# Layout history reference authority

Scope: references to the existing neutral record-history result.

The original failure is a stored Account layout containing AccountHistory that
fails a name-only save. Reading the same derived object succeeds. The write
validator incorrectly requires a physical object and field incarnation for
application aliases over the already-supported neutral record-history query.

L1 owns the history result projection (object name, parent-reference name,
column names and presentation). Describe, candidate discovery and authoring use
one definition. A typed private Runtime request carries the projection onto the
closed eight members of the existing history result for the layout root. This
is a query-source binding, not a caller-defined schema or a field allowlist.
The public HTTP mutation cannot supply these bindings. They are not persisted
as another Layout authority and are not derived from a frozen Catalog schema.
L0 validates the current root incarnation, source members, lookup, all authored
columns and read-only semantics. Physical objects take precedence over derived
projections, as in Describe, and cannot borrow a projection to bypass their
field validation. Ordinary physical
references retain the existing exact object/field checks. The same postimage
validator handles create, update, clone and restore.

## Verification matrix

- Contract and wire: bounded bijective result-member aliases, invalid members,
  duplicate aliases or members, self-reference, round trips, missing projection.
- L0 owner: neutral non-CRM names; real-parent incarnation only; invalid object,
  lookup, columns, prefill; physical conflicts; physical-reference regressions.
- L1 owner: AccountHistory, OpportunityFieldHistory and custom __History;
  Describe/candidates/authoring share the definition; unsupported parents and
  physical collisions retain physical schema authority; public callers cannot inject bindings.
- Real database and HTTP: create, rename-only update, clone and restore; original
  content preserved; failed validation rolls back; stale revision conflicts;
  missing parents, physical-name collisions and cross-object save concurrency; unchanged
  permissions; no Catalog publication, restart or fallback needed.
- Frozen candidate: relevant package suites, generation check, boundary scan,
  diff check; local full producer-to-consumer walking slice before environment CI.

Current validation failures
retain the existing public error envelope; richer field-path diagnostics are
outside this source-authority change. Display/query target
remapping is a separate existing capability: audit its actual references before
claiming that this history-source change fixes arbitrary virtual resources.