Verifying history does not mean executing it

When Metnos code changes, signatures on existing contracts must remain verifiable. This does not authorize new code to execute or publish using a previous authority context.

The first coordinated transition

The initial path authenticates the historical set and its key bindings under one barrier. Readers receive only the set identity and public verification keys, not an executable runtime.

For an unchanged contract, convergence verifies its signature and contents without publishing it again. If a change requires publication, it constructs the full runtime and checks that its context matches the source code: a different context is rejected.

The new context is still required

Historical reading does not replace transition reattestation, which remains bound to the new authenticated distribution. Changes to the historical set, key inventory, or contract-to-generation binding are rejected; a historical signature is not a general permission to execute new code.

The census distinguishes the old and new installations

Retirement entries describe only components of the old installation. A module introduced by the new distribution must not be required in its predecessor: it remains covered by the new distribution's signed inventory and verification. A missing required historical component still blocks the transition.

Resuming reuses the recorded historical census, because retirement may already have renamed some files. The document must retain its valid format, integrity and safe ownership and match the same transition, installation and catalog exactly. It is neither rewritten nor treated as a fresh verification of current state.