# Fractal_Kernel_Migration_Procedure

> **CANONICAL DOCUMENT — the kernel-side migration/update standard (OQ-33): how any child instance adopts a newer anchored kernel release, governedly.** Identity: `Fractal_Kernel_Migration_Procedure_v0.2` — versioned canonical standard (C-040/C-061: every substantive change is a new version, each with its own DOC identity; the versionless alias tracks the newest). Registry class: §2 Procedure (prose + checker half per Registry contract rule 2 — honest status in §7). **What v0.2 adds (C-134 item 7 + C-135 items 3–4):** the **release-class fork** (§9 — a minor release migrates light, adopt-and-go, content converting lazily at first touch; a major migrates census-first, the full ceremony scoped to the contract layer; the first-touch converter named **armed-inactive**) and the **manifest read** (§10 — `birth_state_manifest.json` is the migration's reading key: its stances drive the Gate-4 apply and the regeneration step, under the two-seam doctrine — *birth is a pure function; upgrade is a merge*). `Fractal_Kernel_Migration_Procedure_v0.1` is **superseded, retained as frozen history** (its own DOC identity kept, the C-061 pattern); the whole v0.1 standard is carried forward — §§1–8 stand, and the new law routes through §1.9–§1.10.

**Version:** 0.2 · **Status:** Ratified (2026-08-22, in-conversation per C-033 — **the C-134 slate**, Max's *"all ratified"* at the thirty-seventh session; item 7 the commission of record, C-135 item 3 the shared carrier; the queued build executed 2026-08-23, Update Plan v0.16 row 4) · **Domain:** GOV · **Author:** Claude · **Parent:** GENESIS §7 (the update doctrine — this is its executable half) + GENESIS §2 (the Birth-State clause, C-134) · **Supersedes:** Fractal_Kernel_Migration_Procedure_v0.1 (retained as history, its own DOC identity per C-061) · **Provenance (Registry rule 4):** OQ-33; TF1-1..17 (`Flight_2026-08-17_Migration-Test.md`); KNet P-007 v0.2 / P-008; the executed migration (KNet commits `6c71bb4`, `846503c`); C-134 item 7 (BSL row 7 — the stance read + the regeneration step); C-135 items 3–4 (KLD §4 — the fork + the converter); the manifest (C-136 — the standing draft, bound mother-side by the pack gate) · **Document ID:** — (minted at the ratifying close via `close.py --create`, the v0.1 pattern)

Citation abbreviations: **PROT** = KNet_Fractal_Kernel_Migration_Protocol.md (P-007 v0.2) · **RCPT/ASSESS/VAL** = KNet's Upstream Receipt / Adoption Assessment / Migration Validation for beta-0.5 · **KM-n** = ASSESS §6 findings · **TF1-n** = test-flight findings · **PKT** = the mother's advisory packet (Upstream_Advisory_2026-08-17_KNet-Kernel-Migration) · **ADD** = the TF1 advisory addendum (instructions 1–23) · **MAN** = `birth_state_manifest.json` (`Claude/Project Governance/Rule Corpus/`, read *as shipped in the pinned target release*) · **BSL** = `Proposal_2026-08-21_Birth-State-Law.md` · **KLD** = `Proposal_2026-08-22_Kernel-Layer-Doctrine.md`.

---

## §1 Scope and sovereignty

1. This procedure governs the **demand side** of the release seam: a child instance adopting a newer anchored kernel release. The supply side — mother→mirror/public — is the C-116 rider; same seam, two sides, one interface: anchored release tags with receipts [Protocol v0.52 §1; GENESIS §7].
2. **Adoption is the child's own recorded decision** (a `P-` row), never an obligation. A never-migrating instance is fully conformant and works forever [GENESIS §7.4; Registry contract rule 5; executed: P-008 as KNet's own decision].
3. The gate skeleton is P-007's, adopted nearly verbatim: **Gate 0** clean pushed checkpoint → **Gate 1** pin → **Gate 2** audit → **Gate 3** human acceptance → **Gate 4** apply on a branch → **Gate 5** validate → **Gate 6** land. No partial red landing; forward-only correction after landing [PROT §6–§7; executed: the six-gate trace in RCPT/ASSESS/VAL].
4. **The human gate is mandatory.** Gate 3 stops at the instance owner; every conflict resolves there or defers there [PROT rule 4; executed: C-099.b and C-115.b resolved by Max at Gate 3].
5. Jurisdictions stay parallel: mother and child connect only through handed-over files and the human — no live coupling, no run-time upstream calls [Protocol v0.51 §4; GENESIS §7].
6. **Prospective effect.** Adoption binds forward only; earlier child history retains the meaning of the constitution under which it occurred. No history is rewritten or reinterpreted [PROT rule 5; executed: KNet Register §1 wording].
7. Migration is **never a store merge**; stores stay sovereign and append-only [GENESIS §6/§7, OQ-31].
8. Everything the mother hands over is **audited, never obeyed** — including severity ratings and this procedure's own per-release supplements [ADD posture line; executed: KNet's DEFER of close.py against ADD instr. 13, and of stats.py against a TF1 green].
9. **The lane fork (C-135 — new at v0.2).** Every adoption begins by classing the release: **minor** — additive kernel, no contract break — or **major** — an engine swap / a contract break (§9). The six-gate skeleton of rule 3 is the **major lane's** ceremony; a minor migrates on the light lane (§9.2), every §§2–6 duty read through the fork. The advisory declares the class (§8.9); the child audits the declaration against the pinned manifest's layer bits (§10.6) — declared, audited, never obeyed (rule 8).
10. **The manifest is the reading key (C-134 — new at v0.2).** The migration reads MAN *as shipped in the pinned target release* (§10): each element's **stance** says what swaps, what merges, what regenerates from local source, and what never arrives; each element's **layer bit** feeds the fork (rule 9). One manifest, three consumers — genesis at birth, this procedure at upgrade, the release gate for version arithmetic [GENESIS §2, the Birth-State clause; BSL; KLD].

## §2 The pin (Gate 1)

1. A child updates only from an **anchored release tag** (C-090: signed tag + external timestamp attestation) — never from the living mother tree [C-116 lag boundary; GENESIS §7.2].
2. **Resolve the SHA yourself.** A copy of a SHA is not a pin; your resolving it against the tag is. Record tag name, tag-object SHA, and commit SHA independently [recorded: RCPT §1; independent resolution: RCPT §2 — `beta-0.5^{commit}` resolved independently to `18d4104…`].
3. **Signed-tag verification requires the signers bind.** Before `git tag -v`, bind the allowed-signers file — `git config gpg.ssh.allowedSignersFile "$(git rev-parse --show-toplevel)/.allowed_signers"` (or the `-c` one-shot form); a bare `git tag -v` fails in a fresh clone [TF1-5, High; executed: RCPT §2 "as TF1-5 predicted"].
4. **Verify by fingerprint and principal, never by mother-side key labels** ("key G" is un-derivable from the shipped tree) [TF1-8; executed: RCPT §2 "no mother-side label … was assumed"].
5. Run `git fsck --strict`; record the result [executed: RCPT §2 "completed with no finding"].
6. **The structurally-absent-own-receipt rule.** A release tree cannot contain the attestation of its own tag; the receipt pair (`.txt` + `.ots`) is handed over separately, cited *as supplied*, with SHA-256 of each hand-off document recorded and the OTS state (pending/final) disclosed. **Pending-at-issue is expected and non-blocking**: signed tag + clean fsck suffice to pin; pendency is rechecked at Gate 5 and cured post-landing by a forward commit that appends the finality evidence as a new section — **both receipt hashes (supplied and upgraded) recorded, the historical pending verdict preserved in substance; prior prose may be restated, but the recorded verdict is never reversed** [TF1-6; PROT §9.6; executed: RCPT §3, VAL §6, KNet commit `846503c` — receipt v0.2→v0.3 keeping both `.ots` hashes].
7. **Transport with remote-severing.** `git clone --no-local` → checkout the tag → **record the remote's URL in the receipt, then `git remote remove origin`**. The frozen clone is a reference copy — read-only evidence, never a working surface, never push-capable [TF1-7; C-091; executed: RCPT §1 recorded-then-removed].
8. **Self-contained bundle option.** For full rehydration independence, retain in-repo a complete-history Git bundle of the signed tag plus its SHA-256, at an **instance-parameterized upstream-provenance location**, verified by bundle-only checkout and tag re-verification. The bundle's home and the receipt pair's home may differ — the executed exemplar keeps the bundle under `Claude/Project Governance/Upstream/<release>/` and the receipt pair under `Provenance/Upstream/`; the receipt names both locations. This is the tested strongest transport; the out-of-repo frozen clone alone leaves a rehydration dependency [executed: ASSESS §7.1, VAL §2 rows 1–2 and §4].

## §3 The adoption transaction (Gates 2–3)

1. **The upstream receipt** is a named artifact with a fixed home: `<Instance>_Upstream_Receipt_<release>.md`, sibling to the instance's governance documents. Minimum fields: source identity and transport; tag name + tag-object SHA + commit SHA; acquisition time; verification evidence (fingerprint, principal, fsck); worktree and remotes state (including the severed remote's recorded URL); SHA-256 of every hand-off document; timestamp state; the locations of the retained release pack and the receipt pair (§2.8 — they may differ); and the child's **baseline inheritance clause quoted verbatim** as the comparison anchor [TF1-17; KM-04; executed: RCPT as the template exemplar].
2. Migration working artifacts (receipt, assessment) are **not governance changes**: they may exist before Gate 3 and commit only on the migration branch [TF1-17 fix; ADD instr. 6; ratified in P-008].
3. **The adoption matrix** covers every decision in the delta (child baseline upper edge → release upper edge). Two-natured decisions split into `.a/.b/.c` **sub-rows** (rule / tool / parameter / artifact), each carrying **exactly one** of the seven dispositions — **INHERIT · BIND · EXCLUDE · SUPERSEDE · CONFLICT · MIGRATE · DEFER** [dispositions: PROT §5; sub-row grammar: PROT §4, ratified via ASSESS §9 item 7 / P-008; TF1-15; KM-05; executed: ASSESS §3, ~45 sub-rows] — with the split recorded, never smoothed.
4. **Classification source of record: FRACTAL Architecture State §6 *as shipped in the pinned target release*.** Its kernel/parameterized/instance partition governs classification through the tagged Register's upper edge; where any advisory or hint disagrees, **that pinned §6 wins**. Mother-side edits to §6 reach a child only through the next release the child sovereignly pins — never at run time [TF1-11; TF1-14; KM-01/KM-03; §1.5 no-live-coupling; PROT rule 1; executed: RCPT §4 "the maintained partition in FRACTAL Architecture State §6 governs classification **through C-115**"]. GENESIS §3.4's inheritance clause anchors the child's *baseline lower edge only*; it ships stale at its own release and must not classify the delta. (The manifest is this partition's element-level projection and joins the source of record at v0.2 — §10.5.)
5. **Instance-birth-document EXCLUDE rows are pre-printed.** The child's root `GENESIS.md` and `BOOTSTRAP.md` are never overwritten — the birth record is frozen history; BOOTSTRAP may advance its *content* under its own retained identity [executed: ASSESS §3 root rows + §5 Bootstrap binding row; `BOOTSTRAP.md` modified in `6c71bb4` with KNet identity retained]. Also pre-printed EXCLUDE: mother store, contexts, Register rows, and biography [TF1-1, High; executed: VAL §2 identity PASS].
6. **The conflict register** stops at the human gate and names its class. Classes include child-vs-kernel conflicts **and the upstream-internal class** — mother-vs-mother contradictions (advisory hint vs the pinned Architecture State §6: the pinned partition wins; packet claims about child state the child's corpus does not contain: treat as recommendations, infer no state) [TF1-14; TF1-16; KM-01; KM-02; ratified PROT §9.1].
7. **Tool discipline.** A kernel tool carrying instance-named constants (known: `close.py`'s `Fractal_` alias regex; the fieldnote roster) is **BIND/MIGRATE, never plain INHERIT** — or DEFER if the tool class itself is unadopted [TF1-4; ADD instr. 13; executed: C-112.b DEFER]. A child's **locally-ahead tool wins** over the kernel copy when the kernel copy fails the child's evidenced facts; record it as a local binding, not drift to erase [KM-08, doctor.py]. Tool availability never silently creates governing authority [PROT §5; executed: stats.py deferred despite a TF1 green].
8. **The frozen-assessment discipline.** The Gate-2 assessment freezes at Gate-3 acceptance and is never edited to describe execution; execution proof lives only in the validation record [executed: ASSESS §1 vs VAL — the anti-laundering separation].

## §4 The change-set (Gate 4)

1. **Branch discipline.** All changes on a dedicated migration branch off the pushed Gate-0 checkpoint; applied source-first (provenance → inherited sources → bindings and mechanisms → contexts/index/board last); landed only whole [PROT §6; executed: VAL §1, branch `codex/fractal-beta-0.5-migration`].
2. **Manifest maintenance.** Every newly adopted kernel file is appended to `.inherited` **in the same change-set**, one line per file, **bidirectionally paired** to its matrix row: every manifest addition traces to one INHERIT/MIGRATE row, and every such row resolves to an actual file. Child-authored files never enter the manifest. The manifest's mechanics are fixed by the tooling: it lives at `Claude/Knowledge Graph Store/.inherited` — beside `check_versions.py`, which hard-codes that location, where `genesis.py` writes it at birth — one **repo-relative** path per line (absolute or `../` paths are hard errors), `#` comments permitted; its companion `.version-registry` projection lives in the same directory. (No shipped tool appends; sanctioned hand-editing until the §7 tooling lands.) [TF1-2, High; KM-06; ADD instr. 16; mechanics: check_versions.py `inherited_registry()`, genesis.py manifest write; executed: VAL §2, 12 additions paired both directions]
3. **Prose-half residence.** An adopted standard's document either joins the child's governance tree as an inherited copy at its pinned edition (+ `.inherited` entry) or is cited at the pinned anchored release; the child's self-containment rule decides. The §2.8 bundle is the tested third leg for full independence [TF1-12; ADD instr. 14; executed: ASSESS §7.2, nine standards copied at pinned editions].
4. **Adapter re-projection duty.** Every client adapter is re-projected from the newly adopted Settings and restamped in the same change-set; multiple adapters carry identical rules; all adapters join the strict version scope [executed: ASSESS §7.3, VAL §2 Adapters row — dual CLAUDE.md/AGENTS.md]. Where the instance runs `check_versions.py` at all — the tool class is shipped ready-to-adopt, never demanded (GENESIS §6, the C-081 gate) — its `.version-registry` projection is updated wherever living documents are renamed or re-pointed [executed: KNet `.version-registry` update; check_versions.py `living_overrides` mechanism].
5. **Post-birth kit installs (the retrofit pattern).** Newborn components arrive by hand-rolled install, **each a per-component recorded decision**; newborn-only components are **never** retrofitted; pre-retrofit absence is conformant state, not damage. The concrete per-release component sets — which files, which command surfaces — are per-release advisory content and live in the §8.6 supplement, because they depend on the release's component roster and the child's client surfaces (command files are adapter-tier per C-097; a child on other surfaces has none) [TF1-10, High; TF1-13; ADD instr. 8/18; executed: VAL §2 fieldnote-boundary and adapters/opener PASS — the beta-0.5 exemplar set: named opener + fieldnote door].

## §5 Validation (Gate 5 — the semantic gate)

1. **Green checkers are necessary and insufficient.** The `.inherited` exemption is purely path-based: a naive copy fails loud, but a naive copy **plus an unaudited manifest append launders destruction green** [TF1-3 — destroyed birth documents passed with 204 citations exempted; ADD danger model].
2. Two semantic checks are therefore mandatory: **(a)** diff every instance-class document's Version/Author identity stamps against the Gate-0 checkpoint; **(b)** verify manifest-to-matrix pairing in both directions — an unmatched exemption is itself a finding and fails the gate [TF1-3; KM-07; ratified PROT §9.3; executed: ASSESS §8 checks 7–8, both PASS in VAL §2].
3. **Scratch-clone rehydration is the landing gate.** In an isolated location with no mother checkout reachable: clone the Gate-0 checkpoint clean, **apply the exact staged migration change-set to it**, then prove on the candidate — all checkers reproduce, the retained bundle clones independently, the tag signature re-verifies, plus the instance's own content checks (the KNet exemplar: 16 PDF hashes re-verified) [PROT rule 6 self-contained rehydration + §6 Gate 5 "prove in a scratch clone"; executed: VAL §4 — "the exact staged candidate was applied to a clean clone of the Gate 0 history"]. Validating only the pre-migration checkpoint proves nothing about the migration; the applied candidate is what must rehydrate.
4. A validation plan covers at least these **categories** (values are per-release/per-child): release-pack integrity · upstream authenticity · store fold · version agreement · health/secrets · source parity (imported files byte-match the tag) · preserved-local-machinery blob identity · matrix/manifest pairing · semantic identity · namespace separation · adapters/opener · isolated rehydration — plus **instance-parameterized rows** for the child's own content-safety obligations (experiment boundaries, corpus/PDF hash re-verification, or the instance's equivalents) [executed: ASSESS §8's 15-point plan; VAL §2's 16 rows — **15 PASS plus the disclosed-pending timestamp row**, itself the §2.6 pendency doctrine executed].
5. **Verification-boundary honesty.** Record what could *not* be checked and what compensated; never present a compensation as the missing check [executed: RCPT §3 / VAL §6 — two-explorer header agreement recorded in lieu of a local node].

## §6 Landing and records (Gate 6)

1. Land as **one reviewed change-set**: fast-forward from the migration branch, a single `[GOV]` adoption commit, pushed [PROT §6; executed: `6c71bb4`, 42 files].
2. The committed record set: the **receipt** in its final state (pendency disclosed if unresolved); the **frozen assessment**; the **validation record**; the **decision-register row** naming the exact accepted commit, the resolved conflicts, and any procedure amendments; the migration **return package** [executed: RCPT/ASSESS/VAL/P-008/RP-MIG all in the change-set].
3. Post-landing cures (timestamp finality, deferred items maturing) land as separate forward commits; the receipt upgrades by **appending the final evidence as a new section, keeping both receipt hashes and the substance of the historical Gate-5 verdict — prior prose may be restated, the recorded verdict never reversed** [PROT §9.6/§7; executed: `846503c`, RCPT v0.2→v0.3 keeping both `.ots` hashes and the pending-at-Gate-5 substance].
4. **The feedback offer.** The mother asks for the migration's frictions and greens through the owner — the §8.5 feedback ask [PKT §5, the C-094 loop; ADD instr. 21]. Offering them is the **child's choice**: a never-reporting child is fully conformant (the mirror of Registry rule 5 and GENESIS §7.4). The material lands in the mother's ledger, via the owner's hand only [C-096; executed mother-side: OQ-33 → this document]. §8.5 carries the only normative weight of this loop; nothing here adds a child-side Gate-6 duty.

## §7 The checker half — honest status (Registry contract rule 2)

**Status: prose-first; checker triggers named.** What exists mechanically today: `verify.py` (store gate, incl. the C-114 `vocabulary_local.json` extension hook); `check_versions.py` (version agreement, the path-based `.inherited` exemption, the `.version-registry` instance projection); `doctor.py`; the signed-tag + fsck + bundle Git machinery of §2 [executed: all exercised green in VAL §2]; and, new at v0.2, the **manifest pack gate** mother-side (`close.py --pack` validates MAN at every pack — parse, stance coverage, spec-pin currency, the CUSTOM roster; C-136). What does **not** exist, with build triggers:

1. **`adopt <path>` manifest subcommand** — appends to `.inherited` and enforces the §4.2 matrix-row pairing. Trigger: the second executed migration, or the first hand-pairing failure [TF1-2; ADD instr. 20].
2. **`genesis.py --retrofit`** — tooled §4.5 kit install (genesis.py is birth-only by explicit refusal). Trigger: the second retrofit demand [TF1-10; ADD instr. 21].
3. **The clause-span pack-time check** — GENESIS §3.4's clause upper bound = the Register's max C-number at tag time (mother-side; genesis.py reads the clause live, so staleness propagates into newborns mechanically). Trigger: the next C-090 tagging close [TF1-11; ADD instr. 9/22].
4. **Mechanized §5.2 semantic checks** in check_versions.py (stamp-diff + pairing). Trigger: the first semantic-check failure found by hand, or the third migration [TF1-3].
5. **Delta-inventory generator + machine-readable §6 partition** — mechanical derivation of the §8.3 inventory (Register rows since the child's baseline × Architecture State §6 classes). §6's partition is maintained as narrative prose today, so derivation is by hand until this lands. Trigger: the second advisory authored, or the first hand-derivation error found. (MAN is the partition's machine-readable half landed — the element rows; the decision-delta derivation remains by hand.)
6. **The first-touch converter — named, ARMED-INACTIVE (C-135 item 4; new at v0.2).** The mechanized conversion prompt: read a living document's C-012 stamp, compare it against the adopted Layer B contract edition, offer the conversion at the document's first touch after a major landing; frozen artifacts exempt by law. Trigger: **the first declared contract break** — no release so far has declared one, so the tool deliberately does not exist (C-021); until it does, §9.4's hand ritual is the standard.
7. **The manifest-driven apply (new at v0.2)** — a tooled Gate-4 walk of MAN executing the §10.3 stance table mechanically, child-side. Trigger: the second manifest-read migration, or the first hand-apply error found. Until it lands, the apply is by hand against §10 — each stance a row in the adoption matrix, judged and recorded.

Until a trigger fires, the hand procedures in §§2–6 (and now §§9–10) are the standard — the v0.1 core was executed once end-to-end and passed [executed: the full KNet migration, VAL §5 "Gate 5 passes"]; the v0.2 additions await their first executed specimen (PR's 0.7→0.8 migration the seam's named candidate).

## §8 What the mother owes per release (the advisory template)

Hand-written packets are retired: TF1 found five defects in the one hand-written packet (missing signers bind, key-label phrasing, impossible in-tree receipt citation, live remote, unverified child-state claims) [TF1-5/6/7/8/16]. Each anchored release ships an advisory **hand-instantiated from this template** (mechanically generated once §7.5 lands):

1. **Pin identity** — tag name, commit SHA, tag-object SHA, signing-key fingerprint + principal (never a label), and the §2.3 signers-bind line verbatim [TF1-5/8].
2. **Transport** — the §2.7 recipe including `git remote remove origin`, and the bundle option [TF1-7].
3. **Delta inventory** — hand-derived from the two named sources (Register rows since the child's baseline × the pinned Architecture State §6 partition — read by a person until §7.5 exists); disposition *hints* cite the pinned §6 and never freelance a classification [TF1-14; KM-01]; any claim about child state cites the child file read at a C-096 look, or is phrased as a recommendation [TF1-16; KM-02].
4. **Receipt hand-off** — the receipt pair supplied separately with the structural-absence note and current OTS state [TF1-6].
5. **The feedback ask** — the C-094 fieldnote loop closing the seam, always phrased as an ask through the owner, never a child-side duty [PKT §5; ADD instr. 21].
6. **The retrofit component set** — the release's newborn-kit components with exact per-component file sets for post-birth install under the §4.5 pattern, scoped to the child's actual client surfaces; newborn-only components named as never-retrofit. (The beta-0.5 set: the named opener's command file, obsolete opener deleted, plain vocabulary kept; the fieldnote door — `fieldnote.py` + self-targeted roster + root ledger + command file + parameter-7 growth recorded without rewriting the genesis fact; First Loops Rail excluded.) [TF1-10/13; ADD instr. 8/18]
7. **Pack-time hygiene** (owed once, checked per release): the §7.3 clause-span check; migration-proof GENESIS §5 shelf pointers; qualified GUIDE newborn phrasing; the Registry §1.5 residence clause; the close.py prefix parameterization [ADD instr. 22 slate — landing proposed at the UF1 close, see the cure change-set].
8. **Optional pre-flight**: a TF1-style dress rehearsal (adversarial probes + independent refuter, sandboxed pinned clones, child-sandbox probes serialized) whose surviving findings feed the per-release supplement [Flight_2026-08-17 method note, incl. the shared-sandbox false-positive lesson].
9. **The release class, declared (new at v0.2).** Each advisory states the release's C-135 class — **minor** (additive kernel, no contract break; the light lane applies, §9.2) or **major** (engine swap / contract break; the census-first ceremony, §9.3) — with the touched contract set named. The declaration is a claim like every other packet content: the child audits it against the pinned manifest's layer bits and pins (§10.6), never obeys it [§1.8].

## §9 The release-class fork (C-135 — new at v0.2)

1. **The two layers, restated for the seam.** The kernel has two layers [C-135; KLD]: **Layer A, the engine** — the tools and their tests, the checkers, the command files, the executable rituals; elements that never grow child tissue, **swapped, never merged**, at birth and at every update alike — and **Layer B, the format contracts** — the Schema, the Node Template, the document formats, the governance contracts; the declared shapes child content conforms to, whose incompatible change *alone* makes a major. **Child content is not kernel:** it belongs to the child, conforms to Layer B editions, and is outside the update's blast radius by construction. Under the old fusion, every update had to be treated as a possible format break — maximal ceremony, per-file judgment; the fork ends that.
2. **The minor lane — migrate light.** A **minor** release (additive kernel, no contract break) is adopted, not ceremonied. The pin holds **unchanged** — §2 in full; authenticity discipline is lane-independent. Then a thin mechanical adoption: engine elements swap wholesale per their manifest stances (§10.3), no per-file merge; the adoption matrix collapses to the manifest walk plus the pre-printed EXCLUDE rows (§3.5); Gates 2–3 shrink to a one-page delta review and the owner's acceptance — **the human gate never disappears** (§1.4), and adoption stays the child's own recorded `P-` row (§1.2) even at its lightest; Gate 5 shrinks to the checker suite green on the candidate plus the §5.2(a) identity diff (no instance-class document moved), the full §5.3 rehydration remaining the major lane's gate. **Content converts lazily at first touch:** a compatible contract addition binds new content at its first use; nothing existing converts, nothing is forced. The lane's trajectory is **eventually self-serve** [C-135] — the §7.7 tooling's target; a child running it by hand today is fully conformant.
3. **The major lane — migrate census-first.** An **engine swap / contract break** takes the full six-gate ceremony of §§2–6, **scoped to Layer B and its dependents** — and it opens with a **census**: before any gate is walked, enumerate the instance's living surface against its C-012 stamps — which living documents conform to which contract editions, which artifacts are frozen and exempt — so the break's blast radius is known and recorded up front [the C-135 doctrine; the KNet re-foundation model: census first, one reviewed change-set, executed in the child's own jurisdiction as its own act]. Even here, **child content never migrates estate-at-once**: the landing adopts the new contracts; living documents then convert **lazily, per document, at first touch** (§9.4); frozen artifacts never convert — accretion already exempts them, and history is supposed to hold old formats. The C-012 in-document stamp is the conversion field.
4. **First touch, by hand (until §7.6 builds).** At the first touch of a living document after a major landing: read its stamped contract edition, compare it against the adopted edition, convert and restamp **in that touch's own change-set**, the revision-history entry naming the migration it serves. Never convert a frozen artifact; never batch-convert the estate "while you're at it" — lazy is the law, not a permission.
5. **Version arithmetic, armed-inactive.** Semantic versioning at the release seam is **ratified armed-but-inactive** [C-135]: the minor/major meaning attaches to **no beta-0.x number** — activation is the owner's hold-or-jump call (FN-0006: hold until 1.0, or jump to the `fractal-1.0-beta.N` grammar). Until activation, the class rides the advisory's declaration (§8.9) and the manifest audit (§10.6), never the version number.

## §10 The manifest read (C-134 — new at v0.2)

1. **The input.** MAN — `birth_state_manifest.json`, `Claude/Project Governance/Rule Corpus/`, read ***as shipped in the pinned target release***, never live (§3.4's rule extends to it unchanged; §1.5 no-live-coupling). Every kernel element carries its **stance** (one of five, C-134 axis 2), its **layer bit** (`ENGINE` | `CONTRACT`, C-135), its carried rule families, and its pinned editions; the CUSTOM roster names what never travels. Mother-side, the pack gate validates the file at every pack (§7 status line) — a child may therefore expect a pinned release's manifest to be well-formed, and audits it anyway (§1.8).
2. **The two-seam doctrine (the backbone).** *Birth is a pure function* — `(kernel, interview parameters) → newborn`: deterministic, total, zero origin biography among its inputs. *Upgrade is a merge* — `(instance state, new kernel, owner dispositions) → upgraded instance`: the owner-disposition input is irreducible, and that residue is not friction but the sovereignty grammar itself (§1.2, §1.4). Birth happens exactly once; **after the birth commit, everything is migration** — a young instance's migration is thin, never a re-birth. One manifest serves both seams [BSL; GENESIS §2]: genesis reads a stance to know what to generate, stamp, or copy; **this procedure reads the same stance** to know what is mechanically adoptable, what is the instance's own, and what is replaceable reference.
3. **The stance table — what each stance means at Gate 4.** The apply walks MAN; each stance fixes the element's disposition class before any judgment is spent:

| Stance | At migration |
|---|---|
| **ship-neutral** | mechanically adoptable — the swap class: replace byte-exact with the pinned release copy; INHERIT-row shape, `.inherited` pairing per §4.2 |
| **generate-fresh** | **never overwritten** — instance-bound tissue genesis wrote from a template; after the adoption its projections **regenerate from local source** (§10.4), never copy in from the origin |
| **seed** | never overwritten — the seed grew the child's own body (C-131 class); the shipped seed exists for births. Re-seeding a still-empty organ is a separate recorded decision, never an apply side-effect |
| **origin-reference** | replaced with the pinned release's copy, **banner intact** — the origin's labeled biography, never law in the receiving tree |
| **omit** | does not ship — and does not arrive at migration either; an omit-class element appearing in a delta or packet is an upstream-internal conflict for the §3.6 register |

4. **The regeneration step (the item-7 duty).** After any adoption lands — either lane — the child's **derived projections regenerate from local source**, checked against the matrix's excluded rows: walk the EXCLUDE rows (§3.5) and MAN's generate-fresh/seed elements, regenerate each one's projections from the instance's **own** sources (§4.4's adapter re-projection is this step's oldest member — the newly adopted Settings the source, the adapters the projections; a board, an index, a `.version-registry` the same shape), and confirm the apply overwrote none of them. A projection found carrying origin content after the apply is a **Gate-5 finding**, not a cleanup item [the F1 fracture class, both seams: genesis copying like an upgrade, a migration installing origin projections like a birth — the law puts each seam back on its own side].
5. **One partition, two projections.** MAN is the element-level projection of the same pinned partition §3.4 names (derived from the ratified scope-axis sort, C-136); the classification source of record stays **Architecture State §6 as shipped in the pinned target release** for the decision delta, MAN for element stances and layers. A disagreement between the two pinned artifacts is the **upstream-internal conflict class** (§3.6): it stops at the human gate, and no advisory hint outranks either.
6. **The layer read (C-135 item 3 extending item 7).** The fork's arithmetic is mechanical: a delta whose touched elements are all `ENGINE` and whose `CONTRACT` pins are unchanged is **minor by the manifest's own read**; a `CONTRACT` pin moving incompatibly is the **major** class. The §8.9 declaration is audited against exactly this read — where declaration and manifest disagree, the disagreement is recorded and stops at the human gate (§3.6), never resolving silently.

---

**Refresh triggers:** the next executed migration (any child, any release); the first minor-lane adoption executed (the light lane's first field specimen); the first declared contract break (§7.6's converter builds; §9.4 goes mechanical); a §7 build trigger firing; a change to Architecture State §6's partition mechanics or to MAN's schema; semantic versioning's activation (FN-0006's hold-or-jump); a C-094 fieldnote showing a clause misses or misleads.
**Revision history:** v0.1 (2026-08-17) drafted by the UF1 flight from the executed KNet beta-0.1→beta-0.5 migration (P-007/P-008), the TF1 test flight (17 findings, all confirmed real in execution), and the beta-0.5 kernel literature; corrected in the same flight by a three-track refutation pass (18 unique defects cured — the append-only overclaim weakened to the executed shape, the §6 classification source pinned to the release, the rehydration gate restated as apply-then-prove, five citation pointers repaired, release-specific content moved to §8). Ratified the same day as C-117 (per Protocol v0.53, Max's "go with (a)" — the restatable-receipt doctrine his explicit call); Registry §2 row landed in the same change-set. · v0.2 (2026-08-23) **the birth-state + kernel-layer reissue (C-134 item 7 + C-135 items 3–4 — ratified 2026-08-22 per the C-134 slate, Max's *"all ratified"* at the thirty-seventh session; the queued build executed 2026-08-23, Update Plan v0.16 row 4):** the **release-class fork** (§9 — minors, additive kernel with no contract break, migrate light: adopt the release, engine elements swapping per stance, content converting lazily at first touch; majors, engine swap / contract break, migrate census-first — the full ceremony scoped to Layer B and its dependents; the **first-touch converter named armed-inactive**, built at the first declared contract break; semantic versioning armed-inactive per FN-0006) and the **manifest read** (§10 — MAN the migration's reading key: the five stances driving the Gate-4 apply and the post-adoption regeneration step, under the two-seam doctrine — *birth a pure function, upgrade a merge*; the layer bit the fork's arithmetic; one partition, two pinned projections, disagreements to the §3.6 register). §1 gains the routing clauses (1.9–1.10), §7 the two honest-status rows (converter · manifest-driven apply) plus the pack-gate status line, §8 the release-class declaration row (§8.9), §3.4 the manifest cross-pointer. The whole v0.1 standard carried forward; v0.1 superseded, retained as frozen history with its own DOC identity (C-061).