UAN-017 version migration evidence

Scope

The portable composition entrypoint now provides exact-major selection, stable explicit aliases, structural definition comparisons, same-ID breaking replacement rejection, reviewed major migration records, explicit lifecycle policy, and guarded pack migration validation. It does not import handlers or runtime adapters.

E08 independently packs a contract-only album package containing v1 and v2. Its old binding uses the shared internal data lookup while retaining the single-title output. Its new binding requires locale and returns localized titles. JSON fixtures lock both shapes.

Reproduction

From the repository root:

npm run build
node --test test/composition.test.mjs test/public-exports.test.mjs
npm run typecheck
npm run lint
npm run format:check
npm run example:e08

The E08 suite checks exact selection and alias stability, distinct outputs, structural default/unit, rename and required-field reporting, mandatory semantic review for schema-identical majors, same-identity replacement rejection, implicit retirement rejection, independent consumer processes, and the contract-only import boundary.

Observed on research (Darwin arm64, Node 24.18.0, npm 11.16.0): typecheck, format check, build, and focused lint exited successfully after the final review fixes. The full lint had exited successfully before those fixes. The focused composition/public-export suite passed 14/14. Biome reported non-fatal style suggestions in the schema-diff code. The standalone E08 harness packed and installed both packages from tarballs, passed 9/9 tests with zero audited vulnerabilities in that exported fixture, and returned the v1 Kind of Blue output. git diff --check passed.

The post-review tests reject a spoofed pack authority, a structural multi-major pack without reviewed migration policy, forged semantic/contract reports, a new property in a closed v1 output schema under the same ID, and fake lifecycle get() claims without matching entries. E03's lockfile export fix and E12's canonical ID remain untouched. A full repository suite was not rerun for this focused slice.

Limits

Structural comparison reports only information represented in JSON Schema and risk/access metadata.
Rename detection matches a unique removed/added property with identical structure; review determines intent.
Lifecycle policy is local application metadata; no remote registry or package signature is provided.
Removal validation enforces a prior deprecated state but does not schedule retention or notify consumers.