[aharvard]

Fixes #17.

Problem

Step 5 said resolving concurrent updates to one artifact "remains open" and pointed to DEFERRED.md, which had no entry for it. The first version of this PR added that entry. On review, the decision was to settle the question in the draft instead of deferring it.

What the draft now decides

Rules that independent implementations must agree on are portable. Questions about which version is current stay application policy.

• Step 3: an artifact ID and version number identify at most one artifact version. A second create under a taken number is refused and records nothing. A retry whose ArtifactVersion has the same canonical JSON bytes as the stored one does not conflict, and the implementation MAY return the stored version.
• Step 5: an artifact version is released at most once, including after withdrawal; to release the same content again, create a new version. A release has at most one withdrawal.
• Step 5, new "Concurrent attempts" paragraph:
  • The conflict check runs when the record is written, inside the same atomic write, not at preview time.
  • The first attempt recorded takes effect. Each later conflicting attempt is refused and records nothing.
  • The refused participant MUST be told the attempt was refused, and SHOULD be told which record it conflicted with. GAP defines no error format.
• Stays application policy: refusing a change prepared from a version that is no longer current, for example the research and issue-tracking demos' expected-version checks. GAP doesn't define "current", so it can't define "out of date". No GAP record gains a base-version field, so nothing changes on the wire.
• Scope list: detecting changes prepared from an out-of-date version is listed under application workflows.

Conformance and deferred ledger

• New GAP-CORE-016 Conflicting attempts, with existing CMS, issue-tracking and research tests as coverage. Its notes state the limits.
• One new research test: a second withdrawal of the same release is refused and leaves the workspace bytes unchanged.
• The DEFERRED.md entry this PR added is removed. "Distributed record stores and replication" now covers only conflicts across stores and links to the new rules.

Found along the way

The CMS demo's generic create and release paths take no lock. Two overlapping createArtifactVersion calls both report success, and only one version is stored. Filed as #19, kept out of this PR.

Checks run (at c396d94)

• pnpm test:demo: 142 pass
• pnpm typecheck:demo
• pnpm check:specification
• pnpm docs:build
• pnpm docs:test: 16 pass