Gridoc model identity and versions

This is development documentation for the Grid 0.71 line. The management workspace shows the operations supported by the active model owner. Platform, storage, and commercial capabilities can limit which operations are available.

A Model ID identifies a logical model. A File ID identifies a bound file instance. Copying a file with the operating system duplicates its contents but does not authorize another model writer or duplicate its execution grants. Grid compares the observed File ID with authenticated saved custody before activation. A mismatch keeps the model locked until an authorized actor resolves the exact inspected file and records an explanation.

Operation	Identity and history
Copy	Preserves Model ID and records new file ancestry.
Fork	Creates a new Model ID and records the parent model revision and file ancestry.
Move	Continues the model through an authorized file ownership transaction.
Recover	Resolves an inspected identity mismatch under the original owner's authority.
Version	Names an immutable program revision within the model's history.

An operating-system rename can preserve File ID. Grid's explicit Move records an authenticated transfer. Ancestry records when Grid observed and authorized the relationship; it cannot infer the time an operating-system copy happened.

Receiving Move can select a canonical archive destination outside its document directory. The native model and accounting stay with the same owner; this moves the saved file rather than importing the model into another active document.

Version labels describe program revisions. Local input and state checkpoints have their own history. An update must establish compatibility with those values and the current execution authority; a newer label alone is insufficient.

Automatic upgrades require a verified publisher, an allowed channel and version range, and explicit consent. Compatible updates can run at next open through the existing native compiler and runtime. Conflicts and unsupported migrations require review. Signed, retained update data supports disconnected planning; enabling updates does not start background polling.

Encrypted saved files require their independent archive password. With explicit automatic-upgrade consent, the native host can retain the proven archive key for the current process session and use it again at next open. Disabling updates evicts it. Session-only consent requires another explicit unlock after process restart. A selected macOS native capability now implements explicit rememberArchiveKey consent backed by device-local Keychain custody. When the active native owner supports it, Remember this file key on this Mac appears when enabling automatic upgrades. It starts unchecked; enabling it requires the file password. A remembered-consent status does not guarantee that the stored key is present or accessible. Packaging explicitly selects this capability for macOS and embeds an authorized profile in the native host's own signed wrapper. Live signed-host access and restart behavior remain unverified. Missing or inaccessible custody requires an explicit unlock. The key is never stored in the gridoc, command receipt or update registry. Unlocking the containing document does not provide the archive key. Grant accounting stays with its original owner throughout copying, recovery, version publication, and upgrade.

Commercial recovery is explicitly selected by the native launcher and uses the existing local grant owner. Initial-file recovery does not require contacting the issuer or create credits. After authenticated recovery, Desktop admits the same execution owner, completes its durable publication and exposes the completed model for reading. Reopening an unchanged completed file reads that same committed output without evaluating or spending again. An interrupted terminal publication resumes its retained transaction before admission. Changing the File ID of an already evaluated commercial model remains unsupported and locked, as do transfers to a different accounting owner. A copied gridoc alone cannot authorize execution or duplicate a finite allowance.

Use the explicit lifecycle actions described above to inspect identity and review each version before applying an update.

Saving and portable recovery

Saved working changes and the last portable archive have separate revisions. Local Save does not wait for remote backup availability. A restored archive contains the state captured by its storage owners; copying files alone cannot make separately changing data a coherent checkpoint.

Supported document operations carry their declared model data and references. Private credentials, file custody and undo history do not become portable authority. Restored mail and other external effects remain inactive until their own owners authorize them. An uncertain write acknowledgement must be reconciled before retry; it is never permission to repeat an external effect.

The V3 source now shares publication and document-participation support without changing existing archive formats. Availability still depends on the active storage owners. Collection and energy portability and broad whole-document copy remain limited to their existing supported operations; unsupported content is refused. The local document recovery pilot passes; broader concurrent-capture, performance and native cross-platform verification remain in progress.

Inherited parts in V3 development

Local manual comparison and resolution

The local SCM workflow compares saved definitions: the parent revision last accepted by each selected part, the child's current definitions, and the selected parent revision. Editing or saving a parent does not change the child. An explicit Apply creates a new child revision through the existing native update operation. Unselected parts retain their accepted revisions.

Grid 0.75.0 desktop and Linux server packaging includes local Lineage for native model files. Updates remain explicit operations on saved revisions.

For example, a parent originally defines Total = Rate * 2. The child has a permitted override Total = Rate * 3; the saved parent now defines Total = Rate * 4. The comparison reports a conflict. Keep child retains Rate * 3 against the new parent baseline. Take parent removes that override and uses Rate * 4. A custom replacement supplies a complete definition, such as Total = Rate * 4 + 5, for native compilation and dependency checking.

Comparison reads retained compiler definitions, including named rules and functions. It does not compare or copy live runtime values. The native operation rechecks child/source revisions, state compatibility and permissions before committing. A stale review or incompatible definition leaves the child unchanged; an uncertain response must be reconciled by retrying the exact operation.

A custom definition can also create a child override for an inherited member, even at the already accepted parent revision. The current source owner must still permit that replacement. Source PART additions, removals and import changes require separate explicit acceptance of the displayed interface. Removing an overridden member requires accepting its removal. Dependencies are checked against the complete selected composition: select required imported parts at compatible exact source revisions, or the update refuses without changing the child. It never advances a dependency implicitly. The resulting declarations and replacement ledger survive Save/reopen, including after partial detachment.

Pinned/shared parts cannot advance in this manual review. Live delivery between models, shared captures, remote authorities and Loro remain deferred. The approved local edits R2 view is available in native file tools, including override creation and explicit membership/import acceptance.

Existing selected next-open behavior

Selected V3 source can bind signed next-open consent to the authored child, exact upstream identity, pins and existing replacements. Only inherited parts explicitly declaring update: "compatible" can follow upstream. Manual parts and exact pins stay fixed; changed override bases and unavailable current source owners require review. Declarations and metadata do not grant source access or execution rights. No background polling is started.

This integration remains under development. Selected native library checks and a real saved registry next-open journey pass on V3; broader profiles, platforms, owner integrations and performance remain unverified. The canonical declaration example is inherited-compatible-child.grid. It requires the actual native parent composition owner and separate explicit consent; it is not a standalone runnable program.

Selected native V3 authoring now detaches inherited or pinned parts under the actual ordinary same-document source and child writers. The operation preserves effective permitted overrides, exact remaining pins, continuing identity and private native state. Full detachment clears source-following consent, policy, version range and publication origin. Partial detachment invalidates the old signed scope. Renewed consent now requires genuine saved compiler replay under actual child custody before the host signs its new scope. Compatible upstream updates then run through the existing explicit update or next-open owner, with exact unselected pins, permitted unchanged-base overrides and native state preserved. A changed override base or detached import baseline requires review; out-of-range updates and revoked consent do not fall back to weaker authority. This is a selected native API, with no new UI action.

Saved replay authenticates the exact former child publication, artifact, dependencies and custody history, reconstructs the private effective interface through the compiler, and compares the exact native input and executable. Chained partial-to-full detachment reopens through the same local/nonlocal compiled-model owners. A decoded graph or correct outer signature cannot replace that proof.

Commit uses the existing Original transaction, complete retained preimage, archive writer and recovery fence. An exact retry resolves its original receipt. Missing or substituted preimages keep the fence until restored and verified. The raw all-local loader still refuses transformed artifacts; foreign, commercial and multiple-source owners remain unsupported here.

Selected saved transformed Copy/Fork/Move now use genuine retained compiler proof and complete native state through the existing creation, archive and Original owners. Copy preserves Model ID; Fork records its exact former transformed publication and creates a new Model ID. Both create independent continuing instances and clear source-following consent. Move preserves the continuing instance and consent. Cold replay never parses the inspection text.

Partially and fully detached document Copy and inspected physical-copy import use genuine Nonlocal or Local compiler proof through the existing frozen document recovery owner; subsequent receiving Copy/Fork/Move borrow the actual authenticated membership roster and source-intent writer. Receiving Save retains committed birth history through an opaque historical export proof captured before preparing its new custody image; a planned identity cannot attest its own birth. Exact Save retries reuse the receipt. This internal integration does not enable an unreviewed picker or bypass binding challenges. The partial transformed owner reconstructs exact signed saved ancestry and preserves unselected historical pins; inspection text supplies no compiler proof, File ID, membership or execution rights. Ordinary non-transformed inherited document imports keep their separate owner guard.

A selected named Fork can resolve a copied transformed archive's authenticated challenge. The actual pending archive reader supplies immutable captured bytes; historical lineage authenticates ancestry without installing the former instance or granting its rights. The new Fork gets a new Model ID and continuing instance, clears source-following consent and uses the existing native creation/Original writer. General metadata adoption and unnamed resolution keep their guards.

Selected receiving Upgrade and checked retained Restore reconstruct genuine historical Local/Nonlocal compiler proof. Upgrade readiness and commit share the same native state migration; signed activation, complete retained state, current membership and the source-intent recovery writer remain mandatory. A transformed child can also supply an inherited source publication through the existing native publication owner. Cold replay uses exact saved artifacts and dependencies; inspection text is never executable source. Unsupported cross-lane upgrades, foreign/commercial/resource owners, picker activation, other platforms and numerical Performance remain separate work. The effective detachment scenario separates the compiler examples from the owning native journeys. This development work does not establish complete Model Lineage support or a released feature.

Selected native development also has an explicit same-document PART capture operation. It applies a complete group to existing declared inputs through the normal native input writer, retaining values and provenance in the same durable commit. Cold restart, exact retry and terminal unbind retain the original operation and captured values. An interrupted committed application recovers from the existing document WAL. The producer and receiving writer must hold actual current saved custody; inspection metadata supplies no permission.

A wholly local source can calculate its exported PART using explicit imports of other local PARTs. The capture includes only the exported members' values. The source's supporting calculations stay at the producer, and similarly named private inputs in the child remain independent.

A saved composed producer uses its authenticated retained inputs for this same capture, including inherited, pinned, shared and detached exports. It evaluates the values in its own resident model. The receiver gets neither the producer's supporting definitions nor permission to contact its ancestors. Current producer/receiver custody and accepted-capture checks still apply; remote rights and specialized source settlement remain separate.

Selected native publication can use an accepted capture to create read-only duplicate:"shared" members. The capture may use differently named staging inputs; publication creates source-named shared members and keeps unrelated private inputs. The publication request identifies the original capture; its values come from the native receipt, and current custody, source epochs and target values must still match. Fresh accepted captures update those local slots through the ordinary compiled-model dependency graph. Blank captures stay blank after restart, and retrying an older operation does not roll values back. Ordinary input edits cannot write imported shared members. Publication retains the child's Original capture history. Republishing with a newly selected capture installs its accepted values even when the shared slots have older captured overrides. Later detachment keeps that new baseline, and retrying an older capture cannot restore old values. Copy and Fork preserve the values and definition provenance without copying a live capture binding. When a new target mapping overlaps an existing binding, explicitly unbind the old mapping before accepting the new group. They also preserve provenance for captures accepted after the initial shared publication. After Save and cold reopen, a same-document Copy/Fork can detach those values using the exact original source through its disclosed ancestry. The new branch has no live capture binding to unbind; the original consumer's binding and Original receipts stay with that consumer.

The selected native detach operation can turn shared members into local readonly values. Explicitly unbind every live mapping that targets those members first. It uses the latest accepted capture that matches the current slots, and preserves private inputs. Save and cold reopen retain the exact materialized values and original operation. An explicitly unbound group can still be detached when the current source and child owners permit retention.

To update a shared PART to a newer published definition, accept its current values into the declared staging inputs, then include that capture's exact operation/request digests in the manual update's captures selection. Every advanced shared PART needs its own accepted capture. The source must be a genuine descendant with the same exported interface; stale or retired captures refuse. Other shared groups keep their values and exact source revisions. Updates after partial detachment also retain the remaining shared groups through cold reopen.

This development path does not yet provide automatic refresh, remote membership/freshness or an unreviewed product control. Those owners remain guarded while their native integrations are completed.

The selected development owner reserves terminal-unbind capacity before accepting captures, including the complete saved image's byte and structural bounds. Remote receiving ownership checks and a native elapsed clock are under integration; they do not establish remote source permission or freshness on their own. Unsupported remote capture/application remains unavailable.

The selected receiving owner can authenticate the original source-signed single-export challenge with current Registry rights and its original native clock. This verifies freshness evidence only. It does not admit a remote payload or grant source disclosure, schema acceptance or durable receiving application.

Selected native reference consumers also replay their authenticated composed definitions before admitting a declared input writer. Their inspection snapshots cannot replace the calculation. Current endpoint and input rights remain required, and reference binding/capture/Original recovery use the existing owners. Readonly shared PART slots still require their separate group admission. Outstanding reference refreshes must be reconciled or explicitly unbound before inherited composition, upstream update or detachment. The staging refusal keeps the current model and exact Original request. Once terminal, the original capture or fenced outcome remains inspectable through detachment and cold reopening.

Selected Registry metadata development

Operator-selected model-lineage-registry packaging accepts GRID_MODEL_LINEAGE_REGISTRY_CONTROL_TRUST_JSON plus existing GRID_NS_* client settings at startup. The closed trust object contains registry, provider, incarnation, key_id, key_epoch and the public public_key. Request JSON cannot install trust or credentials. No polling agent starts.

Under the authenticated NativeDocument lease, refreshRegistryMetadataSession performs explicit enrollment/renewal. getRegistryMetadataSource returns current saved native Original/identity/publication/interface DATA for a deliberate report. reportRegistryMetadata, publishRegistryModelName, queryRegistryMetadata and resolveRegistryModelName use the genuine session. Reports/names retain exact Original bodies across Save/Move/reopen; the private session retains verified highwater. The provider independently authorizes each enrolled actor, identity, name and disclosure scope.

applyRegistrySelectedSharedPart takes a metadata query, explicit disclosure position and the existing shared PART request. It joins authorized selection to actual saved producer/target owners, the normal compiled model and one native values/provenance WAL. Interrupted commit recovery and exact retry retain original selection and values. Metadata grants no source or execution permission. Remote admission, automatic refresh and remote mailbox assembly remain guarded. Selected local multi-source receiving and collection names are described below. This individual-member join does not provide complete typed per-row collection materialization. These internal RPCs activate no new visual control.

After Save changes the physical binding, prepareRegistryMetadataSource explicitly certifies the current saved compiler, compiled-model and native-state image under a caller-chosen Original ID using the existing lifecycle transaction. getRegistryMetadataSource continues to refuse historical source receipts as current; certification supplies no future source, capture or writer rights.

Disconnected exchange development

The selected native scalar bridge can retain and retry an original mailbox packet and receive it into the existing durable inbox. A broker retention receipt does not mean the recipient has persisted or applied the input, and none of these facts supplies a terminal Process outcome. Direct and mailbox duplicates retain the same packet identity and acknowledgement. Unknown interrupted application requires original-owner recovery rather than replay.

Its explicit lifecycle handoff reports pending input/output, gaps, unknown application and native producer debt before Upgrade, Detachment or ownership changes. Drained withdrawal retains the caller's Original and change kind across reopen. Its request-owned scan yields in bounded pages across longer histories; pending work on an earlier page cannot disappear at the end of the scan. Concurrent participant changes require inspection again. The single-call limit remains unchanged. This internal capability adds no visual control.

The selected model-profile broker journal has local Testing coverage through the existing provider and native receiving owner, including lost replies and cold retry. Its verified patch is installed in the V3 development checkout; authenticated product-service admission remains guarded. The remote shared-source writer, terminal Process reconciliation and universal Desktop lifecycle integration retain their guards. Registry metadata supplies no execution or source-access right.

The selected native Desktop handoff now joins Copy, Fork and Move to the actual physical command/receipt owner after bounded exchange inspection. Pending inputs keep their original identities and recovery routes. Interrupted withdrawal binds the same command effect and authenticated owner across reopen; changing either refuses. An explicit exact-position mailbox continuation can inspect an original native output beyond the legacy 128-event prefix without creating a new output. Retained Process/effect store markers refuse withdrawal pending the original owner; a pure current definition cannot erase earlier custody. These are internal selected capabilities, with no new visual control or universal Desktop enrollment.

Selected pure scalar composed models now use their authenticated retained compiler inputs for exchange admission. Inspection text cannot substitute for the current executable. The same native input, incremental compiled-model and output owners apply a received value; generic byte loading still refuses composed artifacts. STATE, ONCE, functions and physical resources retain their separate admission rules.

The bounded scan also joins composition, inherited updates and detachment to their actual native publication commands. Save the current native image first. Pending work keeps recovery routes usable; after settlement, withdrawal binds the exact Original, command effect and authenticated owner. Cold command retries use the existing native receipt. Readmit current endpoints after publication; withdrawn routes do not acquire the new definition's rights. See the composed exchange scenario. Generic Upgrade/Restore, receiving callers, model network-service ingress and terminal Process/effect reconciliation remain guarded.

The selected native definition path retains compiler-classified static calls, primitive semantic type tags, STATE and ONCE in native-static-state-v1 owning records. Publication and cold replay share those selected records; historical pure publications keep their existing identities. The separate native-functions-v1 profile retains actual pure function owners and recomputes native callable contracts at composition. Additional type annotations, reference/resource owners, connector/Process effects and commercial accounting remain distinct capabilities.

The selected native-local-qualified-v1 profile also retains local sheet identity. East!R1C1 and West!R1C1 remain separate definitions through native composition, replay, update and detachment. Name each qualified member explicitly in its PART. Simple local sheet names are supported; a workbook or machine prefix still requires its separate admitted reference owner. This profile does not turn a qualified name into remote access or a live shared binding.

The separate native-shared-local-qualified-v1 profile admits captured named values such as Pricing!Price. The sheet remains part of the identity through publication, replay and detachment. Captured slots stay read-only and require the same actual source capture and group admission as unqualified slots. Two sheets can carry different values with the same member name. Workbook and machine qualifiers, cell/range captures, and live shared Tensor values remain outside this profile.

The selected native-physical-values-v1 profile retains Tensor declarations through the compiler's existing physical type owner. Shape, precision and semantic element contracts survive retained publication and reconstruction. Named input, DEFAULT and STATE values keep their current overrides when an unchanged declaration moves during composition; a changed retained physical contract refuses migration. Mutable declarations use the general compiled-model path, so Tensor promotion cannot overwrite their current values with their base formulas. Pure Tensor calculations remain eligible for the existing resident execution. Inherited updates and partial/full detachment use the same native custody, Original recovery and retry owners. This profile requires the installed Tensor runtime. It does not admit trainable parameters, pinned/device resources, Frame/image conversions or combined live shared Tensor captures. Those retain their specialized owners. See the physical definition scenario.

Selected scalar-value Lineage profiles retain date/datetime/duration literals, percentages, basis points, angles, data sizes, built-in units, currencies and exact bigint/decimal values. Exact numbers retain their native precision through capture reconstruction without a floating-point conversion. Their types survive native definition replay and accepted shared-value publication, Copy/Fork, cold reopen and detachment. Private scalar STATE and ONCE values retain their exact types and independent values through inherited publication, updates, cold reopen and detachment: an updated currency-valued STATE does not replace its earlier cached ONCE value. A local imported input with another unit is a contract conflict; Lineage does not silently convert it. Resource handles and custom unit registries still require their separate owners. This adds native capability profiles, with no new visual controls.

The selected native reference-source owner replays a saved composition from its authenticated retained compiler inputs. Its inspection text can be non-executable or differ from the effective program; it cannot replace those inputs. Actual file custody, the resident executable, the captured Original, current endpoint revision and export rights must still agree. This source check alone grants neither remote membership nor disclosure, signing, freshness or consumer write rights.

Selected native export-group development joins closed typed records to the existing source disclosure/signing and native input/WAL owners. Bounded Registry page composition retains each row's original capture and source versions, explicit pending/unavailable outcomes and the authorized continuation chain. The authored Process result profile still refuses records. Remote source/current-membership integration and defined collection names remain unavailable. Metadata or a saved collection result supplies no source-access, execution or receiving right.

The selected typed Registry export development now has 56 passing local owner checks. Verification covers a Registry-selected signed two-field capture through native input/provenance persistence, the normal compiled model and cold reopen, plus two-source provider pagination and restart. Collection results retain separate source versions and explicit unfinished rows. Process record-result issuance, durable remote admission is still guarded; metadata selection does not grant source or input access. Selected collection names are described below.

The selected native applyRegistryExportCollection RPC accepts a bounded Registry query, its disclosure position and exact retained source operations for configured consumer routes. It requires an attributed actor. Each selected row is joined to the actual native source owner and its signed Original; query metadata and serialized Ready rows cannot supply that capability. A missing source Original returns an Unavailable row and no receiving writes.

When every selected row is ready, each target independently lends its current input permission. Receiving uses the existing native values/provenance/WAL transaction and returns each original receipt. An uncertain row leaves later rows unattempted. Retry the same operations to reconcile those results; no collection-wide atomicity or new batch journal is implied. Reopening documents reconstructs the signed Originals under current source/consumer rights and native custody, preserving the original capture, timestamp and version vector. Only the owner epoch may change within this selected recovery profile; different identities, definitions, rights, keys, validity or audiences refuse.

This is explicit foreground work for the configured local native reference profile. It adds no worker, polling, timer, formula-time network access or new visual control. Remote membership/transport and Process record results retain their separate requirements.

Configured native collection requests can also pin an authorized Registry name. resolveRegistryModelName returns the existing signed resolution. A collection request supplies that name query, its exact owner and generation, and the exact collection selection it intends to use. The receiver resolves the name through the enrolled Registry owner and checks all those fields before source capture. The name must still identify a defined collection in the same disclosure scope. Absent or retired names, changed owner/generation, another target type and a different selection refuse the named request.

The returned resolvedName is signed metadata alongside the ordinary collection result. It grants no source or receiving permission. Continuations use the fixed selection from that request. A later name generation needs a deliberate new pin; reusing the same source Originals still returns their existing native receipts. Retiring a name removes that name from the authorized resolution; independently granted source/target permissions remain owned by their original authorities. Unnamed requests keep their existing result shape. This adds no new visual control, background refresh, naming store or runtime evaluator.

For a new defined-collection name, publishRegistryModelName additionally takes collection: { query, disclosure }. The exact query selection must match the name target and its requester must be the name owner. The existing enrolled query owner accepts the selection before the native transaction retains a bounded envelope containing the mutation and signed selection page. Raw name DATA cannot replace this selection loan. The ordinary saved-image and native Original requirements remain mandatory, and Registry independently authorizes the name and generation. This names a selection over known authorized metadata; it does not certify that all matching models exist, are online or were captured.

The same Original recovers its retained envelope after document reopen and submits the exact original mutation. The historical selection is provenance, not renewed disclosure or source rights. Ordinary names retain their existing frame and request representation when collection is absent. No additional journal or separate naming authority is introduced.

Original Process and grant owners during Lineage publication

The internal backbone-v3-model-handoff native entry execute_lineage_with_original_owners joins composition, upstream upgrade and partial/full detachment to the document's original Process retention, selected V3 grant database and current native fence. It borrows those writers before staging and uses the same model table manager to snapshot and reopen original Process records across native publication. It creates no grant, debit, refund, Process journal or source-access permission.

An absent or busy owner, missing native execution admission, unresolved native turn/operation or pending grant reservation refuses publication. A stopped uncertain effect must reconcile through its original owner. The old operation's scope and consumption remain unchanged when definitions change; future execution requires its own current descriptor admission. Partial detachment invalidates old source-following consent; full detachment removes it.

Selected NativeDocument wiring joins publishInheritedParts, updateInheritedParts and detachInheritedParts to the same publication entry. Funded document enrollment and detachment RPC now use their verified native owners in selected builds. Actual caller, interrupted-recovery, cold-open and RPC results are recorded in the October 17 Lineage continuation. An explicitly admitted native document retains its actual grant/Process and table owners; source JSON cannot install them. The transport keeps its compiler presentation checks, normal compiled-model readmission and uncertain-publication lease fence.

The selected Registry opener open_document_with_lineage_execution reinstalls those original owners before the existing next-open hook. Signed compatible consent still binds publisher, channel, version range, source selection and replacements. Current custody rechecks that consent under the actual writer. There is no automatic worker or polling loop. Missing native startup capability remains a refusal; archive history and consent cannot reconstruct it.

Native-reference combinations beyond the verified selected profile still require their actual combined owners. Saved Browser state and funded Process publication now share the original owners described below. Commercial Library/Solution source access and V3 execution funding remain distinct profiles. Existing protected-source, definition-family, disconnected Process-marker and remote-owner guards remain. See the funded native lifecycle scenario.

Static calls and persistent definitions

Selected native Lineage authoring retains static kernel calls, primitive type tags, STATE and ONCE through its versioned compiler definition owner. Source-free authoring and source publication produce the same canonical replay identity; existing pure publications keep their bytes. Other schedules, unknown/effectful calls, additional type annotations and resource definitions still require their own owners.

Adding a child output can move a named STATE or ONCE cell's compiler allocation. Selected migration compares the actual old and target definitions before moving private values or a cached ONCE result. Changed retained contracts, aliases, types or pending work refuse. This is a bounded publication operation; ordinary formula execution still uses the same compiled-model evaluator.

The persistent definition scenario distinguishes a cached ONCE value from a subsequently changed STATE value through composition, update and detachment. This selected native capability does not complete shared/remote Lineage, approved authoring views or platform/cost coverage.

Callable definitions

Selected Lineage publication retains functions through the compiler's owning source graph and its generated codec. Composition prepares the actual callable headers before admitting bodies, then uses the normal compiler and compiled-model runtime. A local wrapper may refer to an explicitly declared inherited function while its authoring contract is unresolved; execution requires the completed native owner.

Function replacements preserve their inferred interfaces. Retained ONCE comparison includes transitive helper implementations, so an upstream helper change cannot silently reuse a cache under a different definition. Partial and full detachment preserve the callable owners rather than emitting source text. See the native callable scenario.

Explicit rule membership

Name a rule with RULE ApplyDiscount WHEN ... THEN ... END and include ApplyDiscount in the owning PART's members. Membership is explicit: reading or writing a PART does not make an anonymous or unlisted rule part of it. Rule names identify instructions and cannot be read as cell values. Cross-PART action targets require imports, and read-only shared captures cannot become write targets.

The selected native rule profiles retain WHEN, EVERY and AT instructions through the compiler's owning graph. The child runs them through its existing compiled-model scheduler with its own permissions, timers, queue and execution accounting. Definition inheritance supplies none of the parent's live execution state.

During an admitted update, unchanged named instructions retain child state using actual compiled bindings. An action-only edit preserves trigger history, including a completed AT instruction. A changed trigger starts a new observation baseline while retaining issued run identities and delivery accounting. Pending old-program work must settle before this transition can activate. Detachment retains the permitted instructions and the child's already owned state. Specialized resource effects still require their corresponding lifecycle owners. See the explicit membership example.

Explicitly removing a named rule from an accepted composition retires its settled history in the child's normal native checkpoint. It stops scheduling while its last execution history, issued run counter and drop accounting remain available after Save and reopen. Reintroducing that same name starts a new trigger observation while keeping the run counter and accounting. Retirement cannot discard queued events, debounce work, unfinished effects or view obligations. Anonymous rule removal with history still requires a named identity; matching an ordinal is insufficient. Retained default/STATE values remain subject to their existing declaration-continuity checks. See the retirement and qualified-capture example.

Rule actions may target an explicitly owned cell range, including a range on a local sheet. Compatible selected updates and detachment preserve each existing override against its original range declaration. Changing that retained base or introducing overlapping owners refuses the transition. A newly added rule can target an existing pure declaration; its cells begin with their base values, without importing parent overrides. See the range lifecycle example.

Persistent defaults and combined archive ownership

Selected inherited composition preserves named scalar DEFAULT declarations when compiler allocation changes. An absent override remains absent; a numeric or sticky-blank override remains attached to its original declaration. Reset removes the override so the retained base expression governs again. This path checks the actual declaration, type, aliases and base expression and refuses changed retained contracts or pending effects. It does not migrate rule or resource state by treating it as scalar input data.

Browser-enabled Lineage publication uses the lifecycle adapter’s original table snapshot loan, including the existing funded Process recovery markers. Browser records are re-encrypted by their existing archive/document key owners. Missing resource custody, missing archive credentials and uncertain Process operations refuse before successful publication; enabling Browser support does not grant execution or source rights.

Inspecting retained Lineage

The selected native inspectModelLineage operation reads the current document owner's authenticated lifecycle. It returns immutable creation ancestry separately from published PART contracts, exact definition origins and replacement overrides. Missing creation evidence is unknown, not a claim that the model has no parent. The response includes the exact native working/archive stamp and the existing lifecycle upgrade/conflict view.

Shared capture inspection reports the most recent committed application for each binding, its original operation, source revision, target mapping and terminal unbind generation. These are retained records: retained does not mean fresh, and every such row reports freshness: "unverified". Inspection does not contact the producer or Registry, return captured values, or grant current source rights. Ordinary formulas continue to read their local compiled-model state.

The independent CLI's lineage commands consume the same native document ingress. Admission explicitly obtains a new transport lease and fences the previous lease; inspection uses an already obtained lease. Composition, upgrade, detachment, capture and unbind carry a saved original request unchanged. A lost reply requires inspection/retry of that same operation, never a newly generated operation ID. See the native inspection and CLI example. The approved Model Lineage inspection R1 view appears above the existing file and version tools when the native host advertises its inspection capability. Opening the tools or refreshing identity reads the retained record once; it does not poll. Copy drafts, the selected PART and focus remain with the existing view. A failed refresh identifies the last confirmed record explicitly. Pending, Receiving and commercial owners do not use the ordinary inspection adapter.

lineage prepare --owner admitted.json --source child.grid sends up to 1 MiB of UTF-8 authoring source to prepareLineageDefinition. The selected native compiler returns the canonical graph, byte count and source/graph digests without changing the model. Place result.graph in the original publication request's childGraph or replacement graph. Preparing data grants no publication or source permission; the native transaction still validates its exact owners, revision and rights.

The native document HTTP gateway also forwards explicit publishInheritedParts, updateInheritedParts and detachInheritedParts requests to those native owners. It checks bounded request shapes without parsing the compiler graph or supplying source rights. The selected web adapter binds preparation to exact source/graph bytes, retains the original operation after an uncertain reply, and requires current-window confirmation before adopting a returned model. Transient archive credentials stay outside retained operation/error data. The approved authoring section appears between Lineage inspection and the existing file/version tools for selected ordinary native models. Choose composition, update or detachment, a saved sibling source and the affected parts. Composition prepares the entered child definition with the native compiler. Review the exact request before applying it; review alone does not publish or establish compatibility.

The selected App authoring owner now confirms the actual native window and physical document root, then uses the existing guarded adoption path for source, cells and streams. Confirmation replays the retained composed program; inspection text cannot replace its compiler evidence. A cold reopen can confirm the same unchanged publication. A later Save creates a new physical binding: the older Original remains exact retry evidence but cannot confirm that later file. An uncertain request stays pending with the same effect and Original. Only an explicit retry receiving the native stale-lease marker can obtain a fresh lease; generic conflicts and network errors do not trigger automatic readmission.

The native owner can return a distinct rejected-before-publication result for a staging conflict. It first verifies that this Original has no committed receipt and that no native transaction is pending, then refuses before entering publication. The App accepts that result only for the exact operation, method and unchanged native lease; it releases the pending request for fresh review. Parsing failures, reused committed IDs, unknown Process work and any failure after publication begins remain unconfirmed. Error text or an HTTP conflict alone cannot release pending work. This request-local result is not a durable rejection receipt for delayed or remote delivery.

The independent CLI also recognizes that exact native result. It exits with LINEAGE_REJECTED_BEFORE_PUBLICATION and preserves the bounded result as JSON on stdout, while leaving the original request file unchanged. A mismatched lease, operation or method remains unconfirmed. Archive credentials are redacted from the diagnostic and returned failure report.

The explicit authoring adapter can list the current document's sibling locators and inspect one saved ordinary source through the existing document lease. It does not admit the source runtime or retire another window's lease. Dirty, protected, unresolved or absent sources refuse this selection; source access and materialization are still checked independently when applying the operation. The approved Lineage inspection remains available when the file tools also offer retained restoration, using the same guarded current-owner reads.

The selected file-tools workspace shares one action guard between its Lineage authoring owner, retained restoration and file mutations. An uncertain Lineage request retains its exact owner and effect across closing/reopening the tools; replacing those tools cannot silently discard pending work. Another mutation and normal workspace departure stay unavailable until that outcome is reconciled. An explicit exact retry can use the current admitted selection of the same original document and physical root; it still respects other workspace draft guards. This in-memory protection does not provide crash recovery or a delayed-delivery terminal receipt. A proven staging refusal releases the guard for a corrected review. After confirmed full App adoption, file tools acquire the current native owner; a failed tool refresh retries only that preparation, never the publication. This integration does not extend ordinary authoring to Receiving/commercial owners. Encrypted authoring requires an explicit archive-credential caller, such as the independent CLI. Ancestor-chain selection, explicit overrides and shared-binding management remain outside this initial authoring section.