1# 8. A stamp is a rebuild-cost promise, not a content promise23- **Date:** 2026-08-024- **Status:** accepted5- **Where it is written down:** issue #5 §6, §10 decision 7;6 [stamps.md](../stamps.md),7 [format.md](../format.md) §889## Context1011The format's first invariant is determinism: same archive in, same stamp, same12file name, on any machine. The rewrite therefore raises an obvious question —13must a clean-room implementation reproduce the reference implementation's14stamps? Issue #5 §6 is careful about it: canonical-content equality is15**mandatory**, stamp identity is tracked as an **aspiration per fixture**.1617Measuring why produced two independent answers.1819- A stamp covers a pyramid's **derivation stamp**, and that value is written20 nowhere in the `.atlas` file. Every other part is recoverable from the21 bundle; that one is out of reach by construction, not by omission.22- A derivation stamp deliberately covers **the deriving code's own source23 hash**, so that changing how a level is reduced invalidates every pyramid.24 The exact consequence: two derivers that write byte-identical tiles still25 stamp differently, because they are different tools. Shipping the reference26 implementation's source verbatim is the only way around it, and that is what27 a clean room is not.28- The `bend-or` re-crawl measured the same thing from the other direction: two29 builds of one city, identical in all 2,320 entries but `atlas.json`,30 differing only where the clock is — and therefore differing in the stamp and31 the file name.3233## Decision3435**A stamp is a rebuild-cost promise — "nothing that made this has moved" — and36never a content promise.** Cross-implementation reproducibility is proven where37it is observable: at the tiles and at the composed bundle's canonical content.3839The gate asserts proxies that would fail for anything that could move a stamp:40manifest byte-parity, canonical-content equality, filename derivation, every41recoverable part hash, and the accounting itself — a test that builds the stamp42from every part it can and asserts that what is missing is exactly the43pyramids.4445## Consequences4647- `docs/stamps.md` carries a per-fixture tracking table with a stated48 status, so the aspiration cannot quietly stay impossible — or quietly become49 possible while nobody checks.50- Four fixtures read HELD because the derived tile set is an input the same way51 the capture archive is; the deriver itself is proven in two halves (the plan52 is identical under a substituted tool hash; the tiles are byte-identical).53- Putting derivation stamps into the manifest would fix the gap and restamp54 every bundle in every library. Format evolution waits until parity passes, so55 it is not done here.