Appendix D - 5. The canonical-seam stack

Concept

Route every mutation of a format through one typed model, and stamp every mutation so it can be explained and reversed. The stack is what makes a remediation auditable: one place where change happens, and a durable record of each change made there. A typed model with no attribution can still corrupt trust silently; attribution with no single seam has too many un-covered doors to stamp.

Mandatory members

• Appendix C - 3. PdfModel (sole PDF mutation surface) — the sole sanctioned mutation surface for a format, held in place by a ban-lint on the raw library (the instance here is a PDF model; the pattern applies per format). One door means one place to enforce every invariant. (The office-format and traversal analogues — Appendix C - 2. Office Models ({Slides,Docs,Sheets}Model), Appendix C - 1. Canonical walkers (one traversal per tree) — instantiate the same member for their trees.)
• Appendix C - 17. Per-mutator attribution stamps — every mutating verb records what it changed, in a durable per-mutation stamp. This is what turns an opaque edit into an explainable, reversible one; the single seam exists precisely so this stamping has a bounded set of sites to cover.
• Appendix C - 16. F10 mutator-stamp-wiring lint — a cross-cutting lint that fails if any mutator verb ships without its stamp wiring. It is the guarantee that the stamping is complete, not merely present on the verbs someone remembered. Drop it and coverage rots one new verb at a time.

Complementary members

• Appendix C - 7. ContentValidator (input ⊆ output fidelity) — a fidelity gate asserting the input content survives into the output (input ⊆ output). It catches a mutation that dropped authored content; strong insurance layered on top of the seam, not part of what makes the seam auditable.
• Appendix C - 15. derive-changelog (reconstruct mutations) — reconstruct the human-readable list of mutations from the stamps. A consumer of the attribution record, valuable for the reader; the stack records provenance with or without the rendered changelog.