carries a composed strength derived from per-edge confidence and relation-kind semantics under a declared, versioned composition method. Paths exceeding the requested maximum strength loss are excluded with a stated reason rather than dropped. A path crossing an asserted not-same pair, or combining relation kinds declared disjoint, is reported as contradicted and is never silently removed from the answer.

1. Which composition method converted per-edge confidence into a path strength, and is it presented as a declared measurement rather than a truth claim? measurement
2. How was the maximum allowed strength loss applied, and are excluded paths reported together with the reason for exclusion? constraint
3. How is a path that crosses an asserted not-same pair or a disjoint relation-kind combination reported to the caller? exception
4. How is strength composed across a path that mixes relation kinds with different transitivity guarantees? quality

Non-Adjudicating Comparison of Competing Assertions

Given two or more assertions about the same endpoint pair or the same candidate, the comparison reports how they differ across asserting authority, relation semantics, confidence, declared context, temporal validity, evidence and lifecycle state, and identifies which dimensions were unavailable. It does not rank authorities, does not declare a winner, and separates verification of an assertion's integrity from any decision to rely on it.

1. Along which dimensions were the assertions compared, and which of those dimensions were unavailable for at least one of them? composition
2. How is a difference in asserting authority represented without implying a precedence order between those authorities? authority
3. How are two assertions that hold in different declared contexts reported, given that neither refutes the other? classification
4. What evidence reference and verification state are shown for each assertion, and is verification kept separate from acceptance of the claim? evidence
5. Which outcome vocabulary is used when the comparison cannot be settled from the recorded facts alone? state

Result Integrity and Disclosure Statement

Every answer is accompanied by a statement of what was and was not reachable: sources consulted, skipped, refused or failed, and whether a failure was silenced or hard; limits reached; access-suppressed candidates or evidence; unresolvable endpoints; and the request-validation outcome with severities. Absence of an answer is never presented as evidence of non-equivalence.

1. Which sources were consulted, which failed or were skipped, and was a failure treated as silent or as a hard error? process
2. How does the statement separate nothing asserted, withheld by access scope, and source unavailable? security
3. Which request-validation results, severities and focus parameters are returned to the caller? validation
4. For how long are a result and its disclosure statement retained for replay and dispute handling, and who owns the disposition decision? retention

Conflict class taxonomy over alias assertions

The governed set of conflict classes a report may state over an alias assertion set: incompatible asserting authorities over the same endpoint pair; incompatible equivalence strength or semantics; divergent confidence or assurance; mismatched context of assertion; temporal incompatibility between validity intervals; conflicting or absent evidence; violation of an explicit not-same constraint; and incompatible lifecycle states. Each class is defined by what makes two claims incompatible rather than merely different, and by the comparison that detects it. The taxonomy is extensible by an adopting Dimension through namespaced codes but the base classes are fixed so that consumers can rely on them.

1. Which conflict classes may a conflict report state over an alias assertion set, and how is each class defined? classification
2. How does a report distinguish a formal not-same violation from a mere disagreement about equivalence strength? constraint
3. What makes two competing assertions genuinely conflicting rather than merely scoped to different contexts? definition
4. Which conflict classes become detectable only when validity intervals or observation times are compared? temporal
5. How may an adopting Dimension extend the conflict class vocabulary without breaking existing report consumers? interoperability

Conflict report request scope, preconditions and failure modes

The bounded request contract that makes a conflict report reproducible and honest about its own limits: which assertion population is in scope, which preconditions must hold before a report can be produced, which failure mode applies when each precondition is unmet, how partial coverage is declared when a participating authority is unreachable, and which observation cut-off time governs the whole report.

1. What scope selector defines the assertion population that a conflict report covers? composition
2. Which preconditions must hold before a conflict report can be produced, and which failure mode applies when each is unmet? requirement
3. How does a report record partial coverage when a participating authority is unreachable at production time? exception
4. Which observation cut-off time governs the report, and how is it kept distinct from the event times of the assertions it covers? temporal

Individual conflict result record

The atomic unit of a conflict report: a single stated incompatibility naming its participating assertions, the identifier endpoints and asserting authorities involved, the conflict class, an optional severity or significance grade, a human-readable message and the evidence and comparison basis that lets a consumer re-derive the finding. The record grades significance but decides nothing: it never marks a participant as correct, never removes a participant and never changes any assertion's lifecycle state.

1. What identifies a single conflict result within a report, and is that identity stable when the report is reissued? identity
2. Which participating assertions, asserting authorities and identifier endpoints must every conflict result cite? relationship
3. What severity or significance grade may a conflict result carry, and what does that grade explicitly not decide? decision
4. What evidence and comparison basis must be cited so a consumer can independently re-derive the stated conflict? evidence

Non-adjudication and minority-claim preservation

The rules that keep a conflict report honest: every participating claim that falls inside the declared scope appears in the report regardless of its authority weight or confidence, any ordering presented is labelled with its basis and marked as presentational rather than resolutive, exclusion by scope is disclosed and distinguished from exclusion by judgement, and the party or model accountable for any downstream adjudication is named by reference rather than acted for.

1. Which rules prevent a conflict report from dropping, collapsing or down-weighting a minority or low-confidence claim out of view? constraint
2. How is an authority-weighted or confidence-weighted ordering presented so that it cannot be read as a resolution? quality
3. How does a report disclose that a claim was excluded by scope rather than by judgement about its merit? provenance
4. Who is recorded as accountable for the adjudication that the report deliberately leaves open? ownership

Impact trigger event classification

The classified change events that warrant an impact report: supersession of an assertion by a later one; retraction or withdrawal of an assertion by its authority; merge of two endpoint clusters into one; split of a cluster into two or more; a policy change that alters which equivalence strengths or confidence levels are admissible; and discovery that a previously accepted strong-identity assertion was false. Retraction and supersession are kept apart because their retrospective reach differs: supersession leaves the prior claim historically true within its interval, retraction asserts it was never sound.

1. Which change events trigger an impact report, and how is each event class defined? event
2. How is a retraction distinguished from a supersession in impact terms? lifecycle
3. When a strong-identity assertion is later found false, what retrospective scope must the impact report cover? exception
4. How is a policy change that alters admissible equivalence strength or confidence represented as an impact trigger? authority

Impact surfaces, lineage and residual uncertainty

Impact is projected across three surfaces with distinct units. At assertion level the unit is a single alias assertion whose admissibility, strength or lifecycle relevance changes. At cluster-view level the unit is a derived endpoint cluster that gains, loses, merges or splits members, and the fate of each member must be stated. At downstream-reference level the unit is a consuming reference that resolved through the changed alias. Every impacted item carries lineage back to the triggering change and to its prior state, and the report states the residual uncertainty where downstream reach cannot be fully enumerated rather than implying complete coverage.

1. Which impact surfaces must an impact report cover, and what is the unit of impact on each? composition
2. What lineage must be attached so a consumer can trace an impacted item back to the triggering change and to its prior state? provenance
3. How does the report represent a cluster that splits into two or more clusters, including the fate of every member? state
4. How is residual uncertainty expressed when downstream reference reach cannot be fully enumerated? measurement
5. Which downstream references are knowable to this model, and which are knowable only to the consuming system? interoperability

Disposition readiness status classification

Every alias mapping record in scope receives exactly one readiness status: eligible (a cited retention rule has run and no block applies); blocked (a cited legal hold, litigation hold or records freeze suspends disposition until the issuing authority formally releases it); retained (the record must persist as a tombstone or provenance residue even after content disposal); externally governed (disposition authority sits with a source authority or jurisdiction outside the adopting Dimension); or not assessed (readiness could not be determined within the report's observation window). Each status must cite its basis; a status is a finding about the record, never an instruction that disposal may proceed.

1. Which disposition-readiness statuses can be reported for an alias mapping record, and how is each defined? classification
2. What must be cited for a blocked status, and which external authority issued the block? authority
3. Which retention rule or schedule reference makes a record eligible, and where is that rule owned? retention
4. How is a record whose disposition authority sits in another jurisdiction or with a source authority reported? spatial
5. What is reported when readiness cannot be determined within the report's observation window? state

Required residue and execution handoff

What must survive an authorised disposition of an alias mapping record, why, and who acts. A tombstone retains only control metadata - the record identifier, its former type, the deletion time, the superseded-by or successor link and the disposition reference - so that dangling downstream references resolve to an explanatory marker rather than to nothing, while all alias content and any personal data are removed. The finding also fixes the handoff: which external model or adopting-Dimension policy executes disposition, and what the readiness report must contain so that executor need not re-derive scope.

1. Which fragments of a disposed alias mapping record must survive as tombstone or provenance residue, and on what basis? retention
2. Which external model or adopting-Dimension policy executes the disposition that this report only declares readiness for? ownership
3. What must a readiness report contain so the executing authority can act without re-deriving scope? process
4. How is a residue record prevented from re-identifying a subject after erasure of personal data? privacy

Report instance identity, provenance, access scope and notification content

A report instance is an immutable, identified, provenance-bearing object belonging to a named series. It carries its generation time, the observation cut-off, the covered event-time range and the input snapshot ingestion time as separate values; corrections are issued as new instances linked to their predecessor by a revision relation, never by editing a released instance. Provenance records the generating agent, the frozen scope binding and the input snapshot so the instance is reproducible. Each section carries an access scope and any redaction applied before release. Where a change must be communicated, this model composes notification content describing the change and pointing at the released instance; discovery of an inbox, delivery, storage, receipt acknowledgement, retry and escalation belong entirely to the notification service.

1. What identifies a report instance, how does it relate to its series, and how is a corrected instance linked to the one it replaces? identity
2. Which distinct times must a report instance carry, and how are event, observation and ingestion times kept separate? temporal
3. What provenance must be recorded so that a report instance can be reproduced from the same inputs? provenance
4. Which access scope applies to each report section, and what redaction must be applied before release to a given audience? access
5. What notification content may this model produce for a reported change, and where does responsibility for delivery begin? interoperability

Projection target capability profile

A named, versioned declaration of what a projection target (Git/file template, Markdown, HTML, JSON, YAML, CSV, an RDF serialization, an HTTP API, an MCP resource, a MongoDB collection, or an HTTP redirect/canonical surface) can express: which relation strengths it can carry, which qualifiers have native slots, which identifier form it requires, what cardinality and ordering it guarantees, and which specification defines its metadata and typing mechanism. Nothing may be projected into a target that has no resolvable profile.

1. What does a projection target profile declare, and what is the smallest set of capabilities a target must expose before an alias assertion may be projected into it? definition
2. How is a target profile identified and versioned so that a released projection can be traced to the exact profile that governed it? identity
3. Which capability class does the target fall into: full-fidelity, lossy-but-qualified, or preference-only? classification
4. Which external specification defines the target's metadata and typing mechanism, and which version of it does the profile bind to? interoperability

Web-preference projections: redirect, canonical link, HTML and RDF links

Binding rules for rendering alias assertions onto HTTP 3xx redirection, the canonical link relation, HTML link markup and RDF link predicates. These surfaces express routing or editorial preference, not identity: 301 and 308 assign a new permanent URI, 303 explicitly points at a different resource, and rel=canonical designates a preferred IRI whose content is duplicative of or a superset of the context IRI. RFC 8288 additionally forbids inferring further semantics from a relation type's presence, absence or cardinality. Output is an advisory map handed to the serving infrastructure.

1. Which HTTP status code or link relation may a given recorded strength be projected onto, and which projections are forbidden for that strength? relationship
2. What travels with a projected 301, 308 or canonical link to stop a consumer reading it as strict identity? constraint
3. How is the direction of a web projection determined when the underlying assertion is recorded as symmetric? classification
4. Under what conditions must a web projection be withheld even though the underlying assertion is publishable? exception
5. Who owns the infrastructure that would actually emit the redirect or canonical link, and what exactly is handed to them? authority

Record, document, interface and database bindings

Binding parameters for projecting assertions into structured records: JSON and YAML documents, CSV rows under a CSVW metadata description, HTTP API payloads, MCP resources with uri, name, mimeType and text or blob contents, and MongoDB documents in canonical or relaxed Extended JSON. Covers identifier conversion, cardinality flattening of multi-valued qualifiers, and type fidelity, including the Int32/Int64/Double collapse in relaxed Extended JSON and YAML implicit tag resolution. A database view, secondary key or YAML anchor is a storage or serialization convenience with no assertional force.

1. How is a multi-qualifier assertion decomposed into the target's record structure, and which container carries qualifiers that have no native slot? composition
2. Which identifier form does the target require, and what is the reversible conversion rule from the assertion's identifier to that form? interoperability
3. Which numeric, temporal or typed values lose fidelity in the chosen serialization mode, and what tolerance is declared? quality
4. Why must a YAML anchor, a database view or a secondary key never be exported or read back as an alias assertion? constraint

Deterministic serialization and content digest

Rules producing byte-stable output so that two exports of the same assertion set are comparable and digestible: JCS for JSON-family output, RDFC-1.0 canonical N-Quads for RDF datasets, explicit row and column ordering with normalized quoting for tabular output, and fixed UTF-8 encoding with fixed line endings for Git, Markdown and HTML templates. YAML anchors, aliases and implicit tag resolution are suppressed because they are discarded on composition. The resulting digest is recorded as an integrity qualifier using a registered algorithm; it detects corruption, is not proof of authenticity or truth, and is never the artifact's identifier.

1. Which canonicalization algorithm applies to each target format, and in what order are canonicalization, digesting and any signature applied? process
2. What digest algorithm and value are recorded for the produced projection, and over which byte range? measurement
3. Which format features must be suppressed to keep output byte-stable, and what is emitted in their place? constraint
4. How can a reviewer establish that a stored projection corresponds to the assertion set it claims to represent? evidence

Schema, version and provenance self-description

Every projection carries a self-description block: the dialect or context identifier appropriate to the target ($schema for JSON-family output, @context for JSON-LD, a CSVW metadata descriptor for tabular data, mimeType and annotations for MCP resources, front matter for Git templates), the model version, the target-profile version, the strength-mapping-table version, and provenance stamps naming the producing agent and the derivation from the source assertion set. All times are RFC 3339 values with seconds and an explicit offset, and the assertion's event time is kept distinct from the export generation time and any later observation time.

1. Which agent, activity and source assertion set produced this projection, and how is that derivation expressed inside the target? provenance
2. Which distinct time points are recorded on a projection, and how are they kept apart from the assertion's own event time? temporal
3. What is the minimum self-description a projection must carry to be interpretable without out-of-band knowledge? requirement
4. How is a superseded projection marked so that consumers stop treating it as current? lifecycle

Relation-strength mapping and the non-upgrade invariant

A governed table binding each recorded strength to the strongest construct each target may use, under a hard invariant: a projection may weaken, annotate or omit, never strengthen. SameIndividual and owl:sameAs assert individual equality and are permitted only where a competent authority recorded strict identity. skos:exactMatch is transitive and a sub-property of skos:closeMatch, while skos:closeMatch is symmetric and deliberately non-transitive, so a chain of close matches must never be projected as exact matches. schema.org sameAs is defined as the URL of a reference page indicating identity, not as an identity axiom. Confidence values, evidence records, cluster membership, canonical preference and redirect targets remain qualifiers; crossing a confidence threshold is not an upgrade.

1. Which target construct is the strongest permissible expression of each recorded strength, per target profile? classification
2. Which candidate projections would strengthen a relation, and by what mechanism is each blocked? constraint
3. How are confidence, evidence and cluster membership represented in a target that offers no qualifier slot? relationship
4. Who may approve a change to the strength-mapping table, and on what evidence? decision
5. What check demonstrates that no emitted triple, row or field exceeds the recorded strength? validation

Machine-readable projection-loss report

Every projection emits a loss report enumerating, as typed entries: omitted qualifiers, unsupported relation kinds together with the substitute construct used, cardinality changes such as multi-valued qualifiers flattened to one column, identifier conversions and their reversibility, hidden evidence present in the source but invisible in the target, ordering changes, and non-round-trippable fields. The report follows the SHACL validation-report shape: a top-level conformance or fidelity verdict plus a list of entries each carrying a focus reference, a path, a component identifier and a severity. An empty report is a positive claim of losslessness for the declared profile, not the absence of a report.

1. What is the complete entry taxonomy of a projection-loss report, and what does each entry type assert? definition
2. How is a loss entry addressed so a consumer can point at exactly the assertion, field and target construct concerned? identity
3. Which counts and severities summarise a report, and what makes a projection lossless for a given profile? measurement
4. How does the report disclose evidence and confidence that exist in the source but are invisible in the target? evidence
5. Which parts of a loss report may be published alongside the projection, and which must remain internal? access

Import round-trip verification and fidelity classification

Re-importing a projection and comparing the reconstructed assertion set with the source through the same canonical form and digest. Results are classified as byte-identical, semantically equivalent, weakened as declared, or divergent. Declared loss already listed in the loss report is reconciled and discounted; anything else is undeclared loss and is a defect. Round-trip never repairs strength: a re-imported close match is not evidence that the source was strict identity, and compaction in linked-data or relaxed database modes may legitimately fail to reconstruct the original form.

1. What is the comparison procedure, and which canonical form is compared at each step? process
2. Which fidelity states may a round-trip result take, and what distinguishes them? state
3. How is undeclared loss distinguished from declared loss, and what is the disposition of each? quality
4. Which times are recorded for a round-trip, and how do they relate to export and assertion times? temporal

Partial projection and refusal when safe weakening is impossible

When a target cannot express any construct at or below the recorded strength without misrepresenting it, the correct outcome is partial projection of the safely representable subset, or refusal. Typical triggers: a target whose only equivalence construct asserts individual equality while the assertion is a graded close match; a redirect surface that would imply permanent replacement for a merely preferred alias; a canonical link whose asymmetry contradicts a symmetric assertion; or an access label barring emission. The outcome is a calculated recommendation with reasons. It does not enforce anything: the adopting Dimension decides, executes and records any override.

1. What conditions make safe weakening impossible for a given assertion and target, and what recommendation follows? exception
2. When a projection is partial, which subset is emitted, and how is the omitted remainder declared? composition
3. Who may override a refusal recommendation, and what must the override record contain? authority
4. What must a consumer be told so that a partial projection is not mistaken for a complete set of aliases? requirement