ADR 0010: External bindings and succession preserve distinction

Context

Linear issues, email messages, provider identities, model processes, and custodians may disappear or be replaced. Canonical Pre continuity cannot depend on an external object's survival or imply that a replacement inherits every permission.

Decision

An external binding maps one canonical object to one provider object and declares field-level direction, external write mode, and conflict policy. Adapter authority applies only to named fields. Unlisted, security-sensitive, or canonical-only fields are denied.

External writes may apply, propose, or produce an explicit conflict. Deletion of the external object marks the projection missing; it never deletes canonical history by implication.

Succession is an explicit relation between predecessor and successor with scope, continuity claims, authorizing reference, effective time, reason, and supersession history.

Succession always records authorityTransferred: false. Identity, capability, membership, and context authority require their own new records. Continuity does not equal numerical identity, and replacement does not equal privilege inheritance.

Consequences

• adapters remain replaceable projections rather than owners;
• field-level policies avoid granting whole-object control for one useful integration;
• conflicts and external deletion are reconstructable;
• model, agent, device, and custodian replacement can preserve attribution and obligations;
• succession cannot become an accidental privilege-escalation path.