Relationship to RFC-019 and RFC-020

Kept: the application/kernel/policy three-proof split; the manifest rules; fixed arity with constrained dummies; consume-and-recreate for freshness; the recovery journal rules; one bounded public obligation; immutable instances; scenario testing; the discipline of a small fixed public statement.

Changed: nullifiers bind the record's rho, not an owner capability, so multi-stakeholder records work; program, instance, and method move behind the program registry and become witnesses; ciphertext review is replaced by in-circuit encryption; the three fixed approval seats with FI checks become stakeholder sets under the authorization rule with FI policy per actor via W; the "one asset" bound becomes up to four per fragment because DvP needs two.

Dropped from the core: public Cell adapters, dependency scheduling, and batch proofs (rollup concerns; the pool stays serial and J composes within a transaction); generic reservations (the Proposal template covers them with no pool state); lineage as a protocol feature (program-level option).