# Ownership and navigation

Nonfinal architecture review · 0.4.0. Generated from `assets/review-model.js`; edit that source and rerun `node tools/generate-docs.js`.

Use the corresponding architecture boundary to reach interfaces, owned data, scopes, costs and decisions.

## catalog

### id

cat_primary

### tenant

ten_primary

### ownership

Tenant-private

### status

Proposed — awaiting Jonathan’s acceptance

### alternative

Shared catalogs with private overlays remain a future option, requiring governance and an explicit migration.

## services

### svc_collector

#### interface

if_capture_submit

#### data

captures and receipt attribution

#### permission

captures:write

#### cost

Fetch / browser / evidence

### svc_resolver

#### interface

if_accepted_change

#### data

Accepted facts, decisions, immutable evidence and outbox

#### permission

decisions:write

#### cost

CPU / PostgreSQL / LLM / review

### svc_product

#### interface

if_projection_bootstrap

#### data

Applied projections, publication grants and inbox

#### permission

exports:read

#### cost

Event delivery / projection database / product API

## journey

- Capture
- A collector acquires the original listing and records source URL, observed time, stable instance, and immutable evidence.
- collectors.html
- Collector execution

- Extract
- The deterministic Lumen parser misses a heatsink field in a changed template. The unmapped evidence is retained.
- contracts.html#cap_lum_0310
- Resolver processing

- Resolve identity
- Existing attributes suggest the non-heatsink item, but the source evidence conflicts. A match is a proposal.
- review.html#rc_0007
- Active rules

- Optional LLM extraction
- Fallback proposes a typed heatsink claim with an evidence locator. Failure remains unresolved; a model call is not success.
- review.html#rc_0007
- Untrusted proposal

- LLM review
- A separate model reviews the proposal and its evidence. It cannot write accepted state or authorize publication.
- trust.html#prn_llm_reviewer
- Recommendation

- Human decision
- A reviewer creates the heatsink variant and corrects the listing mapping with an expected revision.
- review.html#rc_0007
- Required for this split

- Internal acceptance
- The decision, new item, mapping, and events commit together. The new item remains private.
- data.html#publication
- Tenant-private

- Explicit publication
- An authorized operator releases a specific revision and approved explanation. This is a separate command and event.
- data.html#publication
- Publication grant

- Ingest
- The product projection handles duplicates and missing dependencies. Public visibility waits for both the revision and its release.
- preview.html
- Applied state

- Present and improve
- Consumers see the released product and listing URL. A parser fix replays old evidence with its original timestamp, reducing future manual work.
- improvements.html
- No replay freshness gain