[scbrown]

What

An as-of share now carries frozen graphs. A cut reads a frozen graph's rows from its verified pack, not from main, which no longer holds them. A follower can therefore re-bootstrap across a freeze, which mints a new log_epoch, and end equal to the source in every named graph.

The correctness rule this needed (ruled B1)

freeze_io::export_graph_history re-inserts a frozen graph's transactions into the pack, numbered from 1. It keeps no main ids. So pack transaction ids are file-local; store/freeze.rs already says so, and it is why as_of_tx is refused over attachments. Consequently:

rule	why
a watermark before a scoped graph's freeze is refused	the pack cannot say which rows existed then
pack rows are selected by state (op = 1 AND retracted_tx IS NULL), not by tx	the ids can't be compared with the watermark; a frozen graph refuses writes, so its state at any watermark from the freeze on is its state at the freeze
a frozen row's timestamp, actor and source come from the pack's own transactions	main's transaction with the same number is an unrelated one
every frozen record carries F, the main transaction that froze its graph	an applier buckets records by tx and keys progress and duplicates on it
urn:quipu:graph:meta is refused in every cut (scope and context)	F writes that graph, so a cut naming it would mix two graphs into F's bucket

F is the tx of the graph's live lifecycleState "frozen" fact in the meta graph.

Tests

test	shows
a_follower_rebootstraps_across_a_freeze_and_equals_every_named_graph	freeze → epoch change on the next page → re-bootstrap → tail → equal; control: no freeze equals first time
a_frozen_graphs_records_keep_their_provenance_and_carry_the_freeze_tx	three unrelated transactions first, so the two numberings differ (asserted). Timestamp, actor and source are unchanged across the freeze; all frozen records carry one tx, later than every original and ≤ W; no other graph's record shares it
a_cut_from_before_a_scoped_graphs_freeze_is_refused	T before the freeze is refused; the same request at the head is served
the_graph_metadata_graph_is_never_cut	the meta graph is refused in scope and as context; control served
a_frozen_scan_never_reuses_main_metadata_for_its_own_tx_numbers	arranged collision: main's last scanned tx is 1 and the pack's first is its own 1

Instrument note: the provenance falsifier first PASSED, because the fixture wrote G first, so main tx 1 equalled pack tx 1. The adversarial prefix made it fail on the defect.

Sabotage, each restored from a saved copy with its sha256 checked. Each turned its test red; X2 and X6 were re-run after the final refactor:

• meta not refused;
• pre-freeze watermark served;
• metadata borrowed from main;
• frozen rows emit the pack's own tx;
• retracted pack rows included (4 tests red);
• lookup cache kept across scans.

Not in this PR

• Scoped stream (s24.2): it must apply the same meta-graph refusal when it exists.
• Shipping the pack file itself as a share member (option A): recorded for s24.2.
• The follower keeps a frozen graph as an ordinary data graph; lifecycle stays source-local (ruling (a)).

Gates

• default lib 2883 / 0 and server 247 / 0, under a HOME-escape guard (clean);
• clippy -D warnings -A missing-docs for full and shacl,owl;
• wasm32 lib check;
• fmt, file size and the repository pendant scripts.

🤖 Generated with Claude Code

https://claude.ai/code/session_01BzgSY2LpdGhBhb7D1nHbiF

[scbrown]

Non-author Ian: APPROVE at 98fcde36bc9124f66178ccba34f2db5d955662e5, native CONTENT 5c13f3d5a113ea2a9f337e5c2ab5bafb15bc31e828959639618841429ed1378f accepted by the current helper. Full four-path review after completed-green/current native preparation. The helper binds this review to the proposal and explicitly requires the supported merge --diff-bound landing path; this is not merge admission.

Reviewed state selection, pre-freeze refusal, metadata-graph exclusion, per-pack provenance lookup/cache lifetime, pack verification/registry comparison and composed term resolution. No blocking findings.

Validation: 30 supplied as-of conformance tests plus one independent two-frozen-pack control PASS (31/0). The independent control preserves both graphs and their timestamp/actor/source, and checks distinct main-ordered freeze transactions across packs. Inner exit0; outer HOME guard0, 157 watched paths +5 UID resources clean. Temporary test inclusion restored byte-for-byte; checkout clean. Initial wrong filter selected zero tests and is excluded from evidence.

Source/library review only. No deploy, runtime activation, lifecycle or merge action. Normal holds, current merge admission and exact-main watch remain with the lander.