@@ -3,7 +3,7 @@ title: "Slots must carry their type"
 issue: https://github.com/NobleFactor/devlore-cli/issues/712
 status: in-progress
 created: 2026-08-28
-updated: 2026-09-01
+updated: 2026-09-07
 ---
 
 # Plan: Slots must carry their type
@@ -165,7 +165,7 @@ Receipts and the recovery stack feed compensation and resume. A float that reloa
 changes a *compensating* call, which is worse than changing a forward one. One shared treatment at every
 `any` seam, not a local patch at `bindingData`.
 
-## Work in progress — state as of 2026-09-06
+## Work in progress — state as of 2026-09-07
 
 **Resumed 2026-09-06.** `origin/develop` merged at 869ca1bd as `24136bdf` (195 files, no conflicts; the branch is
 7 ahead, 0 behind). The order this plan asked for held: #644, #645, and #649 landed first, so every announced
@@ -222,11 +222,16 @@ the bare id for a declared resource slot, and the retirement of `Discover(uri)`
    decision 8); `readSlotValue` reads a string in a resource-typed slot by `Lookup(id)` against the document's
    catalog (decision 10), so the slot holds the ledger's entry after load exactly as it did before save. An unknown
    id is an error. A string with the tag-URI prefix is a pre-ruling document, refused by name (#735).
-2. **Dispatch resolves by id.** `resolveDispatchResource` maps the slot's resource -- the graph catalog's entry --
-   onto the run clone's entry by `Lookup(v.ID())`, never `Current(v.URI())`. A string at dispatch is refused
-   outright: after (1) no string reaches a resource slot from a document, and immediate-mode session dispatch
-   (`Graph == nil`) falls through to [Convert] as today. Of the five `method_test.go` pins, the string-key hit becomes
-   a refusal and the resolve-by-URI becomes resolve-by-id; miss, non-identity, and session stay as they are.
+2. **Dispatch resolves a resource by id.** `resolveDispatchResource` maps a Resource slot value -- the graph
+   catalog's entry -- onto the run clone's entry by `Lookup(v.ID())`, never `Current(v.URI())`. **Corrected
+   2026-09-07, before the code landed:** the sizing said a string at dispatch is refused outright; the dispatch-miss
+   judgment scenario (`test_judgment_dispatch_miss.star`) shows why it is not. A `gather` item supplies the path at
+   run time, so `plan.item("source")` resolves to the authored string at dispatch -- a value no plan-time claim
+   ever saw. That string is a key into the run catalog (§5.6), resolved by `Current(key)` as today, and a miss is
+   the catalog's verdict ("not in the run catalog"), which is the scenario's assertion. What (1) removes is the
+   string a *document* used to leave in a declared slot; what (2) changes is the Resource half only. Of the five
+   `method_test.go` pins, resolve-by-URI becomes resolve-by-id; the string-key hit, miss, non-identity, and
+   session stay exactly as they are.
 3. **`origin.go` `Annotations`** are enveloped per value on write and unwrapped on read (`OriginBase`'s two
    unmarshalers), recursing through the map and list forms the envelope already has. Consumers read strings out of
    them (writ's `files` annotation) and are unaffected; a numeric annotation value comes back typed rather than as
@@ -239,7 +244,28 @@ the bare id for a declared resource slot, and the retirement of `Discover(uri)`
    Filed as a follow-up under #625 rather than folded in here; the plan's "retire `Discover(uri)` on unmarshal"
    bullet is closed by the slot path no longer reaching it, and the methods' removal is that issue.
 
-Steps: (1) and (2) with their tests, one commit; (3) and (4), one commit; the follow-up issue filed; then phase 4.
+**Decision 11 (2026-09-07, found by the doctored-checksum judgment scenario): the checksum covers the catalog's
+intent rows.** `CanonicalContent` serializes `children`, `edges`, `subgraphs`, `nodes`, and `origin`; the
+`resources` section -- the ids and URIs the graph's identity is built on -- was outside it. Before (1) that gap
+was masked: a declared slot carried the URI, so doctoring a URI anywhere in the document changed a node and the
+mismatch fired. After (1) the slot carries `res-N`, the URI lives only in its row, and
+`test_judgment_doctored_checksum.star` -- which rewrites `claimed.txt` to `ghost.txt` across the document and
+expects `checksum mismatch` -- loaded the doctored row without complaint: the resolved entry pointed at a file the
+plan never claimed, past the trust boundary. The rows are part of what the graph IS (decision 8 made the id the
+identity a slot names), so they enter the canonical form as `resources`, and a doctored row is a mismatch at load
+as every other doctored byte is. This answers the checksum half of phase 5's open question early; the
+canonical-form half (the envelope is in the canonical form, decision 9) stands.
+
+Steps: (1), (2), and decision 11 with their tests, one commit; (3) and (4), one commit; the follow-up issue filed; then phase 4.
+
+**Items (1), (2), and decision 11 applied 2026-09-07; `make check` green.** `marshalBindings` writes a Resource in a
+declared resource slot as its bare id and refuses an uncataloged one; `readSlotValue` resolves a string in a
+resource-typed slot by `Lookup(id)` against the document's catalog and refuses a tag-URI string by name (#735);
+`resolveDispatchResource` resolves a Resource by `Lookup(v.ID())` and a string by `Current(key)`, the two halves
+of (2) as corrected; `CanonicalContent` carries the catalog's intent rows as `resources`. Pins: the declared slot
+records the id and reloads the entry; a URI in a declared slot is refused; a doctored `resources` row is a checksum
+mismatch; dispatch resolves a Resource by id. The two judgment scenarios that forced the corrections pass unchanged.
+Next: items (3) and (4), one commit.
 
 ### State as of 2026-09-01
 
 
@@ -503,3 +503,112 @@ func TestLoadGraph_ANumberAParameterCannotHoldIsRefusedAtLoad(t *testing.T) {
 		}
 	}
 }
+
+// resourceSlotFixture carries a method whose parameter is declared [Resource], for the declared-resource-slot rule.
+type resourceSlotFixture struct{ ProviderBase }
+
+// Hold accepts a resource; the method does nothing with it.
+//
+// Parameters:
+//   - `entry`: the declared-Resource parameter.
+//
+// Returns:
+//   - `error`: always nil.
+func (p *resourceSlotFixture) Hold(entry Resource) error { return nil }
+
+func init() {
+	AnnounceProvider(reflect.TypeFor[resourceSlotFixture](), NewProviderFlags(SurfaceWorkflow, PlacementQualified),
+		func(runtimeEnvironment *RuntimeEnvironment) (any, error) {
+			return &resourceSlotFixture{ProviderBase: NewProviderBase(runtimeEnvironment)}, nil
+		},
+		map[string]MethodMetadata{
+			"Hold": {ParameterNames: []string{"entry"}},
+		})
+}
+
+// resourceSlotGraph builds a one-node graph whose declared resource slot holds a cataloged resource, and returns
+// the document and the resource's id.
+func resourceSlotGraph(t *testing.T) (document []byte, id string) {
+	t.Helper()
+	environment := formatIdentityEnvironment(t)
+	candidate, err := newAnySlotResource(environment, "test:held")
+	if err != nil {
+		t.Fatalf("newAnySlotResource: %v", err)
+	}
+	resource, err := environment.ResourceCatalog.GetOrCreate("hold", candidate.URI(), func() (Resource, error) { return candidate, nil })
+	if err != nil {
+		t.Fatalf("GetOrCreate: %v", err)
+	}
+	action, err := ReceiverRegistry().BuildAction("resourceSlotFixture.hold")
+	if err != nil {
+		t.Fatalf("BuildAction: %v", err)
+	}
+	node, err := NewNode(NewNodeSpec().WithID("hold").WithAction(action).WithSlot("entry", NewImmediateBinding(resource)))
+	if err != nil {
+		t.Fatalf("NewNode: %v", err)
+	}
+	graph, err := NewGraph(NewGraphSpec().WithOrigin(NewOriginBase("test", "home", NewAnnotationMap(nil))).
+		WithUnits(node).WithResourceCatalog(environment.ResourceCatalog))
+	if err != nil {
+		t.Fatalf("NewGraph: %v", err)
+	}
+	return serializeGraph(t, graph, "json"), resource.ID()
+}
+
+// TestLoadGraph_ADeclaredResourceSlotRecordsTheIDAndReloadsTheEntry pins #712 phase 3's declared-slot rule and
+// #735: the document holds the catalog id, bare, and the reloaded slot holds the ledger entry that id names.
+func TestLoadGraph_ADeclaredResourceSlotRecordsTheIDAndReloadsTheEntry(t *testing.T) {
+
+	document, id := resourceSlotGraph(t)
+	if !strings.Contains(string(document), `"value":"`+id+`"`) {
+		t.Fatalf("the document does not record the slot as the bare id %q:\n%s", id, document)
+	}
+	if strings.Contains(string(document), `"value":"tag:`) {
+		t.Fatalf("the document records a URI in a resource slot:\n%s", document)
+	}
+
+	loaded, err := LoadGraph(formatIdentityEnvironment(t), document, "json")
+	if err != nil {
+		t.Fatalf("LoadGraph: %v", err)
+	}
+	slots := loaded.Nodes()[0].ResolveSlots(nil, nil)
+	held, isResource := slots["entry"].(Resource)
+	if !isResource {
+		t.Fatalf("the reloaded slot holds %T, want the ledger entry", slots["entry"])
+	}
+	if held.ID() != id {
+		t.Errorf("the reloaded slot holds entry %q, want %q", held.ID(), id)
+	}
+}
+
+// TestLoadGraph_AURIInADeclaredResourceSlotIsRefused pins the pre-ruling document: a URI where an id belongs is
+// refused, not re-identified to the current generation (#735).
+func TestLoadGraph_AURIInADeclaredResourceSlotIsRefused(t *testing.T) {
+
+	document, id := resourceSlotGraph(t)
+	rewritten := strings.Replace(string(document), `"value":"`+id+`"`, `"value":"`+tagURIPrefix+`test:held#x"`, 1)
+	_, err := LoadGraph(formatIdentityEnvironment(t), []byte(rewritten), "json")
+	if err == nil {
+		t.Fatal("LoadGraph accepted a URI in a resource slot; want a refusal naming #735")
+	}
+	if !strings.Contains(err.Error(), "#735") {
+		t.Errorf("refusal %q does not name the ruling", err)
+	}
+}
+
+// TestLoadGraph_ADoctoredCatalogRowIsAChecksumMismatch pins #712 decision 11: the catalog's intent rows are in the
+// canonical form, so a document whose `resources` row was rewritten -- the slot's id untouched -- is a checksum
+// mismatch at load, never a graph pointed at something the plan never claimed.
+func TestLoadGraph_ADoctoredCatalogRowIsAChecksumMismatch(t *testing.T) {
+
+	document, _ := resourceSlotGraph(t)
+	if !bytes.Contains(document, []byte("test:held")) {
+		t.Fatalf("the document does not carry the row's URI:\n%s", document)
+	}
+	doctored := bytes.ReplaceAll(document, []byte("test:held"), []byte("test:ghost"))
+
+	_, err := LoadGraph(formatIdentityEnvironment(t), doctored, "json")
+	if err == nil || !strings.Contains(err.Error(), "checksum mismatch") {
+		t.Fatalf("LoadGraph(doctored row) error = %v; want a checksum mismatch", err)
+	}
+}
@@ -805,8 +805,9 @@ func (g *Graph) UnitCount() int { return len(g.Nodes()) + len(g.Subgraphs()) }
 // CanonicalContent returns the graph serialized as YAML without checksum and signature.
 //
 // Used for computing checksums and verifying signatures. The output mirrors the symbol-table serialized form: top-level
-// `children` (root's children IDs in topological order), `subgraphs` (every non-root Subgraph sorted by ID), and
-// `nodes` (every Node sorted by ID).
+// `children` (root's children IDs in topological order), `subgraphs` (every non-root Subgraph sorted by ID), `nodes`
+// (every Node sorted by ID), and `resources` (the catalog's intent rows: the ids a slot names and the URIs they stand
+// for -- part of what the graph is, so a doctored row is a mismatch at load; #712 decision 11).
 //
 // Returns:
 //   - `[]byte`: the canonical YAML bytes.
@@ -819,13 +820,14 @@ func (g *Graph) CanonicalContent() ([]byte, error) {
 	// checksums with no input having changed -- the thing 2.4 says must not happen (#690). Provenance survives on
 	// the graph and in the serialized document; only identity stops depending on it.
 	type canonicalGraph struct {
-		Kind          string      `yaml:"kind"`
-		SchemaVersion uint32      `yaml:"schema_version"`
-		Children      []string    `yaml:"children"`
-		Edges         []Edge      `yaml:"edges,omitempty"`
-		Subgraphs     []*Subgraph `yaml:"subgraphs,omitempty"`
-		Nodes         []*Node     `yaml:"nodes,omitempty"`
-		Origin        OriginBase  `yaml:"origin"`
+		Kind          string        `yaml:"kind"`
+		SchemaVersion uint32        `yaml:"schema_version"`
+		Children      []string      `yaml:"children"`
+		Edges         []Edge        `yaml:"edges,omitempty"`
+		Subgraphs     []*Subgraph   `yaml:"subgraphs,omitempty"`
+		Nodes         []*Node       `yaml:"nodes,omitempty"`
+		Origin        OriginBase    `yaml:"origin"`
+		Resources     []IntentEntry `yaml:"resources,omitempty"`
 	}
 
 	var rootEdges []Edge
@@ -840,6 +842,10 @@ func (g *Graph) CanonicalContent() ([]byte, error) {
 	nodes := g.root.descendantNodes()
 	sort.Slice(nodes, func(i, j int) bool { return nodes[i].ID() < nodes[j].ID() })
 
+	var resources []IntentEntry
+	if g.resourceCatalog != nil {
+		resources = g.resourceCatalog.IntentEntries()
+	}
 	canonical := canonicalGraph{
 		Kind:          g.kind,
 		SchemaVersion: g.schemaVersion,
@@ -848,6 +854,7 @@ func (g *Graph) CanonicalContent() ([]byte, error) {
 		Subgraphs:     subgraphs,
 		Nodes:         nodes,
 		Origin:        g.origin,
+		Resources:     resources,
 	}
 
 	return yaml.Marshal(canonical)
 
@@ -788,9 +788,9 @@ func guardConsumedGone(activation *ActivationRecord, goArgs []any) error {
 // resolveDispatchResource is graph dispatch's identity resolution — the §5.6 seam.
 //
 // Applies only when `activation` is a graph dispatch with a run catalog and `target` implements
-// [Resource]. A [Resource] value resolves by its URI — the dispatched object must BE the run clone's
+// [Resource]. A [Resource] value resolves by its catalog id — the dispatched object must BE the run clone's
 // entry (re-based, state-carrying, the row pre-flight verified), never the captured planning object. A
-// string is the rehydrated identity a reload leaves in the slot and resolves as the key it is. Any other
+// string is a run-time value — a gather item, a variable — and resolves as the key it is (§5.6). Any other
 // value cannot name a resource at dispatch. A miss is the catalog's verdict: the catalog is complete by
 // construction (§5.1), so nothing constructs here — construction from strings survives only in load-time
 // rehydration and immediate mode.
@@ -817,38 +817,37 @@ func resolveDispatchResource(activation *ActivationRecord, value any, target ref
 		return nil, false, nil
 	}
 
-	var key string
+	// A Resource in the slot is the graph catalog's entry; the run clone holds the same ids, so it resolves by id
+	// (#712 decision 8, #735) -- never by URI, which would name whichever generation is current. A string is a
+	// run-time value -- a gather item, a variable -- that no plan-time claim saw: a key into the run catalog, never
+	// a constructor (4-resource-management.md §5.6). A miss is the catalog's verdict either way.
+	var id string
 	switch v := value.(type) {
 	case Resource:
-		key = v.URI()
+		id = v.ID()
+		if id == "" {
+			return nil, true, fmt.Errorf("graph dispatch: resource %q is not cataloged; nothing constructs at dispatch", v.URI())
+		}
 	case string:
-		key = v
+		id = environment.ResourceCatalog.Current(v)
+		if id == "" {
+			return nil, true, fmt.Errorf("graph dispatch: resource %q is not in the run catalog", v)
+		}
 	case nil:
 		return nil, false, nil
 	default:
 		return nil, true, fmt.Errorf(
-			"graph dispatch: a %T cannot name a resource — a string is a key, never a constructor (4-resource-management.md §5.6)",
-			value)
-	}
-
-	catalog := environment.ResourceCatalog
-
-	id := catalog.Current(key)
-	if id == "" {
-		return nil, true, fmt.Errorf(
-			"graph dispatch: %q is not in the run catalog — a string is a key, never a constructor; nothing constructs at dispatch (4-resource-management.md §5.6)",
-			key)
+			"graph dispatch: a %T cannot name a resource — a string is a key, never a constructor "+
+				"(4-resource-management.md §5.6)", value)
 	}
-
-	canonical, ok := catalog.Lookup(id)
+	canonical, ok := environment.ResourceCatalog.Lookup(id)
 	if !ok {
-		return nil, true, fmt.Errorf("graph dispatch: run catalog names %q as %s but holds no entry", key, id)
+		return nil, true, fmt.Errorf("graph dispatch: resource %s is not in the run catalog", id)
 	}
 	if !reflect.TypeOf(canonical).AssignableTo(target) {
 		return nil, true, fmt.Errorf(
-			"graph dispatch: run catalog entry %q is %T, which cannot fill a %s slot", key, canonical, target)
+			"graph dispatch: run catalog entry %s is %T, which cannot fill a %s slot", id, canonical, target)
 	}
-
 	return canonical, true, nil
 }
 
 
@@ -31,17 +31,17 @@ func TestResolveDispatchResource_StringKeyHitReturnsTheCanonical(t *testing.T) {
 	}
 }
 
-// TestResolveDispatchResource_ResourceValueResolvesByURI pins the captured-object half: a Resource slot
-// value resolves by its URI to the canonical, never dispatching the captured object itself — the aliasing
-// between planning catalog and run clone is severed, not load-bearing.
-func TestResolveDispatchResource_ResourceValueResolvesByURI(t *testing.T) {
+// TestResolveDispatchResource_ResourceValueResolvesByID pins the captured-object half: a Resource slot value
+// resolves by its catalog id to the run clone's canonical, never dispatching the captured object itself -- the
+// aliasing between planning catalog and run clone is severed, not load-bearing -- and never by URI, which would
+// name whichever generation is current (#735).
+func TestResolveDispatchResource_ResourceValueResolvesByID(t *testing.T) {
 
 	catalog := NewResourceCatalog()
 	canonical := newLifecycle("test:///claimed", AddressingLocation)
-	catalog.Resolve(canonical)
-
+	_, id := catalog.Resolve(canonical)
 	captured := newLifecycle("test:///claimed", AddressingLocation) // the same identity, a different object
-
+	captured.id = id
 	activation := &ActivationRecord{Graph: &Graph{}, RuntimeEnvironment: &RuntimeEnvironment{ResourceCatalog: catalog}}
 
 	resolved, applied, err := resolveDispatchResource(activation, captured, reflect.TypeFor[*lifecycleResource]())
@@ -51,6 +51,11 @@ func TestResolveDispatchResource_ResourceValueResolvesByURI(t *testing.T) {
 	if resolved != Resource(canonical) {
 		t.Errorf("resolved %p is not the canonical %p — the captured object must not dispatch", resolved, canonical)
 	}
+
+	uncataloged := newLifecycle("test:///claimed", AddressingLocation)
+	if _, applied, err := resolveDispatchResource(activation, uncataloged, reflect.TypeFor[*lifecycleResource]()); !applied || err == nil {
+		t.Errorf("an uncataloged resource (no id) must be refused, got applied %t, err %v", applied, err)
+	}
 }
 
 // TestResolveDispatchResource_MissRefuses pins the refusal: a graph-dispatch catalog miss is the