Who gets in.
Who takes over.

The package identity, test plan, policy and execution source are bound before execution. Authenticated stage records and exact evidence are checked against those bindings. Authentication of the record does not establish that every possible behavior of the program has been observed.

Anchoring and full admission are distinct transactions. Admission retains authenticated failed results too. Current authorization uses the latest fully admitted completion and the same verified retained package copy; it cannot fall back to an older passing run. Authenticated dependency links identify affected results, and version guards prevent stale updates from restoring obsolete status.

The comparison is derived from authenticated source records before applying the candidate’s restrictions. Verification covers the remaining obligation, complete eligible continuations, guaranteed work and a matching bound. Pending external operations retain their identities and backing. Optional refinements repair permitted state, certify the exact successor configuration and support private verification.

Current-source activation consumes the complete unused old cohort, issues derived successor rights and enables only the staged successor. Already exercised rights remain represented by external intents. An authenticated policy index supports a current maximum query only after a verified capacity-only frame check; other source changes require full-domain revalidation.