feat(relation): refuse retrospective reporting as a transition

ARCHITECTURE.md

@@ -61,6 +61,7 @@ boundaries above remain the target modular MSA architecture.
 | `tepp_simulation` | known-truth temporal/event data generation |
 | `validation_core` | RMSE, bias, coverage, graph, and Monte Carlo metrics |
 | `tepp_api` | versioned DTO, schema, and export contracts |
+| `retrospective_edge` | retrospective reporting cannot become a transition or a translation |
 
 No crate exposes placeholder production behavior in Task 1. This prevents an
 empty façade from becoming a de facto public API before its invariants and tests

CHANGELOG.md

@@ -6,6 +6,8 @@ All notable changes to TEPP are documented here. The format follows Keep a Chang
 
 ### Added
 
+- `retrospective_edge` identity gate: retrospective reporting may point to earlier event time but cannot become a state transition or a translation; recovered reporting kinds match known truth at a higher computed rate than collapsing every report to a contemporaneous forward report (ADR 0002/0003).
+- `persistence_postgres` retention/deletion/legal-hold (migration `0007`): policy rows, legal holds that block completed deletion, evidence tombstones without raw-source restore, analysis exclusion only for `logical_revocation`/`identity_tombstone` (not `cache_export_removal`), and deletion requests bound to the cited retention policy's tenant/class/purpose.
 - `tepp_api` adaptive orchestration router (ADR 0010): versioned `direct`/`verify`/`committee`/`conductor`/`abstain` selection from CPU `f64` risk, ambiguity, evidence, and token-budget inputs; recorded stages, recursion, decomposition, access lists, and role-specific reasoning effort; fail-closed document-controlled policy/access/credentials; LLM plans remain proposals under deterministic statistical authority; comparable-budget ablation requires a direct baseline; credential-free contextual-orchestrator binding. Live NIM HTTP remains accepted-target.
 - `tepp_api` purpose-bound provider-payload minimization: time-bounded `PurposeGrant` evaluation, fail-closed expired/not-yet-valid/inverted/cross-tenant/impossible-calendar denial, semantic UTC calendar validation, refusal to copy identity mappings into model-provider payloads or ordinary logs, preservation of opaque analytical identifiers and membership roles (no blanket PII mask), a separately authorized scientific re-identification path, and an internally bound FIPS 180-4 SHA-256 audit digest appended through `ReidentificationAuditSink` before disclosure.
 - `persistence_postgres` backup/restore integrity: restored snapshots stay unusable until tenant, canonical `SHA-256`, knowledge-cutoff eligibility, temporal window order, and append-only triggers revalidate; SQL probes raise `restore integrity failed` (ADR 0013).

Cargo.toml

@@ -11,6 +11,7 @@ members = [
     "crates/tepp_simulation",
     "crates/validation_core",
     "crates/tepp_api",
+    "crates/retrospective_edge",
 ]
 default-members = [
     "crates/evidence_core",
@@ -23,6 +24,7 @@ default-members = [
     "crates/tepp_simulation",
     "crates/validation_core",
     "crates/tepp_api",
+    "crates/retrospective_edge",
 ]
 
 [workspace.package]

README.md

@@ -7,7 +7,7 @@ implemented in Rust.
 ## Current implementation state
 
 This branch establishes the Task 1 Rust workspace and quality-gate foundation.
-The ten bounded crates compile independently but intentionally expose no
+The eleven bounded crates compile independently but intentionally expose no
 placeholder production APIs. Domain behavior begins in Task 2 with immutable
 evidence identifiers and source records.
 
@@ -22,6 +22,7 @@ crates/corpus_split
 crates/tepp_simulation
 crates/validation_core
 crates/tepp_api
+crates/retrospective_edge
 ```
 
 ## Local verification

crates/retrospective_edge/Cargo.toml

@@ -0,0 +1,17 @@
+[package]
+name = "retrospective_edge"
+description = "Retrospective reporting is not a transition and not a translation."
+version.workspace = true
+edition.workspace = true
+rust-version.workspace = true
+license.workspace = true
+authors.workspace = true
+repository.workspace = true
+homepage.workspace = true
+readme.workspace = true
+keywords.workspace = true
+categories.workspace = true
+publish = false
+
+[lints]
+workspace = true

crates/retrospective_edge/src/error.rs

@@ -0,0 +1,55 @@
+//! Fail-closed retrospective-edge errors.
+
+use std::fmt;
+
+/// A fail-closed retrospective-edge error.
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+#[non_exhaustive]
+pub enum RetrospectiveEdgeError {
+    /// A retrospective report was treated as a state transition.
+    RetrospectiveIsNotTransition,
+    /// A retrospective report was treated as a translation.
+    RetrospectiveIsNotTranslation,
+    /// A recovery slice was empty or length-mismatched.
+    InvalidEdgePayload,
+}
+
+impl fmt::Display for RetrospectiveEdgeError {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        let message = match self {
+            Self::RetrospectiveIsNotTransition => {
+                "retrospective reporting is not a state transition"
+            }
+            Self::RetrospectiveIsNotTranslation => "retrospective reporting is not a translation",
+            Self::InvalidEdgePayload => "invalid retrospective-edge payload",
+        };
+        formatter.write_str(message)
+    }
+}
+
+impl std::error::Error for RetrospectiveEdgeError {}
+
+#[cfg(test)]
+mod tests {
+    use super::RetrospectiveEdgeError;
+
+    #[test]
+    fn error_messages_are_stable() {
+        for (error, message) in [
+            (
+                RetrospectiveEdgeError::RetrospectiveIsNotTransition,
+                "retrospective reporting is not a state transition",
+            ),
+            (
+                RetrospectiveEdgeError::RetrospectiveIsNotTranslation,
+                "retrospective reporting is not a translation",
+            ),
+            (
+                RetrospectiveEdgeError::InvalidEdgePayload,
+                "invalid retrospective-edge payload",
+            ),
+        ] {
+            assert_eq!(error.to_string(), message);
+        }
+    }
+}

crates/retrospective_edge/src/kind.rs

@@ -0,0 +1,143 @@
+//! Retrospective reporting versus contemporaneous forward reporting.
+
+use crate::RetrospectiveEdgeError;
+
+/// Closed vocabulary of reporting edges that may point at earlier event time.
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub enum RetrospectiveKind {
+    /// A later report about an earlier event (provenance; may point backward).
+    RetrospectiveReport,
+    /// A contemporaneous report that is not a translation or a transition.
+    ForwardReport,
+}
+
+impl RetrospectiveKind {
+    /// Return the stable wire kind name.
+    #[must_use]
+    pub const fn wire_name(self) -> &'static str {
+        match self {
+            Self::RetrospectiveReport => "retrospectively_reports",
+            Self::ForwardReport => "forward_report",
+        }
+    }
+
+    /// Parse a stable wire kind name.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`RetrospectiveEdgeError::InvalidEdgePayload`] for unrecognized
+    /// names.
+    pub fn from_wire_name(name: &str) -> Result<Self, RetrospectiveEdgeError> {
+        match name {
+            "retrospectively_reports" => Ok(Self::RetrospectiveReport),
+            "forward_report" => Ok(Self::ForwardReport),
+            _ => Err(RetrospectiveEdgeError::InvalidEdgePayload),
+        }
+    }
+}
+
+/// Refuse to treat a retrospective report as a forward state transition.
+///
+/// # Errors
+///
+/// Returns [`RetrospectiveEdgeError::RetrospectiveIsNotTransition`] when
+/// `kind` is [`RetrospectiveKind::RetrospectiveReport`].
+pub fn refuse_retrospective_as_transition(
+    kind: RetrospectiveKind,
+) -> Result<(), RetrospectiveEdgeError> {
+    match kind {
+        RetrospectiveKind::RetrospectiveReport => {
+            Err(RetrospectiveEdgeError::RetrospectiveIsNotTransition)
+        }
+        RetrospectiveKind::ForwardReport => Ok(()),
+    }
+}
+
+/// Refuse to treat a retrospective report as a translation.
+///
+/// # Errors
+///
+/// Returns [`RetrospectiveEdgeError::RetrospectiveIsNotTranslation`] when
+/// `kind` is [`RetrospectiveKind::RetrospectiveReport`].
+pub fn refuse_retrospective_as_translation(
+    kind: RetrospectiveKind,
+) -> Result<(), RetrospectiveEdgeError> {
+    match kind {
+        RetrospectiveKind::RetrospectiveReport => {
+            Err(RetrospectiveEdgeError::RetrospectiveIsNotTranslation)
+        }
+        RetrospectiveKind::ForwardReport => Ok(()),
+    }
+}
+
+/// Fraction of recovered reporting kinds that match known truth.
+///
+/// # Errors
+///
+/// Returns [`RetrospectiveEdgeError::InvalidEdgePayload`] when either slice is
+/// empty or the lengths differ.
+pub fn identity_recovery_rate(
+    truth: &[RetrospectiveKind],
+    decided: &[RetrospectiveKind],
+) -> Result<f64, RetrospectiveEdgeError> {
+    if truth.is_empty() || truth.len() != decided.len() {
+        return Err(RetrospectiveEdgeError::InvalidEdgePayload);
+    }
+    let mut matches = 0_u32;
+    for (truth_kind, decided_kind) in truth.iter().zip(decided) {
+        if truth_kind == decided_kind {
+            matches += 1;
+        }
+    }
+    Ok(f64::from(matches) / truth.len() as f64)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::{
+        RetrospectiveKind, identity_recovery_rate, refuse_retrospective_as_transition,
+        refuse_retrospective_as_translation,
+    };
+    use crate::RetrospectiveEdgeError;
+
+    #[test]
+    fn local_branches_cover_kinds_payloads_and_wire_names() {
+        assert_eq!(
+            refuse_retrospective_as_transition(RetrospectiveKind::RetrospectiveReport),
+            Err(RetrospectiveEdgeError::RetrospectiveIsNotTransition)
+        );
+        assert_eq!(
+            refuse_retrospective_as_translation(RetrospectiveKind::RetrospectiveReport),
+            Err(RetrospectiveEdgeError::RetrospectiveIsNotTranslation)
+        );
+        refuse_retrospective_as_transition(RetrospectiveKind::ForwardReport).expect("forward");
+        refuse_retrospective_as_translation(RetrospectiveKind::ForwardReport).expect("forward");
+        for kind in [
+            RetrospectiveKind::RetrospectiveReport,
+            RetrospectiveKind::ForwardReport,
+        ] {
+            assert_eq!(
+                RetrospectiveKind::from_wire_name(kind.wire_name()).expect("round-trip"),
+                kind
+            );
+        }
+        assert_eq!(
+            RetrospectiveKind::from_wire_name("translates"),
+            Err(RetrospectiveEdgeError::InvalidEdgePayload)
+        );
+        let matched = identity_recovery_rate(
+            &[RetrospectiveKind::RetrospectiveReport],
+            &[RetrospectiveKind::RetrospectiveReport],
+        )
+        .expect("rate");
+        assert!((matched - 1.0).abs() < f64::EPSILON);
+        assert_eq!(
+            identity_recovery_rate(&[], &[]),
+            Err(RetrospectiveEdgeError::InvalidEdgePayload)
+        );
+        assert_eq!(
+            identity_recovery_rate(&[RetrospectiveKind::RetrospectiveReport], &[]),
+            Err(RetrospectiveEdgeError::InvalidEdgePayload)
+        );
+    }
+}

crates/retrospective_edge/src/lib.rs

@@ -0,0 +1,21 @@
+#![forbid(unsafe_code)]
+#![deny(missing_docs)]
+#![allow(clippy::cast_precision_loss)]
+//! Retrospective reporting is not a transition and not a translation.
+//!
+//! A later report may point at earlier event time. It never becomes an
+//! input-process-outcome edge or a translation (ADR 0002/0003).
+
+mod error;
+mod kind;
+
+/// Fail-closed retrospective-edge errors.
+pub use error::RetrospectiveEdgeError;
+/// Closed vocabulary of reporting edges that may point at earlier event time.
+pub use kind::RetrospectiveKind;
+/// Fraction of recovered reporting kinds that match known truth.
+pub use kind::identity_recovery_rate;
+/// Refuse to treat a retrospective report as a forward state transition.
+pub use kind::refuse_retrospective_as_transition;
+/// Refuse to treat a retrospective report as a translation.
+pub use kind::refuse_retrospective_as_translation;

crates/retrospective_edge/tests/crate_contract.rs

@@ -0,0 +1,7 @@
+//! Integration contract for the `retrospective_edge` package identity.
+
+#[test]
+fn package_identity_is_stable() {
+    let observed = std::hint::black_box(env!("CARGO_PKG_NAME"));
+    assert_eq!(observed, "retrospective_edge");
+}

crates/retrospective_edge/tests/retrospective_edge_contract.rs

@@ -0,0 +1,70 @@
+//! Retrospective reporting is not a transition and not a translation.
+
+use retrospective_edge::{
+    RetrospectiveEdgeError, RetrospectiveKind, identity_recovery_rate,
+    refuse_retrospective_as_transition, refuse_retrospective_as_translation,
+};
+
+#[test]
+fn retrospective_reporting_cannot_become_a_transition_or_a_translation() {
+    assert_eq!(
+        refuse_retrospective_as_transition(RetrospectiveKind::RetrospectiveReport),
+        Err(RetrospectiveEdgeError::RetrospectiveIsNotTransition)
+    );
+    assert_eq!(
+        refuse_retrospective_as_translation(RetrospectiveKind::RetrospectiveReport),
+        Err(RetrospectiveEdgeError::RetrospectiveIsNotTranslation)
+    );
+    refuse_retrospective_as_transition(RetrospectiveKind::ForwardReport).expect("forward");
+    refuse_retrospective_as_translation(RetrospectiveKind::ForwardReport).expect("forward");
+}
+
+#[test]
+fn recovered_kinds_match_known_truth_better_than_a_translation_collapse() {
+    let truth = [
+        RetrospectiveKind::RetrospectiveReport,
+        RetrospectiveKind::ForwardReport,
+        RetrospectiveKind::RetrospectiveReport,
+    ];
+    let recovered = truth;
+    let collapsed = [
+        RetrospectiveKind::ForwardReport,
+        RetrospectiveKind::ForwardReport,
+        RetrospectiveKind::ForwardReport,
+    ];
+    let recovered_rate = identity_recovery_rate(&truth, &recovered).expect("recovered");
+    let collapsed_rate = identity_recovery_rate(&truth, &collapsed).expect("collapsed");
+    let expected = {
+        let mut matches = 0_u32;
+        for (truth_kind, decided_kind) in truth.iter().zip(recovered.iter()) {
+            if truth_kind == decided_kind {
+                matches += 1;
+            }
+        }
+        f64::from(matches) / f64::from(u32::try_from(truth.len()).expect("len"))
+    };
+    assert!((recovered_rate - expected).abs() < f64::EPSILON);
+    assert!(recovered_rate > collapsed_rate);
+}
+
+#[test]
+fn empty_or_mismatched_kind_payloads_fail_closed() {
+    assert_eq!(
+        identity_recovery_rate(&[], &[]),
+        Err(RetrospectiveEdgeError::InvalidEdgePayload)
+    );
+    assert_eq!(
+        identity_recovery_rate(&[RetrospectiveKind::RetrospectiveReport], &[]),
+        Err(RetrospectiveEdgeError::InvalidEdgePayload)
+    );
+    assert_eq!(
+        identity_recovery_rate(
+            &[
+                RetrospectiveKind::RetrospectiveReport,
+                RetrospectiveKind::ForwardReport
+            ],
+            &[RetrospectiveKind::RetrospectiveReport]
+        ),
+        Err(RetrospectiveEdgeError::InvalidEdgePayload)
+    );
+}

docs/TRACEABILITY.md

@@ -12,7 +12,7 @@ The full APA 7th standards/literature register remains `docs/research/standards-
 | Rust workspace/quality foundation | ADR 0007 | workspace/CI/repository contract | implemented-main |
 | six distinct clocks and uncertain intervals | PRD; ADR 0002 | PR #8 `temporal_core` on protected main; PR #5 historical only | implemented-main |
 | Allen relation algebra/bounded closure | ADR 0002; temporal research | PR #9 `temporal_core` path-consistency on protected main | implemented-main |
-| forward-only transition subgraph | PRD; ADR 0002/0003 | `relation_graph` on protected main | implemented-main |
+| forward-only transition subgraph | PRD; ADR 0002/0003 | `relation_graph` on protected main; `retrospective_edge` retrospective-versus-translation identity on the active PR | partial |
 | event ontology/evidence mentions | PRD; ADR 0003 | `event_core` mention/instance separation on protected main; `persistence_postgres` mention SQL implemented-main refuses mention-as-instance; event-instance SQL (#39 implemented-main) refuses inverted windows; full intelligence stack remaining | partial |
 | time-varying cross-classified multiple membership | PRD; ADR 0003 | `membership_core` network on protected main; multilevel estimators remaining | partial |
 | leakage-safe availability/cutoff snapshots | PRD; ADR 0002/0013 | `corpus_split` on protected main | implemented-main |

docs/adr/0002-six-clock-temporal-semantics.md

@@ -1,7 +1,7 @@
 # ADR 0002 — Six-clock temporal semantics and leakage prevention
 
 **Decision status:** Accepted  
-**Implementation maturity:** active-PR — unmerged PR #8 is the canonical replacement implementing typed clocks/intervals against the current protected-main lineage; superseded/conflicted PR #5 is historical lineage only; downstream transition/split enforcement remains accepted-target  
+**Implementation maturity:** partial — typed clocks/intervals implemented-main via `temporal_core`; retrospective-reporting identity in `retrospective_edge` on the active PR; downstream transition/split enforcement remains accepted-target  
 **Date:** 2026-08-05  
 **Supersedes:** None. ADR 0013 owns persistence/split representation; ADR 0016 owns event-intelligence reasoning above these temporal primitives.