Identities are derived, and every pin is verified where its object is present

A population's hash is derived from what makes it that population — the brief and ontology it was built for, its seed, every persona, its social graph and communities — and a graph's hash from its ties. A manifest still states both, because it travels where the personas do not, but a population refuses a manifest whose hashes are not its own. Before, both were free fields: two different populations could share a hash, and world identity, which derives from the population hash, rested on a value nothing checked.

A run configuration pins its brief, ontology, population, graph, templates, anchor sets and models by hash or identifier. Those pins are now verified wherever the pinned object is present. A trace partition's header carries the run configuration beside the brief pack, the population manifest and the scenario, and refuses any disagreement; its events must then use only pinned templates, anchor sets, embedding model and billed models, belong to personas in the population, and elicit against the brief's category — which also makes every elicitation in a world share one embedding model. A turn's memories cite earlier turns or reflections of the same persona by event id, and a world's lifecycle moves only through started, paused and completed.

The representative study's identities — population, graph and configuration hashes and world ids — are pinned per contract version, so a hashed shape cannot change under an unchanged version without a test failing.

Consequences

Each partition header repeats the run configuration and the population's persona ids: tens of kilobytes against partitions of hundreds of megabytes. Unvalidated construction, the escape hatch for high-volume records, refuses raw mappings wherever a field expects a model, for trace events and graph edges alike.