docs(schema): reconcile ADR-150, ADR-083, the design, and docs with the engine [roadmap:deterministic-substrate]

[tcballard]

Summary

This is PR F, the last in the post-merge review series: corpus and documentation corrections, plus one small engine fix that the docs pass surfaced.

Engine fix. decided-mcp named a federation composition failure's stable code twice when composition failed mid-session, for example corpus-federation-artifact-type-conflict: corpus-federation-artifact-type-conflict: source …. Both serving composition sites in derived_cache.rs (v1 and v2) wrapped an error whose display already leads with the code in a Composition error that prefixes it again. I reproduced it live. It happens with and without the cache: the existing test's starts_with("…conflict: ") assertion also matched the doubled form, so it never caught it.

ADR-150 (wording amended to match the accepted intent and the implementation; no decision changes):

• Decision 1 said "a node unions its parents' type sets, then adds its own. A name already present is skipped". That contradicted both its own first sentence (own elements first) and decision 2 (first-wins is rejected). It now says own-first bottom-up, with identical content a silent duplicate and different content decision 2's conflict, "never a skip".
• Decision 6 is headed "per source" (was "per element") and says an entry is emitted per source that pins a bundle, whether or not its elements survive.
• The Consequences no longer claim schema --list differs by closure without --corpus, or that an override can un-inherit a type. An override only settles a collision.
• The amendment notes that order fixes the classification tie-break (ADR-083 decision 8).

ADR-083:

• A dated amendment in Status records that ADR-150 replaces decision 9's federation scoping.
• The amendment also records how decided-mcp meets decision 9's "watched" clause: it re-syncs the registry per call, not through the file-freshness watch list.
• Decision 9 is marked amended.
• adr-150 joins Related Decisions, which clears the unlinked-reference doctor finding.

Design (third-party-artifact-extensibility):

• A duplicate override name is artifact-spec-bundle-config-invalid, not corpus-federation-invalid-override. The test already pins this.
• Bundle-level failures are hard errors, not "one warning … find and resolve exit 0".
• The nonexistent artifact-spec-bundle-skipped code is removed.
• The MCP freshness, parent-order tie-break, un-inheriting, digest-bump rationale and memo-leak wording now match the code.

docs/validation.md:

• MCP freshness is stated accurately.
• schema/templates with --corpus is documented; the old line said they take no corpus directory.
• validate --json reports artifact_spec_bundles for an unfederated bundle too.

Tests:

• The live-collision MCP test runs cached and uncached and asserts one code prefix.
• A type alias clears the clippy::type_complexity lint that --all-targets reports on decided/tests/spec_federation.rs.

Roadmap / ADR Trace

• Roadmap: decisions/roadmaps/deterministic-substrate.md (Tranche C)
• ADR-150, ADR-083 (wording amendments; the decisions are unchanged)
• ADR-047: agent-facing and corpus artifacts stay truthful to the engine

Scope

• rust/rac-engine/src/derived_cache.rs: FederatedCacheError::from_composition_display at both composition sites.
• rust/decided-mcp/tests/spec_federation.rs: cached and uncached live collision.
• rust/decided/tests/spec_federation.rs: OverrideCase alias.
• decisions/decisions/adr-150-…md, decisions/decisions/adr-083-…md, decisions/designs/third-party-artifact-extensibility.md.
• docs/validation.md, CHANGELOG.md.

Product / Architecture Decisions

• No decision is re-opened. Every ADR edit either removes a sentence that contradicted another decision in the same ADR, or records behaviour a later accepted ADR (ADR-150) already fixed. Each is marked as a dated amendment.
• The MCP freshness wording describes behaviour once fix(schema): make decided-mcp freshness follow the artifact-type registry [roadmap:deterministic-substrate] #492 merges: per-call registry re-sync and bundle re-verification, with trackers rebuilt when the registry changes. Merge fix(schema): make decided-mcp freshness follow the artifact-type registry [roadmap:deterministic-substrate] #492 before this PR so the docs never lead the engine.

User-Facing Contract

• decided-mcp error text for a mid-session composition failure loses its duplicated code prefix. The code, isError, and the detail are unchanged.
• No other output changes. The CLI golden battery (135 cases) and MCP golden battery are byte-identical to main on the same tree.

Verification

• cargo fmt --check; cargo clippy --workspace --release --no-deps -- -D warnings (the CI invocation) and --all-targets: clean; cargo test --workspace --release: pass.
• Mutation check: restoring the old constructor makes both the cached and the uncached live-collision tests fail.
• Conformance certification 11/11; live-corpus invariants PASS.
• Corpus gates: validate, relationships --validate, review (no P1/P2), export --agent-rules --check, watchkeeper --base origin/main: all exit 0.

Review Path

1. derived_cache.rs (one constructor, two call sites).
2. ADR-150 and ADR-083 diffs.
3. The design diff.
4. docs/validation.md, then the tests.

Notes For Reviewer

• Merge order. Every PR in the series (fix(schema): load the spec bundle in every command that classifies [roadmap:deterministic-substrate] #491–fix(schema): make inherited type composition scope- and topology-exact [roadmap:deterministic-substrate] #495 and this one) adds a bullet at the top of the CHANGELOG's Unreleased ### Fixed, so each merge after the first needs a trivial CHANGELOG resolution. This PR also edits design and validation.md paragraphs next to ones fix(schema): make inherited type composition scope- and topology-exact [roadmap:deterministic-substrate] #495 edits, but never the same lines.
• Commit history, not fixable here. Nine merged commits (c98a3f7, 4fbfc11, f55d0f6, 9a105cc, 7a4106a, 5697597, 8c097b2, 25db429, d4e6e89) lack the Implements … body line. The GitHub rebase merges recorded the committer as the GitHub account's address rather than tom@armytage.co. Both sit in main's history, and rewriting it is out of bounds; a merge method that preserves the committer avoids the second going forward.

Implementation Process

Implemented with AI assistance under the roadmap contract; final scope, review, and acceptance decisions were made by the maintainer.