# Verified archive repair model

## Diagnosis

Fixed status/reason with all mutation/native/publication grants false. Private source integrity facts do not appear in public output; omit paths, hashes, members and metadata. Status distinguishes repair candidate, decoder verification, conversion and retained review.

## Exceptional source witness

Exact source path/full nine-field signature/SHA-256, captured malformed entry, closed envelope, every local/central header commitment, complete virtual inventory and root metadata digests. Only the trusted owning producer captures it from current bytes. Caller JSON or historical diagnosis cannot mint it.

## Immutable preparation

Version/kind, current exact owner, full catalog/correction census, writer/thread/root, source witness, distinct preservation/restore custody, staged derivative signature/hash, complete preservation evidence and immutable intent digest. Preparation is non-executable. Same bytes at a changed inode/mode invalidate original physical facts.

## Owned transition and terminal record

A dedicated native typed consumer joins current preparation, allowed owner/correction policy, reader continuity and durable custody under Writer. Exceptional inventory applies only to that captured original. Exact finite predecessors bind prepared/uncertain/accepted/rollback phases. Unknown or mixed state retains evidence and cannot replay or fabricate completion.

## Prospective NFS selection and phase records

Plan13's private common-root geometry binds three original directory references:
common root, scanned library and outside-library retention. Each reference has a
canonical path and original full signature; held descriptors retain the three
physical nodes. The common root's original signature and exact two-child census
remain unchanged. Actual child mount ID, export and device join source and
retention before the one-use typed selection is consumed. Serialized facts alone
cannot reconstruct that selection or stopped-reader custody.

The sealed adoption capability includes its selected publication protocol and
original geometry. A version 2 baseline records these facts; legacy version 1
retains its exact exchange schema. Each of six forward or reverse transitions
has a durable intent and completion with original inode locations and finite
link counts. Unknown outcomes retain pending state and both revisions; phase
records supply no replay or reader-resume permission.

Private request version 2 selects forward or rollback only with plan13/action
input version 3. Explicit rollback consumes the same successfully installed live
capability. It cannot recover an uncertain capability from a saved receipt.