Corpus Snapshots

Purpose and authority boundary

A corpus snapshot is scientific membership authority. It binds one exact verified Deduplication result and active decision set, preserves every candidate exactly once as a group member or unresolved entry, and records representative/evidence relationships without deleting raw source records. A workspace generation or “current candidates” view is not a snapshot.

NexusScholar.Screening.CorpusSnapshots is a separate outward bridge. It converts verified snapshot units into the locked candidate surface used by Screening without making CorpusSnapshots depend on Screening.

Snapshot and successor model

verified Deduplication result + verified authority policy
  → baseline snapshot (empty decision set)
  → human decision
  → deterministic reduction
       merge          → group union
       keep-separate  → membership unchanged + active constraint
       mark-unresolved→ membership unchanged + unresolved decision
  → successor snapshot
  → predecessor invalidation

No snapshot is edited or deleted.

DeduplicationSnapshotReducer applies only exact verified review-pair decisions. It preserves all group members and evidence, elects representatives with the Deduplication selector, checks active keep-separate constraints, and requires the successor active decision set to differ by exactly the accepted transition.

Key types and services

• VerifiedCorpusSnapshot exposes source/decision bindings, groups, unresolved candidates, publisher authority, supersession, invalidations, and both digests.
• CorpusSnapshotService creates baselines/successors, verifies complete membership, deterministic ordering, group IDs, evidence, authority, lineage, and rehydration.
• CorpusSnapshotInvalidation creates and rehydrates immutable invalidation records tied to cause decision/snapshot and complete invalidated records.
• DeduplicationSnapshotReducer owns membership transition logic for FE-02.
• VerifiedScreeningCorpusBinding binds result, snapshot record, decision set, group units, unresolved units, and a canonical digest.
• ScreeningCorpusBindingAuthority checks exact source coverage and creates VerifiedSnapshotBoundScreeningPolicy.

Source: CorpusSnapshots and Screening.CorpusSnapshots. Authority is defined by ADR 0028 and the FE-06 bridge in ADR 0033.

Two digest meanings

• Content digest: schema, source result, active decisions, groups, membership, representatives, evidence, and unresolved candidates. It excludes snapshot id, creator/time, supersession, and invalidation history. Matching content digests mean scientifically equal corpus content under this schema.
• Record digest: all snapshot record fields, including id, publisher, time, supersession, invalidation references, and reproduced content digest. It identifies the exact historical record.

Group IDs derive from canonical ordered member candidate IDs. The decision-set digest derives from decision id/digest references ordered by decision id. Every Deduplication candidate must occur once and only once; no-ID candidates remain explicitly unresolved with their candidate digest and raw-sighting references.

Snapshot-to-Screening bridge

Each snapshot group becomes one Screening unit represented by the group’s representative candidate, while all member IDs stay bound. Each unresolved snapshot candidate becomes its own unit with exact candidate digest. The bridge requires total source coverage, forbids duplicate membership, binds the snapshot record and decision-set digests, and creates a locked candidate set with explicit source references. Screening cannot expose a public factory that bypasses this binding for snapshot-authoritative conduct.

Failure and refusal behavior

Snapshot authority rejects stale result/policy, unauthorized publisher, missing/duplicate membership, representative outside group, altered candidate/evidence digest, fabricated no-ID identity, noncanonical ordering, wrong group/decision-set/content/record digest, invalid supersession, unknown decision, cycles, incomplete invalidation, and active-separation violation. The Screening bridge additionally rejects stale snapshot/result, altered units, duplicate units, noncanonical bytes, missing members, wrong representatives, and candidate-digest mismatch.

Tests, extension points, and nonclaims

CorpusSnapshotTests, invalidation tests, reducer tests, and Screening binding tests cover equality, transitions, tamper, and exact coverage. Conformance cases are in screening-corpus-binding fixtures.

New downstream bindings belong in outward bridge packages. New invalidatable record kinds require explicit resolver and semantics. The module provides no mutable corpus table, Search/Deduplication execution, storage, release snapshot, PHP corpus-lock compatibility, automatic downstream invalidation, or final-review completeness claim.