Invariant from the R0.4.5 review:
An old valid lifecycle prefix must never reactivate possession that a newer finalized history has fenced. Recovery requires freshness, not merely internally valid history.
<!-- historical --> Before R0.4.6, recovery and (the since-removed) reopen proved possession against whatever event slice the caller supplied. A stale custody for A@0 fails against the current history, but succeeds against the old prefix [Attached(A,0)]. Same for reopen: a warden that never reopened plus an old closed prefix materializes a vacancy at a generation that is currently occupied via an orderly succession. Both are rollbacks: making an old truth current again. <!-- /historical -->
(Introduced in R0.4.6 as a "head" advanced in a separate step; since R0.4.7 the same linear value is the LifecycleAdmission and is advanced only by the transitions themselves — see docs/admission-model.md. The freshness property is unchanged.)
LocusRoot::begin() ─────────────► Vacant(0) + FinalityWarden + LifecycleAdmission(gen 0, vacant)
Vacant/Attachment/Warden + Admission ──transition──► ... + Admission' [CONSUMES the admission]
CarrierCustody + &LifecycleAdmission ──recover──► LocusAttachmentLifecycleAdmission is born once per lineage at begin, has private
fields and no public constructor, is move-only, and advances only by being consumed by a transition. An older admission therefore cannot coexist with the current one as recovery authority: it was consumed to produce the current one.
Possession-granting operations no longer accept an event slice at all.
Passing &[LifecycleEvent] where a head is required is a compile error. "Caller must supply the latest log" is thereby encoded, not documented.
replay_lifecycle / audit_replay remain public and descriptive over
slices: knowledge of any prefix is still available; possession from a prefix is not.
A trusted root can fork lineages via repeated create_locus, each with
its own head; a fork can be fed the honest prefix and would recover the stale custody. Locus-birth uniqueness is the future World-level invariant; cross-lineage rollback resistance is not claimed.
Durable crash recovery and cross-process/disk copies remain unclaimed;
a persisted head is bytes and copies freely — the same future incarnation/CAS/fencing primitive applies to heads as to custody.
No distributed consensus, leases, or network protocol in this round.
The review's 7-step scenario: stale A custody fails against the
current head; there is no API path to present the old prefix.
At an occupied generation, finality of the wrong carrier/generation
fails and no second vacancy can be minted; no slice path exists.
A consumed admission cannot be reused (compile gate); a failed
transition hands the admission back.
LifecycleAdmission cannot be fabricated (private fields); recovery
rejects event slices (type error).
All prior falsifiers remain green under the head-based API.