\documentclass[12pt]{article}

\usepackage{amsmath,amssymb,amsthm}
\usepackage{tikz}
\usepackage{tikz-cd}
\usepackage[margin=1in]{geometry}
\usepackage{xcolor}
\usepackage{hyperref}
\usepackage[capitalise,noabbrev]{cleveref}
\usepackage{booktabs}
\usepackage{longtable}
\usepackage{tabularx}
\usepackage{array}
\usepackage{ragged2e}
\usepackage{enumitem}
\usepackage{microtype}
\usepackage{listings}
\usepackage{pdflscape}
\usepackage{url}
\usepackage[numbers,sort&compress]{natbib}

\hypersetup{
  colorlinks=true,
  linkcolor=blue!45!black,
  citecolor=green!35!black,
  urlcolor=blue!55!black,
  pdftitle={Identity, Equivalence, and Reconciliation across Heterogeneous Data Systems},
  pdfauthor={Matthew Long; The YonedaAI Collaboration}
}

\newtheorem{proposition}{Proposition}[section]
\theoremstyle{definition}
\newtheorem{definition}[proposition]{Definition}
\newtheorem{example}[proposition]{Example}
\newtheorem{requirement}[proposition]{Requirement}
\theoremstyle{remark}
\newtheorem{remark}[proposition]{Remark}
\newtheorem{conjecture}[proposition]{Open conjecture}

\newcommand{\CatDB}{\textsc{CatDB}}
\newcommand{\code}[1]{\texttt{#1}}
\newcommand{\ev}[1]{\textsc{#1}}
\newcommand{\prior}{\ev{SUPPORTED BY PRIOR LITERATURE}}
\newcommand{\enghyp}{\ev{ENGINEERING HYPOTHESIS}}
\newcommand{\openstatus}{\ev{OPEN}}
\newcommand{\obstructed}{\ev{OBSTRUCTED}}
\newcommand{\openconj}{\ev{OPEN CONJECTURE}}
\newcommand{\speculative}{\ev{SPECULATIVE}}
\newcommand{\status}[1]{\par\noindent{\normalfont\textit{Evidence status.} #1.}\par}
\newcommand{\SourceRef}{\mathsf{SourceRef}}
\newcommand{\CanonicalRef}{\mathsf{CanonicalRef}}
\newcommand{\Evidence}{\mathsf{Evidence}}
\newcommand{\MethodResult}{\mathsf{MethodResult}}
\newcommand{\Decision}{\mathsf{Decision}}
\newcommand{\Project}{\mathsf{Project}}
\newcommand{\Candidates}{\mathsf{Candidates}}
\newcommand{\same}{\mathrel{\sim}}
\newcolumntype{L}[1]{>{\RaggedRight\arraybackslash}p{#1}}
\newcolumntype{Y}{>{\RaggedRight\arraybackslash}X}

\setlength{\emergencystretch}{4em}
\setlist{itemsep=0.25em,topsep=0.4em}
\lstset{
  basicstyle=\ttfamily\footnotesize,
  breaklines=true,
  breakatwhitespace=false,
  columns=fullflexible,
  frame=single,
  rulecolor=\color{black!20},
  showstringspaces=false
}

\definecolor{grokgray}{RGB}{110,110,110}
\AddToHook{shipout/background}{%
  \ifnum\value{page}=1
    \begin{tikzpicture}[remember picture,overlay]
      \node[
        rotate=90,
        anchor=south,
        font=\Large\sffamily\bfseries\color{grokgray},
        inner sep=0pt
      ] at ([xshift=38pt,yshift=0.52\paperheight]current page.south west)
      {GrokRxiv:2026.07.catdb-identity-reconciliation\quad
       [\,cs.DB\,]\quad
       23 Jul 2026};
    \end{tikzpicture}
  \fi
}

\title{Identity, Equivalence, and Reconciliation\\
across Heterogeneous Data Systems}
\author{Matthew Long \\
\textit{The YonedaAI Collaboration} \\
\textit{YonedaAI Research Collective} \\
Chicago, IL \\
\texttt{matthew@yonedaai.com} $\cdot$ \url{https://yonedaai.com}}
\date{23 July 2026}

\begin{document}
\maketitle

\begin{abstract}
Two records can look alike without naming the same thing.  They can also name
the same thing while looking quite different.  In an integration platform, a
mistaken match can quietly change joins, counts, materialized views, and
writes.  This paper specifies a provisional identity and reconciliation layer
for \CatDB{}.  The design keeps four artifacts separate: immutable
source-local references, observed evidence, versioned method results, and
authority-bearing reconciliation decisions.  A canonical identity is a
versioned projection of admitted decisions under a named identity profile. It
is not an ontological fact inferred from a score.

The model records source-local identity, canonical anchors, candidate links,
possible and probable equivalence, confirmed sameness, confirmed difference,
contradiction, supersession, retraction, and versioned identity as distinct
states and artifacts.
Only effective \code{confirmed-same} decisions may enter an equivalence
projection.  Vector similarity and approximate nearest-neighbor search may
generate candidates or features, but they cannot establish semantic identity
by themselves.  The paper also specifies scoped authority and source
ownership, along with bitemporal replay, provenance, logical reversal,
downstream invalidation, and strict versus partial federation behavior.

The contribution remains an \enghyp{}.  Probabilistic record linkage,
merge/purge, blocking, collective resolution, declarative matching,
human-in-the-loop matching, identity uncertainty, Semantic Web equality,
provenance, and large-scale entity-matching systems are established prior
work.  A repository audit found no accepted identity profile,
\code{catdb-identity} crate, identity fixture family, Haskell identity oracle,
Lean identity theorem, reconciliation state machine, calibrated matcher, or
P7 experiment.  Every CatDB runtime claim is therefore \openstatus{} or
\obstructed{}.  The strongest plausible systems contribution is narrower: an
auditable, typed, versioned decision layer that preserves uncertainty and
evidence, applies scoped authority, supports admitted reversals, and exposes
their consequences across mappings, federation, materialization, provenance,
and workspaces.  The implementation and experimental gates defined here must
determine whether that combination is useful.
\end{abstract}

\tableofcontents

\section{Introduction}
\label{sec:introduction}

\subsection{One customer, three records, and four different questions}

Consider a retailer that runs a sales database, a billing service, and a
support system.  The sales database has customer \code{crm:4821}; billing has
account \code{billing:773}; support has contact \code{ticketing:51}.  The names
are similar, and two records share an email address.  The third record was
created after that address changed, but its delivery address and purchase
history are compatible with the first record.

An integration engineer might ask whether these records belong to the same
household, natural person, billing account, or legal contracting party.  Those
are different relations, not four phrasings of one relation.
The first may group family members; the third may deliberately separate
accounts held by one person; the fourth may depend on jurisdiction and
effective date.  Even the apparently simple question ``same person'' depends
on source-key reuse, time, evidence quality, and authority.

Suppose a vector index places the three records near each other.  The result
is useful because the system has avoided comparing every record with every
other record.  It is not a decision.  The embedding was trained for a declared
objective, uses a particular projection of the source fields, and may return
semantically similar but distinct people.  Approximate search may also omit a
true neighbor.  A classifier score is another method result.  Human review
adds a judgment, and a source owner may supply an authoritative crosswalk.
The final merge must not overwrite any of them.

The risk extends beyond a wrong label.  If the system treats a likely match
as equality, a federated query may undercount customers.  A materialized view
may combine balances, a workspace merge may propagate the decision, and a
write-through policy may update the wrong source.  Removing one pair edge
later may neither reconstruct the old partition nor reveal where synthesized
values belong.

This paper examines the semantic boundary before those actions.  It asks:

\begin{quote}
How can identity evidence remain explicit without collapsing uncertainty?
\end{quote}

\subsection{The proposed answer}

Within an immutable identity profile, \CatDB{} should represent separately:

\begin{enumerate}
  \item source-local references and their key/snapshot regimes;
  \item positive, negative, missing, and dependent evidence;
  \item deterministic outcomes, likelihood ratios, probabilities,
  similarities, ranks, and human judgments;
  \item scoped authority and source ownership;
  \item proposals, approvals, rejections, contradictions, supersessions, and
  reversals; and
  \item the canonical partition projected from effective confirmed decisions
  at a declared valid-time and system-time cut.
\end{enumerate}

The profile fixes the entity type and exact identity question, as well as the
context, time policy, admitted evidence and methods, decision states,
authority, constraints, cluster policy, disclosure, retention, downstream
obligations, and normalization.  A canonical anchor names one versioned
decision history.  It neither replaces its member source references nor
claims universal, metaphysical, or legal identity.

\subsection{Research contribution and evidence boundary}

Record linkage has a mature statistical foundation
\cite{FellegiSunter1969,Jaro1989}.  Duplicate detection, match/merge systems,
identity uncertainty, collective resolution, declarative constraints,
crowdsourced review, and learned matching all precede this proposal
\cite{HernandezStolfo1995,BenjellounEtAl2009,PasulaEtAl2002,
DongHalevyMadhavan2005,BhattacharyaGetoor2007,BienvenuEtAl2022,
BertossiEtAl2011,WangEtAl2012,GokhaleEtAl2014,KondaEtAl2016,
MudgalEtAl2018,LiEtAl2020}.  Approximate vector systems establish efficient
similarity retrieval, not identity \cite{MalkovYashunin2020,
JohnsonDouzeJegou2021}.  OWL gives \code{owl:sameAs} strong equality
semantics, while SKOS offers weaker concept-mapping relations
\cite{OWL2RDFSemantics2012,HalpinEtAl2010,SKOS2009}.  W3C PROV supplies an
interchange vocabulary for derivation, attribution, delegation, revision,
and invalidation, but not this paper's decision state machine
\cite{PROVO2013}.

The proposed delta is not a new matcher.  It is the composition of identity
artifacts with \CatDB{}'s typed mappings, provenance, versioning, federation,
and materialization boundaries.  That composition remains unimplemented.
This manuscript provides a candidate contract, examples, falsifiers, a
prior-art boundary, an implementation roadmap, and a preregistered evaluation
design.  It reports no CatDB identity accuracy, calibration, scalability,
reversibility, or machine-checked theorem.

\subsection{Paper organization}

\Cref{sec:evidence} fixes the evidence vocabulary and current audit.
\Cref{sec:questions} gives the hypothesis and falsification boundary.
\Cref{sec:model} defines the identity profile and artifact types.
\Cref{sec:states} defines uncertain and effective states.
\Cref{sec:methods} separates deterministic, probabilistic, vector, and
collective methods.  \Cref{sec:authority,sec:time,sec:crosslayer} treat
authority, provenance, reversal, and integration.  \Cref{sec:formal} states
the formal targets without presenting them as proved.
\Cref{sec:example} follows one reconciliation case.
\Cref{sec:related} locates the proposal in prior work.
\Cref{sec:implementation,sec:evaluation} define the build and experiment
program.  The final sections retain limitations, open questions, and exact
nonclaims.

\section{Evidence vocabulary and repository audit}
\label{sec:evidence}

\subsection{Binding labels}

The labels in \cref{tab:evidence-labels} apply to every result-like statement.
They prevent a design sketch from being narrated as a system result and a
program run from being narrated as proof of real-world identity.

\begin{table}[ht]
\centering
\small
\caption{Evidence labels used in this paper.}
\label{tab:evidence-labels}
\begin{tabularx}{\textwidth}{L{0.27\textwidth}Y}
\toprule
Label & Meaning \\
\midrule
\prior & A primary paper, standard, or official system artifact establishes
the claim within its assumptions. \\
\enghyp & A proposed CatDB behavior that requires implementation and
experiment. \\
\openstatus & Definitions, code, fixtures, experiments, or review are not
complete. \\
\obstructed & A prerequisite semantic boundary is missing, so implementation
or testing would be premature. \\
\openconj & A mathematical statement remains unproved. \\
\speculative & The claim is too underspecified for a stronger label. \\
\bottomrule
\end{tabularx}
\end{table}

No P7 claim is labelled \code{proved}, \code{machine-checked},
\code{computational}, or \code{experimentally supported}.  Those labels are
reserved for exact future artifacts.  Existing Rust, Haskell, and Lean work
on categorical identity paths or identity schema mappings concerns algebraic
identity operations, not entity identity.

\subsection{What exists}

The repository contains a P7 manifest and dependency edges, a proposed shared
claim, terminology, a primary-source map, a detailed evidence dossier, and a
smaller accepted semantic core for schema paths and mappings.  The dossier
also defines candidate identity fixture families, implementation phases,
formal targets, benchmark questions, and review gates.

These are author-side research artifacts.  They establish that the proposal
has a falsifiable scope.  They do not establish any identity decision,
canonical partition, reversal, or performance property.

\subsection{What does not exist}

At the evidence cut used for this paper, the repository has no:

\begin{itemize}
  \item accepted identity profile or profile validator;
  \item identity fixture family or normalized result manifest;
  \item \code{catdb-identity} crate;
  \item deterministic entity-resolution rule engine;
  \item Fellegi--Sunter evaluator or calibrated learned matcher;
  \item vector-candidate adapter with decision-path separation;
  \item authority or source-ownership policy implementation;
  \item human-review artifact model or reconciliation state machine;
  \item canonical projection, bitemporal replay, or reversible merge;
  \item downstream invalidation implementation;
  \item Haskell identity oracle or Lean identity theorem; or
  \item P7 benchmark, security analysis, or human study.
\end{itemize}

The overall P7 status is therefore \obstructed{}.  Some isolated tasks are
\openstatus{}, while cross-layer tasks depend on unfinished mapping,
materialization, workspace, policy, or provenance semantics.

\subsection{Dependency boundary}

P7 depends on three upstream paper programs:

\begin{enumerate}
  \item P1 supplies immutable typed entities, values, paths, equations, and
  stable semantic references.
  \item P4 supplies the record-preserving interpretation of source-to-domain
  mappings.  A field mapping must not become an identity assertion.
  \item P13 supplies provenance identities for sources, observations,
  methods, policies, actors, decisions, revisions, and derived products.
\end{enumerate}

P5 is an execution dependency when federated answers reconcile records.  P6
is needed to invalidate materializations after reversal.  P7 in turn blocks
safe write propagation in P8 and semantic workspace merge in P9.

\section{Research question, hypothesis, and falsification}
\label{sec:questions}

\subsection{Primary hypothesis}

Let \(R\) be immutable source-record references, \(P\) a versioned identity
profile, \(E\) typed evidence observations, \(M\) versioned deterministic or
probabilistic methods, \(A\) scoped authority policies, \(D\) reconciliation
decisions, and \(C\) canonical anchors.  For entity type \(\tau\), context
\(\chi\), and validity interval \(\nu\), the proposed operation is
\[
\operatorname{reconcile}_{P} :
  (R,E,M,A,D)
  \longrightarrow
  (\widehat D,C,\mathcal O),
\]
where \(\widehat D\) contains proposed or revised decisions and
\(\mathcal O\) contains validation, review, provenance, disclosure,
invalidation, and execution obligations.

The hypothesis is that a finite, explicitly delimited profile can preserve
source references, keep evidence and decisions distinct, prevent uncertain
edges from entering equality, apply scoped authority, retain contradictions,
support an admitted reversible fragment, reproduce historical projections,
and expose downstream consequences.
\status{\enghyp}

\subsection{Strongest defensible first target}

The first useful result should be deliberately small:

\begin{itemize}
  \item two entity types, for example \code{Person} and
  \code{Organization};
  \item four sources with immutable record and snapshot references;
  \item exact and composite-key deterministic rules;
  \item one Fellegi--Sunter-style probabilistic matcher;
  \item one supervised pair classifier;
  \item one exact and one approximate vector candidate generator;
  \item explicit candidate, possible, probable, confirmed-same,
  confirmed-different, contradicted, superseded, and retracted states;
  \item one source-owner and one cross-domain approval policy;
  \item append-only bitemporal decision events;
  \item one admitted merge, split, and supersession fragment;
  \item P13-compatible provenance projection;
  \item deterministic Rust/Haskell agreement on shared fixtures; and
  \item selected Lean invariants over transitions and projections.
\end{itemize}

This target excludes universal identity, unrestricted biometric linkage,
legal identity across jurisdictions, automatic cross-tenant write-back, and
claims that one model transports across domains.

\subsection{Falsification conditions}

The hypothesis must be narrowed or rejected if any supported profile allows:

\begin{enumerate}
  \item destruction of a source record or source-local identifier during
  canonicalization;
  \item candidate generation to alter the effective canonical partition;
  \item possible or probable edges to be transitively closed as equality;
  \item confirmed-same across types or scopes without an explicit coercion;
  \item a cannot-link pair to share an accepted anchor;
  \item a decision without exact evidence, method, feature, threshold,
  policy, authority, and source-snapshot revisions;
  \item an uncalibrated score to be displayed as a probability;
  \item nondeterministic normalized output for the same immutable input;
  \item nonreproducible replay at the same system-time cut;
  \item a claimed supported reversal that cannot reconstruct the prior
  partition;
  \item a reversed decision to leave an affected artifact presented as
  current;
  \item an actor to approve outside recorded authority;
  \item source ownership to disappear after canonicalization;
  \item approximate-search misses to be absent from candidate-recall
  reporting;
  \item missing evidence to be treated as negative evidence;
  \item partial source availability to be presented as complete;
  \item model drift to leave old outputs current without revalidation; or
  \item claimed workflow benefit to vanish after review, provenance,
  calibration, candidate, repair, and reversal costs are counted.
\end{enumerate}

These falsifiers are more important than the product vocabulary.  A system
that stores the proposed record shapes but violates them would not satisfy
the P7 hypothesis.

\section{A profile-relative identity model}
\label{sec:model}

\subsection{Source-local identity}

\begin{definition}[Source-local reference]
A source-local reference is a tuple
\[
\SourceRef =
(\text{source},\text{namespace},\text{record key},\text{snapshot}).
\]
Its interpretation is fixed by a source regime that declares key stability,
reuse, deletion, tombstone, alias, and snapshot behavior.
\end{definition}

A source-local reference makes an observed record addressable.  It does not
make the key global, unrecycled, correct, or authoritative.  Nor does it say
that equal keys in two namespaces denote the same entity.  A durable source
reference is therefore a prerequisite for reconciliation, not its outcome.

\subsection{Canonical identity anchor}

\begin{definition}[Canonical anchor]
A canonical anchor is an immutable identifier
\[
\CanonicalRef =
(\text{identity profile},\text{anchor ID},\text{revision})
\]
for a versioned canonicalization history.
\end{definition}

The current membership of an anchor is derived from effective decisions at a
declared time cut.  Member source references remain intact.  The anchor is
not a natural key, an \code{owl:sameAs} assertion by default, a guarantee that
every member is correct, or evidence that no unobserved duplicate exists.

\subsection{Identity profile}

\begin{definition}[Identity profile]
An identity profile is an immutable, content-addressed contract
\[
P=(\tau,q,\chi,V,S,E,M,K,D,A,H,G,X,L,N),
\]
where \(\tau\) is the entity type, \(q\) the exact identity question,
\(\chi\) the context, \(V\) the valid-time policy, \(S\) source regimes,
\(E\) evidence types, \(M\) methods, \(K\) candidate policy, \(D\) decision
states, \(A\) authority policy, \(H\) hard constraints, \(G\) cluster policy,
\(X\) disclosure and retention policy, \(L\) downstream obligations, and
\(N\) normalization.
\end{definition}

The identity question is first-class.  ``Same household,'' ``same person,''
``same patient chart,'' ``same customer account,'' and ``same legal
organization'' denote different relations.  Decisions under different
profiles are not automatically comparable or composable.
\status{The identity-profile contract is \obstructed{} pending P4 and P13
reference semantics.}

\subsection{Four artifact kinds}

P7 requires four typed artifacts rather than one overloaded match edge.

\begin{definition}[Evidence observation]
An evidence observation records subjects, source artifact and snapshot,
observed value or digest, evidence kind, polarity, independence group,
sensitivity, valid interval, and provenance.  It records what was observed,
not what decision should be effective.
\end{definition}

\begin{definition}[Method result]
A method result records the method revision, input evidence, candidate pair
or cluster, output kind and value, calibration population, threshold,
uncertainty, feature digest, generation time, and provenance.
\end{definition}

An output kind may be a deterministic rule outcome, likelihood ratio,
estimated posterior, classifier score, calibrated probability, vector
distance, candidate rank, cluster proposal, or \code{unsupported}.  These
forms are not interchangeable.

\begin{definition}[Reconciliation decision]
A reconciliation decision records a profile, subjects, prior decisions,
proposed and effective states, evidence and method results, policy revision,
actor, authority scope, approvals, reason, valid interval, system time,
supersession, reversal, obligations, and provenance.
\end{definition}

\begin{definition}[Canonical projection]
For profile \(P\), valid-time cut \(t_v\), and system-time cut \(t_s\),
\[
\Project(P,t_v,t_s)
\]
is the normalized partition and conflict report computed from decisions
visible at \(t_s\) and effective at \(t_v\).
\end{definition}

The proposed projection excludes retracted or superseded decisions according
to profile rules, enforces confirmed-different constraints, retains
unresolved references separately, reports contradictions, and is independent
of incidental input enumeration.

\subsection{Evidence is not one scalar}

The model keeps apart:

\begin{itemize}
  \item strength of an observation for or against sameness;
  \item a method's reported confidence;
  \item calibration of probabilities on a declared population;
  \item measured source reliability;
  \item institutional source authority;
  \item ownership of the source record;
  \item reviewer authority;
  \item operational decision status; and
  \item truth in the modeled world.
\end{itemize}

Truth-discovery work can model source reliability and dependence
\cite{YinHanYu2007,DongBertiEquilleSrivastava2009}.  Proper scoring rules can
evaluate forecasts \cite{GneitingRaftery2007}.  Neither statistical result
grants an institution authority over a record or turns a probability into an
operational decision.

\section{Uncertainty, equivalence, and contradiction}
\label{sec:states}

\subsection{Required states}

\Cref{tab:states} is the minimum state vocabulary.  It deliberately refuses
to make uncertainty transitive.

\begin{table}[ht]
\centering
\small
\caption{Decision states and their effect on canonical identity.}
\label{tab:states}
\begin{tabularx}{\textwidth}{L{0.20\textwidth}Y L{0.17\textwidth}}
\toprule
State & Meaning & Canonical effect \\
\midrule
\code{candidate} & Retrieved for detailed comparison. & none \\
\code{possible} & Evidence makes sameness plausible but insufficient. & none \\
\code{probable} & A calibrated method crosses a profile threshold. & none by default \\
\code{confirmed-}\allowbreak\code{same} & Authorized sameness decision within profile and time. & equivalence edge \\
\code{confirmed-}\allowbreak\code{different} & Authorized cannot-link decision. & merge constraint \\
\code{contradicted} & Effective evidence or decisions conflict. & blocks or routes review \\
\code{superseded} & A later decision replaces operational effect. & determined by successor \\
\code{retracted} & Decision withdrawn while history remains. & none \\
\code{expired} & Time or policy ended operational effect. & none \\
\bottomrule
\end{tabularx}
\end{table}

The three Fellegi--Sunter action regions motivate match, possible-match, and
nonmatch handling \cite{FellegiSunter1969}.  They do not establish the full
state machine above, and P7 must not attribute it to that theory.

\subsection{Confirmed equivalence}

Within one profile and time cut, only the effective
\code{confirmed-same} relation is intended to generate an equivalence
projection:
\[
\begin{aligned}
r &\same r,\\
r_1\same r_2 &\Longrightarrow r_2\same r_1,\\
r_1\same r_2\land r_2\same r_3
  &\Longrightarrow r_1\same r_3.
\end{aligned}
\]

Candidate, possible, probable, vector-neighbor, and shared-evidence relations
need not obey these laws.  Their graph may be asymmetric, nontransitive,
incomplete, or inconsistent.

\begin{requirement}[No uncertain closure]
No \code{candidate}, \code{possible}, or \code{probable} edge may change a
canonical partition unless a separate authorized transition creates an
effective \code{confirmed-same} decision.
\end{requirement}
\status{\obstructed{} until profile semantics, executable projection, and
machine-checked safety invariants exist.}

\subsection{Confirmed difference}

\code{confirmed-different} is symmetric for its subject pair but is not a
general transitive relation.  If \(a\) cannot link to \(b\), and \(b\) cannot
link to \(c\), nothing follows automatically about \(a\) and \(c\).  An
accepted partition must reject any cluster containing an active cannot-link
pair and return a conflict witness rather than silently dropping the
constraint.

\subsection{Contradiction as data}

A contradiction may arise from a proposed merge crossing a cannot-link,
disagreement between authoritative sources, incompatible time intervals,
type or cardinality violation, model/reviewer disagreement, or a source
supersession that conflicts with local evidence.  The system must preserve
both sides and route the conflict according to policy.  Last-writer-wins is
not an identity semantics.

\subsection{State transitions}

Candidate transitions include:
\[
\begin{array}{rcl}
\code{candidate}&\to&\code{possible},\ \code{probable},\
  \code{confirmed-different},\\
\code{possible}&\to&\code{probable},\
  \code{confirmed-same},\ \code{confirmed-different},\\
\code{probable}&\to&\code{confirmed-same},\
  \code{confirmed-different}.
\end{array}
\]
Any active decision may become contradicted; any effective decision may be
superseded; an admitted reversible decision may be retracted.  Every
transition records the actor or method, policy, time, authority check, and
provenance.  A rescore appends a new result; it does not mutate the old one.

\section{Methods produce evidence, not identity}
\label{sec:methods}

\subsection{Deterministic rules}

A deterministic rule may evaluate typed positive predicates \(p_i\) and
negative predicates \(q_j\):
\[
\operatorname{Rule}_k(r_i,r_j)
  =
  \bigwedge_{\ell=1}^{n}p_\ell(r_i,r_j)
  \land
  \bigwedge_{m=1}^{s}\neg q_m(r_i,r_j).
\]
Examples include equal source-certified immutable identifiers, equal
normalized composite keys within a jurisdiction and interval, source-declared
aliases, or an approved internal crosswalk.

The rule record must include normalizers, null behavior, key-reuse policy,
time scope, negative predicates, and authority.  Deterministic means
reproducible under fixed input.  It does not mean true.  Identifiers are
mistyped and reused; household keys are confused with person keys; defaults
compare equal; composite keys omit differentiating fields; source meaning
changes.  Every rule therefore needs adversarial fixtures and measured
precision on its intended population.

Merge/purge and sorted-neighborhood work provides an established large-scale
deduplication baseline \cite{HernandezStolfo1995}.  Generic match/merge
frameworks such as Swoosh expose useful algebraic conditions
\cite{BenjellounEtAl2009}.  P7 must state whether any admitted operation
actually satisfies idempotence, commutativity, associativity, or
representativity; naming a typed rule does not grant those properties.

\subsection{Probabilistic record linkage}

For comparison vector \(\gamma\), the classical likelihood ratio is
\[
\Lambda(\gamma)
  =
  \frac{\Pr(\gamma\mid M)}
       {\Pr(\gamma\mid U)},
\qquad
w(\gamma)=\log\Lambda(\gamma),
\]
where \(M\) denotes matching pairs and \(U\) nonmatching pairs
\cite{FellegiSunter1969}.  Thresholds divide pairs into link,
possible-link/review, and nonlink actions under declared errors or costs.
Operational record-linkage work demonstrates how such methodology is applied
in practice \cite{Jaro1989}.

P7 must not present \(w\) as a calibrated posterior by default, assume
comparison-field independence, reuse thresholds across populations, ignore
blocking-induced selection, or convert a high-probability pair into confirmed
identity without policy and authority.

Every probabilistic result should retain the model and feature revisions,
training or estimation population, blocking policy, prevalence if used,
threshold and cost revision, calibration population, uncertainty, leakage
audit, source/schema revisions, and result digest.

\subsection{Calibration and decisions}

If the interface says ``70\% match probability,'' roughly 70\% of comparable
held-out cases in the declared population should be matches.  Required
evidence includes reliability diagrams, Brier and log scores, calibration
intercept and slope where applicable, bin counts, confidence intervals, and
drift by source, time, entity type, and missingness.  Proper scoring rules
provide the relevant statistical foundation \cite{GneitingRaftery2007}.

The action still depends on a declared loss
\[
\mathcal L(a,y),
\qquad
a\in\{\text{link},\text{review},\text{nonlink}\}.
\]
A high-consequence profile may require review at high probability.  A
calibrated probability is evidence for a policy decision, not an
authority-bearing decision itself.

\subsection{Candidate generation and vector retrieval}

Candidate generation reduces the comparison space:
\[
\Candidates_k(r)\subseteq R\setminus\{r\}.
\]
Learned and iterative blocking are established approaches
\cite{MichelsonKnoblock2006,WhangEtAl2009}.  Candidate methods are evaluated
with pair completeness or candidate recall, reduction ratio, latency, and
cost.  A missed true pair is unavailable to a perfect downstream matcher.

Let \(e:R\to\mathbb R^d\) be an embedding and \(d\) a distance.  The relation
\[
d(e(r_i),e(r_j))\leq\epsilon
\]
or a nearest-neighbor rank does not imply
\[
\operatorname{denotes}(r_i)=\operatorname{denotes}(r_j).
\]
The embedding is trained for a declared objective; proximity changes with
model, preprocessing, metric, corpus, and threshold; approximate retrieval
may miss items; similar entities can be distinct; one entity can drift apart;
distance is generally nontransitive; rank depends on the indexed population;
and no authority is encoded in the vector.

HNSW and Faiss establish scalable approximate similarity search
\cite{MalkovYashunin2020,JohnsonDouzeJegou2021}.  DeepMatcher and Ditto
establish learned pair-classification baselines
\cite{MudgalEtAl2018,LiEtAl2020}.  None establishes semantic identity from
raw proximity.

\begin{requirement}[Vector safety boundary]
A vector adapter emits only a method result labelled
\code{candidate}.  It cannot invoke the effective-decision path.
\end{requirement}
\status{\openstatus{}.  No adapter or misuse test exists.}

\subsection{Pair scores are not partitions}

Suppose
\[
\Pr(a=b)=0.92,\qquad
\Pr(b=c)=0.91,\qquad
\Pr(a=c)=0.08.
\]
Thresholding the first two scores and taking connected components merges all
three records despite strong contrary evidence.  A partition needs an
explicit cluster policy over positive and negative evidence, constraints,
time, objective, solver status, and deterministic tie-breaking.

Correlation clustering supplies a baseline objective for positive and
negative pair labels \cite{BansalBlumChawla2004}.  Relationship-aware and
collective resolution can improve decisions but makes evidence dependent
\cite{DongHalevyMadhavan2005,BhattacharyaGetoor2007}.  Declarative work on
matching dependencies and LACE supplies rule, constraint, chase, and
collective baselines \cite{BertossiEtAl2011,BienvenuEtAl2022}.  P7 cannot
claim novelty merely for storing rules in a typed file.

\subsection{Human review}

Active learning, crowdsourcing, and end-to-end entity-matching systems already
combine machine and human work
\cite{SarawagiBhamidipaty2002,WangEtAl2012,GokhaleEtAl2014,KondaEtAl2016}.
Human review is therefore neither a new contribution nor an oracle.

A review artifact should retain the evidence shown and withheld, reviewer and
principal, authority scope, decision and confidence, reason, duration,
exposure to model output, conflicts, second review, adjudication, and later
reversal.  The proposed CatDB delta is durable and reversible decision
semantics across layers, not the existence of a review queue.

\section{Authority, ownership, and provenance}
\label{sec:authority}

\subsection{Scoped authority}

An authority grant is scoped by principal, organization, role, operation,
entity type, source or canonical domain, tenant, jurisdiction, valid and
system time, risk class, quorum, delegation chain, and revocation revision.
Authority is checked when a decision becomes effective, not only when
proposed.

A statistically reliable source may lack authority to decide a legal
relationship.  An authoritative source may still be wrong.  A reviewer may
understand the evidence but lack permission across a tenant boundary.  These
cases require separate fields and separate failure modes.
\status{Authority non-bypass is \obstructed{} pending a shared policy
semantics and adversarial implementation tests.}

\subsection{Source ownership}

Canonicalization does not transfer source ownership.  For every source
record, the decision projection should disclose its owner, read/write policy,
any governed attribute authority, and update route.  For every canonical
attribute, it should disclose whether the value was copied, selected,
synthesized, or left disputed.

Entity identity and data fusion are distinct.  Two records can be confirmed
as the same entity while their addresses, names, balances, or dates remain
in conflict.  A merge that silently chooses one value has performed an
additional, unrecorded decision.

\subsection{Provenance projection}

P7 depends on P13 for immutable source tokens, evidence derivation, method and
policy identity, actor and delegation, revision, invalidation, downstream
dependence, disclosure, and retention.  P7 adds a reconciliation-specific
decision object.  Neither paper should invent incompatible artifact IDs.

One prospective W3C PROV projection is:

\begin{table}[ht]
\centering
\small
\caption{Prospective P7 to PROV-O projection.}
\label{tab:prov}
\begin{tabularx}{\textwidth}{L{0.31\textwidth}Y}
\toprule
P7 artifact & PROV-O representation \\
\midrule
source record or snapshot & \code{prov:Entity}, with specialization if needed \\
evidence observation & entity generated by an observation activity \\
model, rule, or policy & \code{prov:Plan} or versioned entity \\
matching or review & \code{prov:Activity} \\
reviewer, service, organization & \code{prov:Agent} \\
decision & entity generated by the activity \\
approval role & qualified association with \code{prov:Role} \\
delegation & qualified delegation \\
revised decision & \code{prov:wasRevisionOf} \\
retracted decision & qualified invalidation \\
\bottomrule
\end{tabularx}
\end{table}

PROV-O establishes an interchange model for these relations
\cite{PROVO2013}.  It does not define P7's states, probability semantics,
calibration, authorization, or confirmed equivalence.  An exporter must
therefore report information loss.

\subsection{Audit questions}

An implementation should answer:

\begin{enumerate}
  \item Which source records belong to an anchor at a given valid and system
  time?
  \item Which evidence supported and opposed the decision?
  \item Which rule or model revision produced each result?
  \item What population calibrated any displayed probability?
  \item Who proposed, approved, rejected, superseded, or reversed the
  decision?
  \item Which authority and delegation were in force?
  \item Who owns each source record?
  \item Which mappings, queries, and materializations depend on the decision?
  \item What became stale after contradiction or reversal?
  \item Which evidence is hidden, expired, or redacted?
  \item Can the prior projection be reproduced?
\end{enumerate}

Every answer must state completeness and disclosure limits.  Provenance
describes origin and process; it does not prove that the identity decision is
true.

\section{Time, supersession, and reversible reconciliation}
\label{sec:time}

\subsection{Bitemporal decisions}

A decision may have valid time, describing when it is intended to hold in
the modeled domain, and system time, describing when \CatDB{} recorded it.
This allows the statement ``the records referred to the same legal
organization during 2024'' to remain separate from ``the system learned in
2026 that its earlier conclusion was wrong.''

The profile must state whether identity is endurant, time-indexed, or modeled
through explicit succession.  Adding timestamps without this policy does not
resolve the conceptual choice.

\subsection{Supersession}

Supersession may mean corrected duplicate, account replacement, corporate
succession, renamed identifier, source redirect, revised decision, or policy
revision.  Only some of these imply sameness.  A supersession edge therefore
needs a typed reason, direction, interval, authority, and declared effect on
canonical membership.

\subsection{Logical reversal}

A merge is admitted as logically reversible only when:

\begin{enumerate}
  \item every source record remains an immutable reference;
  \item the prior canonical partition remains reconstructible;
  \item the merge decision is append-only and can be superseded or retracted;
  \item synthesized attributes retain derivation;
  \item downstream artifacts name the decision revision they used;
  \item reversal emits invalidation and recomputation obligations;
  \item historical queries reproduce the earlier projection; and
  \item failed reversal attempts remain recorded.
\end{enumerate}

Logical reversal does not make physical repair free.  Indexes and
materializations may need rebuilding.  External writes may need
compensation.  Deleted or redacted evidence may make reversal unsupported.

\subsection{Splitting a merged cluster}

Removing one pair edge is insufficient when a canonical cluster has many
members.  The system must compute a new partition, assign derived facts by
provenance, retain ambiguous facts, and disclose external effects that cannot
be undone.  The first profile should support only a fragment whose affected
decisions and dependencies are complete; other cases return
\code{reconciliation-dependent} or \code{unsupported}.
\status{Reversal and invalidation are \obstructed{} on P6, P9, and P13.}

\section{Cross-layer contracts}
\label{sec:crosslayer}

\subsection{Composable integration}

P4 mappings may transform source fields into typed candidate inputs.  They
must preserve original source references and mapping loss.  They may not
identify records merely because mapped fields align, treat object synthesis
as canonical identity, or compose uncertain identity edges as lawful schema
mappings.

Any \(N+M\) integration-maintenance comparison must count identity profiles,
exceptions, approvals, contradictions, and reversal work.  If reconciliation
effort grows pairwise, the broader maintenance claim may fail.

\subsection{Federated query}

A federated result that reconciles records must carry:

\begin{itemize}
  \item identity profile and projection revision;
  \item source set, availability, and snapshot;
  \item candidate and matching methods;
  \item effective decision state;
  \item unresolved or contradictory records;
  \item confidence semantics and freshness; and
  \item provenance reference.
\end{itemize}

A strict query rejects when required identity decisions are unresolved.  A
partial query returns explicit unresolved groups and missing-source metadata.
It must not silently drop duplicates or merge likely matches.
\status{Identity-aware federation is \obstructed{} on the P5 result
contract and runtime.}

\subsection{Provenance and materialization}

P13 must not use identity evidence as proof of truth, and P7 must not use
provenance as proof of identity.  P6 must track every materialization or cache
whose content depends on a decision revision.  Reversal is sound only for the
recorded dependency closure.  An artifact outside that closure is a
completeness failure, not harmless missing metadata.

\subsection{Write propagation and workspaces}

P8 cannot infer writeability from confirmed identity.  A canonical anchor may
unify reads while source owners retain distinct write authority.  P9 cannot
merge workspace decisions with a file-level union: merge, cannot-link,
retraction, and authority changes can be noncommutative.  Conflicts require
semantic classification and, in some cases, coordination.

\section{Formal core and theorem roadmap}
\label{sec:formal}

\subsection{Why the formal target is narrow}

Formalization should verify the deterministic decision kernel, not whether a
person, organization, or product match is true.  A theorem may show that
uncertain edges never enter the confirmed partition.  It cannot show that the
evidence justifying a confirmed edge is factually correct.  A theorem may
show authority derivations are present under a policy model.  It does not
verify authentication, credentials, deployment, or organizational behavior.

\subsection{Finite core}

The proposed finite model includes source references, profiles, evidence and
method-result references, decision states, scoped grants, valid/system
intervals, decision events, and normalized projections.  Assumptions include
decidable equality, finite histories, well-formed references, interval
ordering, and acyclic supersession.
\status{\obstructed{} until identity-profile v1 is frozen.}

\subsection{State-transition safety}

\begin{conjecture}[Uncertain-state exclusion]
For every well-formed profile and event history, adding, removing, or
reordering events whose effective states are only \code{candidate},
\code{possible}, or \code{probable} leaves the confirmed-equivalence
projection unchanged.
\end{conjecture}

\begin{conjecture}[Decision witness]
Every effective confirmed decision has a well-formed profile, actor, policy,
authority derivation, evidence reference, and system-time record.
\end{conjecture}

Both statements are \openconj{}.  No Lean representation or declaration
exists.

\subsection{Confirmed-equivalence projection}

\begin{conjecture}[Projection soundness]
For a well-formed finite event history without an active conflict witness,
the projected \code{confirmed-same} relation is reflexive over admitted
active references, symmetric, and transitive after explicit closure; every
cluster member is traceable to effective confirmed decisions; and no active
cannot-link pair occupies one cluster.
\end{conjecture}

If closure conflicts with a cannot-link, the projection should be undefined
with a conflict witness rather than silently repaired.

\subsection{Replay}

\begin{conjecture}[Historical replay]
Under a deterministic total event order or a declared commutativity
relation, repeated replay is idempotent, causally independent permutations
are extensionally equal, system-time prefixes reproduce historical
projections, and later events do not alter earlier system-time results.
\end{conjecture}
\status{\openconj{}.  No event semantics or implementation exists.}

\subsection{Restricted reversal}

For an admitted merge \(m\), candidate inverse decision \(m^{-1}\), and state
\(s\), the desired law is
\[
\Project\bigl(m^{-1}(m(s))\bigr)\approx \Project(s),
\]
where extensional equality ignores new audit-event IDs but preserves source
references, cluster membership, constraints, ownership, and prior facts whose
derivation remains valid.

\begin{conjecture}[Restricted reversal law]
The equation above holds for the explicitly admitted reversible fragment and
fails closed when required provenance or dependency information is absent.
\end{conjecture}

This statement cannot cover irreversible external writes or deleted
derivations.  It is \openconj{} and operationally \obstructed{}.

\section{Running example: reconciling customer records}
\label{sec:example}

\subsection{Profile}

Return to the three systems in the introduction.  The profile asks:

\begin{quote}
Do two source records describe the same natural person within tenant
\code{north}, for customer-service analytics, during the overlapping valid
interval?
\end{quote}

This question excludes household, billing-account, and legal-party identity.
The profile admits CRM, billing, and ticketing references; exact and
normalized identifiers; incompatible birth date as negative evidence; a
Fellegi--Sunter result; vector candidates; one tenant reviewer role; a source
owner for each record; and a cannot-link constraint.  Vector retrieval may
propose a pair, but effective confirmed sameness requires human approval.

\subsection{Source references}

The immutable references are:
\[
\begin{aligned}
r_c&=(\code{crm},\code{customer},4821,s_c),\\
r_b&=(\code{billing},\code{account},773,s_b),\\
r_t&=(\code{ticketing},\code{contact},51,s_t).
\end{aligned}
\]
The billing key names an account, not necessarily a person.  Its mapping into
this profile therefore requires a typed person-holder projection and may be
partial.  The lexical key \code{773} itself supplies no cross-source
identity.

\subsection{Candidate and evidence}

An embedding index returns \((r_c,r_b)\) at rank 1 and \((r_c,r_t)\) at rank
3.  Each result records the model, projected fields, index revision, metric,
search parameters, rank, score, source filters, time, and an exact-search
recall audit.  Both remain \code{candidate}; neither changes an anchor.

For \((r_c,r_b)\), the evidence includes an equal verified email, compatible
name, overlapping interval, and a billing-holder identifier whose source
regime is documented.  For \((r_c,r_t)\), it includes a similar name and
address but incompatible authoritative birth dates.  Missing phone number is
recorded as missing, not as negative evidence.

\subsection{Method results and decision}

A versioned linkage method produces \(w(\gamma)=4.2\) for
\((r_c,r_b)\), in the review region, and \(w(\gamma)=3.9\) for
\((r_c,r_t)\).  These values are likelihood-ratio scores, not advertised as
probabilities.  A supervised classifier separately reports 0.88 and 0.84;
because its output is not calibrated on this tenant and source mixture, the
profile labels the values \code{classifier-score}, not
\code{match-probability}.

The tenant reviewer examines the first pair and approves
\code{confirmed-same} under their authority for customer-service person
identity.  The second pair becomes \code{contradicted} because positive
similarity conflicts with the birth-date cannot-link.  The current projection
creates one anchor for \(r_c\) and \(r_b\), keeps \(r_t\) separate, and
preserves all evidence.

\subsection{Attribute conflict}

The merged records have different postal addresses, and an identity decision
does not choose between them.  A canonical query may return both with
provenance, apply a separate valid-time and attribute-authority rule, or
return an explicit conflict.  Silently copying the billing address would
conflate identity with fusion.

\subsection{Reversal}

Later, the billing source reports that account 773 was reassigned.  This
assertion is new evidence, not a mutation of the original record.  The prior
decision becomes contradicted, then an authorized reviewer retracts it.  A
supported reversal would:

\begin{enumerate}
  \item reconstruct the prior partition;
  \item preserve the original merge and retraction events;
  \item invalidate the reconciled customer materialization;
  \item disclose affected historical query ranges;
  \item recompute derived analytics; and
  \item report any external write requiring manual compensation.
\end{enumerate}

This sequence is illustrative.  The repository has no executable profile,
score, decision, projection, or reversal corresponding to it.

\section{Prior art and novelty boundary}
\label{sec:related}

\subsection{Classical linkage and duplicate detection}

Fellegi and Sunter provide the canonical decision-theoretic record-linkage
framework; Jaro develops and applies operational methodology
\cite{FellegiSunter1969,Jaro1989}.  Merge/purge addresses scalable duplicate
detection \cite{HernandezStolfo1995}.  Swoosh studies generic match/merge
functions and properties \cite{BenjellounEtAl2009}.  P7's states, authority,
and bitemporal history are not results of those papers, and P7 cannot claim
their underlying algorithms as new.

\subsection{Uncertain, collective, and declarative resolution}

Identity-uncertainty work models uncertain mappings from observations to
entities \cite{PasulaEtAl2002}.  Reference reconciliation and collective
entity resolution use relational context and positive/negative evidence
\cite{DongHalevyMadhavan2005,BhattacharyaGetoor2007}.  Correlation clustering
provides a partitioning baseline \cite{BansalBlumChawla2004}.  Matching
dependencies and LACE show that declarative rules, matching functions, hard
constraints, soft rules, and resolved answers predate P7
\cite{BertossiEtAl2011,BienvenuEtAl2022}.

These sources set a high bar.  A typed syntax for rules or a graph of pair
scores is not a contribution by itself.  P7 must demonstrate an operational
cross-layer property that established ER plus ordinary event logging and
policy do not already supply.

\subsection{Blocking, learning, and human workflow}

Learned and iterative blocking are established candidate techniques
\cite{MichelsonKnoblock2006,WhangEtAl2009}.  Interactive deduplication,
CrowdER, and Corleone establish active and crowd review workflows
\cite{SarawagiBhamidipaty2002,WangEtAl2012,GokhaleEtAl2014}.  Magellan
establishes a complete entity-matching management baseline
\cite{KondaEtAl2016}.  DeepMatcher and Ditto establish neural and
pretrained-language-model pair classifiers
\cite{MudgalEtAl2018,LiEtAl2020}.

Therefore, P7 must compare setup, candidate generation, matching, review,
correction, audit, and maintenance costs.  Accuracy for one classifier is not
evidence that the full CatDB workflow is better.

\subsection{Vector search}

HNSW and GPU similarity systems establish approximate search at scale
\cite{MalkovYashunin2020,JohnsonDouzeJegou2021}.  Their role in P7 is
retrieval.  The safety claim that a vector result cannot directly invoke a
decision path could be a useful interface property, but the conceptual
distinction between retrieval and classification is not new.

\subsection{Semantic Web identity}

OWL's \code{owl:sameAs} denotes equality of individuals
\cite{OWL2RDFSemantics2012}.  Empirical and conceptual work documents the
risks of using it for weaker relations \cite{HalpinEtAl2010}.  SKOS
distinguishes weaker mapping relations such as \code{closeMatch} and
\code{exactMatch} for concepts \cite{SKOS2009}.  A P7 exporter may use
\code{owl:sameAs} only when the confirmed profile warrants substitutability.
Candidate, probable, contextual, and concept-mapping relations need weaker,
explicit predicates.

\subsection{Provenance, trust, and privacy}

PROV-O supplies normative provenance structures \cite{PROVO2013}.
TruthFinder and source-dependence work study reliability, copying, and
conflicting claims \cite{YinHanYu2007,DongBertiEquilleSrivastava2009}.
Proper scoring rules support probabilistic evaluation
\cite{GneitingRaftery2007}.  Bloom-filter linkage supplies one
privacy-preserving record-linkage approach
\cite{SchnellBachtelerReiher2009}.

P7 must not redescribe these results as CatDB innovations.  A privacy mode
requires an attacker and leakage model; provenance requires a loss audit;
reliability remains distinct from authority.

\subsection{Plausible CatDB delta}

The strongest plausible novelty is a versioned identity assertion and
decision layer that:

\begin{itemize}
  \item retains source-local references and uncertainty;
  \item separates evidence, scores, authority, and decisions;
  \item exposes identity profile and time in every projection;
  \item supports an admitted, provenance-complete reversal fragment;
  \item invalidates mapped, federated, materialized, and workspace artifacts;
  \item prevents vector candidates from becoming identity by interface; and
  \item makes conflicting decisions reviewable rather than order-dependent.
\end{itemize}

This combination is an \enghyp{}.  ``Category-aware identity semantics'' is
\speculative{} until a result unavailable to ordinary typed graphs, rules,
and event histories is precisely stated and established.

\section{Implementation roadmap}
\label{sec:implementation}

\subsection{Profile and fixtures}

The first milestone freezes identity-profile v1, its validation schema,
diagnostic registry, normalization, digest profile, P4/P5/P13 reference
contract, privacy boundary, and unsupported list.  Exit requires agreement
that every state and field has one meaning, candidate and probable never mean
equality, and no source reference can be lost by design.
\status{\obstructed{} on P4 and P13.}

The second milestone builds hand-worked positive and negative fixtures for
source identity, deterministic rules, probabilistic scoring, learned matcher
metadata, vector candidates, clustering, authority, contradiction, time,
reversal, federation, provenance, and privacy.  Expected results must be
independently derived rather than emitted by an implementation.
\status{\openstatus{}.}

\subsection{Independent Haskell reference}

The proposed reference modules are:
\begin{lstlisting}
CatDB.Identity.Types
CatDB.Identity.Validate
CatDB.Identity.Rules
CatDB.Identity.FellegiSunter
CatDB.Identity.Project
CatDB.Identity.Reversal
CatDB.Identity.Provenance
\end{lstlisting}

Properties include conservation of source references, exclusion of uncertain
states from confirmed partitions, satisfaction of cannot-links, replay
invariance for causally independent events, admitted reversal, acyclic
supersession, and idempotent normalization.
\status{\openstatus{}.  No module exists.}

\subsection{Rust production crate}

The proposed \code{catdb-identity} crate owns production IR, validation,
deterministic rule evaluation, candidate/result ingestion, policy checks,
decision append, projection, audit queries, reversal planning, provenance
hooks, and stable diagnostics.  It should not own vector indexing, model
training, authentication, or a general policy engine.
\status{\openstatus{}.  No crate exists.}

\subsection{Method adapters and review workflow}

Candidate adapters should cover exact blocking, one learned blocker, exact
vector search, and HNSW.  Matcher adapters should cover Fellegi--Sunter and
one supervised pair classifier.  A human-review adapter ingests a typed review
artifact.  Every adapter emits method results, never effective decisions.

Authority implementation includes scoped grants, delegation, proposal,
approval, rejection, contradiction, supersession, retraction, quorum, and
separation of duty.  Authentication and the policy engine remain external
dependencies.
\status{Adapters are \openstatus{}; authority workflow is \obstructed{}.}

\subsection{Projection, reversal, and integration}

Later milestones add bitemporal projection, constraint checks, deterministic
replay, supported reversal/split, downstream invalidation, strict and partial
federation, workspace-local proposals, semantic decision diffs, and
historical reproduction.
\status{\obstructed{} on P5, P6, P9, and P13.}

\subsection{Security and privacy}

Only after threat-model review should the system add evidence access control,
sensitive-feature redaction, audit-safe disclosure, encrypted or tokenized
linkage, key rotation, retention handling, and inference tests.  A type named
\code{PrivateIdentity} is not a privacy proof.
\status{\openstatus{} for implementation; formal noninterference remains
\speculative{}.}

\section{Experimental evaluation contract}
\label{sec:evaluation}

\subsection{Research questions}

The evaluation asks whether typed artifact separation prevents
score-to-identity promotion; whether Rust and Haskell agree; whether
probabilities are calibrated; how candidate methods trade recall and cost;
how pairwise, collective, and constraint-aware policies trade error; what
human review costs; whether provenance reduces audit and repair time; whether
admitted reversal reconstructs prior partitions and invalidates all recorded
dependents; what overhead full history adds; and whether any maintenance
benefit survives identity exceptions and approval work.

\subsection{Compared systems and ablations}

The comparison matrix includes deterministic rules, Fellegi--Sunter,
supervised and transformer pair classifiers, vector-candidate-plus-classifier,
connected components as an intentionally unsafe baseline, correlation
clustering, collective ER, human-only review, hybrid review, and the proposed
typed/versioned CatDB workflow.  Ablations remove provenance, authority
checks, and reversible history.

Baseline implementations must be executable or clearly labelled faithful
reconstructions.  A toy baseline cannot establish superiority over a mature
system.

\subsection{Datasets and ground truth}

Use hand-checkable synthetic data, corruption generators, licensed public
entity-matching benchmarks, relational data for collective resolution,
temporal source corrections, source-copying conflicts, domain shift, and a
consent-safe enterprise-like dataset with independent adjudication.  Every
dataset manifest records provenance, license, unit of identity, ground-truth
method, ambiguous labels, split, contamination, and checksums.

Sensitive-person linkage is excluded unless governance, privacy, licensing,
and ethics review explicitly admit it.

\subsection{Correctness metrics}

Report candidate recall and reduction before matcher accuracy.  Report pair
precision, recall, false-match rate, and missed-match rate with denominators.
Report cluster metrics with exact definitions, exact partitions for small
cases, must-link/cannot-link violations, contradiction detection,
source-reference conservation, replay determinism, reversal equivalence,
invalidation recall, historical reproduction, misuse rejection, and
interchange loss.

A single F1 score is insufficient because it hides prevalence, candidate
loss, cluster shape, calibration, review burden, and consequences.

\subsection{Probabilistic and systems metrics}

Probabilistic evaluation includes Brier score, log loss, calibration
intercept/slope, reliability curves, expected calibration error with bins,
area under precision--recall, threshold precision/recall, review-region size,
expected decision cost, intervals, and drift strata.

Systems evaluation includes profile compilation, candidate generation,
exact/approximate recall and latency, scoring, policy evaluation, projection,
replay, historical query, review throughput, storage amplification,
provenance query, reversal, invalidation, recomputation, source rows/bytes,
memory, CPU, privacy overhead, and failed/conflicted operations.

\subsection{Human review and reversal studies}

The human study preregisters recruitment, task, evidence presentation,
model-score visibility, randomization, blinding, adjudication, training,
disagreement, stopping, compensation, privacy/ethics approval, endpoints, and
exclusions.  It measures accuracy, time, disagreement, calibration,
correction, reversal, and auditability.

The reversal study seeds false pair merges, false transitive clusters,
late cannot-links, source corrections, supersession, model recalibration,
revoked approval, mapping revision, newly visible evidence, and deletion.  It
measures partition recovery, fact reassignment, invalidation completeness,
repair time, and external compensation.

\subsection{Promotion gates}

Before confirmatory execution, freeze source state, dependencies, profile,
fixtures, datasets, splits, models, thresholds, policies, baselines,
hypotheses, margins, sample-size plan, seeds, environment, and exclusions.
Preserve failed runs.

Examples of promotion criteria are:

\begin{itemize}
  \item zero source-reference loss in the supported fixture family;
  \item exact Rust/Haskell action agreement under a frozen numeric profile;
  \item calibration within preregistered held-out margins;
  \item candidate-recall lower bound above the declared threshold;
  \item zero authority bypass in the admitted adversarial suite;
  \item byte-identical normalized replay;
  \item exact extensional recovery for every admitted reversal;
  \item zero missed recorded downstream dependency;
  \item zero unqualified partial-source result; and
  \item preregistered audit/repair improvement with noninferior error.
\end{itemize}

None of these criteria has been run.

\section{Current results and implementation status}
\label{sec:results}

\subsection{What this paper establishes}

This author pass establishes only a specification-level result: the proposed
claim has been decomposed into artifact types, states, authority boundaries,
cross-layer obligations, formal conjectures, falsifiers, and experiments.
The paper's prior-art claims are \prior{} where cited.  The repository audit
supports the statement that P7 implementation and experiment artifacts are
absent at this evidence cut.

\subsection{What this paper does not establish}

\begin{table}[ht]
\centering
\small
\caption{Current P7 status by layer.}
\label{tab:status}
\begin{tabularx}{\textwidth}{L{0.28\textwidth}L{0.20\textwidth}Y}
\toprule
Layer & Status & Reason \\
\midrule
record-linkage prior art & \prior & Primary sources establish the field. \\
vector/identity boundary & \prior{} plus inference & ANN defines retrieval;
OWL defines strong equality. \\
identity profile & \obstructed & P4/P13 references are not frozen. \\
typed artifact model & \openstatus & Manuscript and dossier only. \\
deterministic/probabilistic methods & \openstatus & No implementation or
fixtures. \\
authority and ownership & \obstructed & Shared policy semantics absent. \\
Rust runtime & \openstatus & Crate absent. \\
Haskell oracle & \openstatus & Modules absent. \\
Lean laws & \openstatus & Representation absent. \\
federation & \obstructed & P5 result/runtime contract absent. \\
reversal and invalidation & \obstructed & P6/P9/P13 dependencies absent. \\
privacy/security & \openstatus & Threat model and implementation absent. \\
experiments & \openstatus & No run artifacts. \\
\bottomrule
\end{tabularx}
\end{table}

No CatDB accuracy, calibration, scalability, review-quality, reversibility,
privacy, or maintenance claim is experimentally supported.  No P7 theorem is
machine-checked.  No existing categorical identity-mapping fixture is entity
identity evidence.

\section{Limitations}
\label{sec:limitations}

\subsection{Conceptual limits}

An identity profile makes the question explicit, but it cannot make the
answer objective.  A profile may be poorly scoped, biased, internally
inconsistent, or politically contested.  Canonicalization can still be
useful without being universally true.  Legal, ethical, and institutional
constraints do not reduce to graph closure.

\subsection{Statistical limits}

Probabilistic methods depend on the population, sampling, comparison features,
blocking, prevalence, calibration, and drift.  Ground truth may itself be
ambiguous or wrong.  A reported probability can be well calibrated overall
and still fail for a consequential subgroup.  Collective inference may
double-count copied evidence or amplify an early false merge.

\subsection{Systems limits}

Versioning and provenance cost storage, latency, review time, and operational
work.  Reversal may require expensive recomputation, while some external
effects cannot be reversed at all.  Partial source access limits
completeness.  A typed record design does not provide authentication,
authorization enforcement, encryption, key management, or side-channel
resistance.

\subsection{Formal limits}

The proposed theorems concern well-formed finite histories and policy
derivations.  They cannot establish that observations are correct, reviewers
are honest, a statistical model transports, or a real-world entity exists.
Even a future Lean proof of projection laws would not validate the empirical
identity evidence.

\subsection{Evaluation limits}

Synthetic ground truth may miss the ambiguity found in production.  Public
benchmarks may be contaminated by pretrained models or encode only one
identity question.  Human studies depend on participant expertise, evidence
presentation, and incentives.  A positive result would support only the
tested profile, workload, sources, and population.

\section{Open questions}
\label{sec:open}

\begin{enumerate}
  \item Which identity questions and entity types belong in profile v1?
  \item Should confirmed identity be time-indexed, or should change use
  succession relations?
  \item Which source-key guarantees permit deterministic promotion?
  \item How should copied and syndicated evidence be represented?
  \item Which numeric profile gives reproducible linkage scores across
  languages?
  \item Which probability semantics may be shown to users?
  \item How should calibration be corrected after blocking or population
  shift?
  \item Which uncertain states may downstream queries consume?
  \item How should pair probabilities become cluster proposals?
  \item Which constraints are hard, defeasible, or authority-overridable?
  \item What conflict witness is minimal and useful?
  \item When may one source owner authorize identity across another owner's
  record?
  \item Which decisions require quorum or separation of duty?
  \item How should identity and attribute-fusion policies compose?
  \item Which merge fragment is exactly reversible?
  \item How should synthesized facts be split after an erroneous merge?
  \item Which external effects require compensation?
  \item What downstream invalidation completeness can P6 and P13 provide?
  \item Which reconciliation operations commute across workspaces?
  \item What may a redacted provenance answer reveal through graph shape?
  \item Which privacy-preserving protocol and attacker model fit v1?
  \item How should deletion interact with audit and reproducibility?
  \item Which datasets have defensible and licensed ground truth?
  \item How should disputed benchmark labels be scored?
  \item Can the proposed layer demonstrate value beyond established ER,
  provenance, event histories, and ordinary policy systems?
\end{enumerate}

\section{Conclusion}
\label{sec:conclusion}

Identity integration cannot be reduced to choosing the nearest vector or the
largest score.  It requires preserving source records and evidence, stating
the exact identity question, applying a versioned method, obtaining authority
under a declared policy, and exposing the consequences of the decision.

This paper proposes that \CatDB{} make those objects first-class.  It keeps
source-local references intact and excludes candidate, possible, and probable
states from confirmed equivalence.  Contradictions survive approval.
Canonical anchors are relative to a profile and time.  Provenance records
origin and process without claiming truth, and reversal is admitted only when
the prior partitions and downstream effects can be reconstructed.

The proposal is not yet a CatDB capability.  Its profile, runtime, fixtures,
formalization, security model, and experiments are absent or blocked by
upstream semantics.  Vector similarity may generate candidates, but it cannot
establish semantic identity by itself.  The research program succeeds only if
implementation and experiments show that typed, versioned, authority-bearing
decisions materially improve audit and repair without hiding errors or costs.
Until those gates close, the correct status is \enghyp{}, \openstatus{}, and
\obstructed{}, not solved identity.

\appendix

\section{Exact nonclaims}
\label{app:nonclaims}

This manuscript makes the following exclusions binding:

\begin{enumerate}
  \item \CatDB{} does not invent record linkage, entity matching, entity
  resolution, blocking, merge/purge, collective ER, or human review.
  \item Category theory does not discover real-world identity.
  \item A schema mapping does not show that two records denote one entity.
  \item A source identifier is not automatically global, stable, true, or
  unrecycled.
  \item A canonical anchor is a profile-relative decision artifact, not proof
  of metaphysical or legal identity.
  \item Candidate, possible, and probable relations are not equivalence
  relations.
  \item Similarity is evidence, not identity.
  \item Vector similarity and nearest-neighbor rank may generate candidates
  but cannot establish semantic identity by themselves.
  \item Approximate vector search may miss candidates.
  \item A high classifier score is not a calibrated probability unless
  validated as such.
  \item A calibrated probability is not an authority-bearing decision.
  \item Deterministic rules and human reviewers can be wrong.
  \item More agreeing sources do not imply independent evidence.
  \item Source reliability is not source authority.
  \item Source authority is scope- and time-relative.
  \item Confirmed identity does not resolve attribute conflicts.
  \item Supersession does not automatically imply sameness.
  \item Connected components over scores are not a safe universal cluster
  semantics.
  \item \code{owl:sameAs} is not a fuzzy or candidate relation.
  \item W3C PROV does not supply P7 identity semantics.
  \item Provenance does not prove identity or truth.
  \item Append-only history alone does not guarantee authenticity,
  completeness, or reversibility.
  \item Logical reversal does not remove physical repair or compensation.
  \item Reversal may be unsupported after evidence deletion or redaction.
  \item Identity decisions do not generally commute under replication.
  \item Partial source availability is not a complete identity view.
  \item Privacy-preserving linkage is not private against every attacker.
  \item Benchmark accuracy does not establish production quality.
  \item F1 does not measure calibration, candidate recall, cluster quality,
  review burden, or decision cost.
  \item \CatDB{} does not eliminate manual reconciliation, ETL, data movement,
  source governance, or distributed-systems tradeoffs.
  \item Existing schema-path and mapping work does not establish P7.
  \item A future formal projection proof would not prove match evidence.
  \item Future Rust/Haskell agreement would be computational conformance, not
  proof of identity truth.
\end{enumerate}

\section{Minimum fixture matrix}
\label{app:fixtures}

\begin{longtable}{L{0.25\textwidth}L{0.32\textwidth}L{0.33\textwidth}}
\caption{Minimum hand-worked fixture families before P7 claim promotion.}
\label{tab:fixtures}\\
\toprule
Family & Positive coverage & Adversarial coverage \\
\midrule
\endfirsthead
\toprule
Family & Positive coverage & Adversarial coverage \\
\midrule
\endhead
Source identity &
stable key, namespace separation, tombstone, alias evidence &
key reuse, household/person type mismatch, cross-time ambiguity \\
Deterministic rules &
authoritative identifier, normalized composite key, permutation stability &
null/default collision, schema meaning change, rule-priority conflict \\
Probabilistic linkage &
hand score, match/review/nonmatch regions, threshold revision &
zero probability, missing comparisons, prior shift, blocking selection \\
Learned matcher &
model/feature digests, calibrated output, threshold revision &
uncalibrated probability label, leakage, drift, missingness failure \\
Vector candidates &
exact hit, HNSW result plus exact audit, candidate recall &
true-pair miss, high-similarity cannot-link, low-similarity true match \\
Clusters &
consistent confirmed triangle, deterministic tie break &
nontransitive scores, must/cannot conflict, false collective propagation \\
Authority &
in-scope owner, valid delegation, quorum, dual approval &
out-of-scope action, revoked delegation, model self-approval \\
Contradiction &
positive and negative evidence coexist, reviewer disagreement &
last-writer-wins attempt, hidden negative evidence, interval conflict \\
Time and reversal &
historical cut, merge/reversal, supported split, invalidation &
incomplete provenance, ambiguous derived fact, external compensation \\
Cross-layer &
mapping creates candidate, strict/partial federation, PROV trace &
lost source ref, silent partial source, stale cache, \code{owl:sameAs} misuse \\
Privacy &
declared raw/token/Bloom profiles, key rotation &
frequency attack, linkage leakage, unsupported privacy claim \\
\bottomrule
\end{longtable}

\section{Claim-promotion ledger}
\label{app:claims}

\small
\begin{longtable}{L{0.10\textwidth}L{0.34\textwidth}L{0.18\textwidth}L{0.25\textwidth}}
\caption{Selected P7 claim anchors and minimum promotion gates.}
\label{tab:claims}\\
\toprule
ID & Claim & Status & Promotion gate \\
\midrule
\endfirsthead
\toprule
ID & Claim & Status & Promotion gate \\
\midrule
\endhead
\code{ID-01} & Source references survive canonicalization and reversal. &
\openstatus & Shared fixtures and exact Rust/Haskell agreement. \\
\code{ID-02} & Candidate, evidence, method result, and decision remain typed
separately. & \openstatus & Schema, validators, and negative fixtures. \\
\code{ID-03} & Uncertain states never enter confirmed equivalence. &
\obstructed & Frozen state semantics, executable projection, Lean invariant. \\
\code{ID-04} & Confirmed-same projects to an equivalence relation within one
profile/time cut. & \obstructed & Precise projection and machine-checked laws. \\
\code{ID-05} & Accepted projections respect confirmed-different. &
\obstructed & Constraint semantics, exhaustive finite tests, Lean invariant. \\
\code{ID-07} & Rust and Haskell agree on reference linkage scores. &
\openstatus & Hand-worked scores and frozen numeric tolerance. \\
\code{ID-08} & Displayed probabilities are calibrated. &
\openstatus & Held-out evaluation with proper scores and intervals. \\
\code{ID-09} & Vector search emits candidates only. &
\openstatus & API restrictions and misuse tests. \\
\code{ID-12} & Scoped authority is non-bypassable. &
\obstructed & Policy IR and adversarial API/backend tests. \\
\code{ID-15} & Replay is deterministic at a system-time cut. &
\openstatus & Event fixtures, shuffled delivery, byte-stable projection. \\
\code{ID-16} & Admitted reversal reconstructs the prior partition. &
\obstructed & Reversible fragment, Rust/Haskell agreement, Lean law. \\
\code{ID-17} & Reversal invalidates every recorded dependent artifact. &
\obstructed & P6/P13 dependency graph and mutation tests. \\
\code{ID-18} & Contradictions are preserved without hidden order. &
\openstatus & Permutation and concurrency fixtures. \\
\code{ID-19} & OWL export reserves equality for qualifying confirmed identity. &
\openstatus & Export profile and loss/misuse tests. \\
\code{ID-21} & Partial source availability is always qualified. &
\obstructed & P5 result envelope and source-failure fixtures. \\
\code{ID-24} & Privacy mode meets a declared leakage contract. &
\openstatus & Independent security analysis and attacks. \\
\code{ID-25} & The layer reduces audit/repair cost without degrading error. &
\openstatus & Preregistered full-workflow comparison. \\
\bottomrule
\end{longtable}

\bibliographystyle{plainnat}
\bibliography{references}

\end{document}
