The law that records its own defect.

The minter’s mutable state MUST be the pair timestamp ++ sequence — concretely
state = (ts << 12) | seq — and MUST NOT embed the node bits.

Burst borrow: when more than 4,096 ids are minted in one millisecond, state + 1 carries
from the sequence field into the timestamp field — the node borrows ids from its own
future milliseconds. Because node bits are outside the counter, the borrow can never
reassign an id into another node’s space.

Clock regression: when the wall clock moves backward, now_state < state and minting
continues from state + 1; ids never repeat and never decrease.

A state layout with node bits inside the counter exhibits exactly the cross-node failure past sequence exhaustion, and is non-conformant. The clause exists because a port drifted; writing the law into normative text turned one bug into a permanent test surface for every future port.

Length, namespace, charset, range — four refusals a gate may speak, so that a 400 can say why without leaking what. The five inputs below are the committed vectors; a pure function replays the gates in the contract's evaluation order and names the refusal in each of its committed spellings — the gate name, the C status, and the BEAM's coarse :invalid.

reject "USRzzzzzzzzzzz"                  → range
reject "usr0KHTOWnGLuC"                  → namespace
reject "USR0KHTOWnGLu"                   → length
reject "USR0KHTOWnGL!C"                  → charset

One runtime speaks the vocabulary coarsely: the BEAM's parser reports :invalid without subclassification — the Chapter 1.1 decision that refused a second parser. If the taxonomy ever sharpens there, it sharpens in BrandedId once.

One Rust source, one C reference, one vector file, and a conformance suite per runtime — membership in the fleet is passing the suite, not reimplementing carefully. "Which language" becomes a deployment detail.

runtimes/elixir/verify.exs           pure and native paths, asserted against each other at boot by self_check!/0
contract/branded-id-rs               the crate suite — make -C contract test runs a one-million-id roundtrip
runtimes/node/bench.ts               + wasm_bench.ts
runtimes/go/brandedid                tests
runtimes/postgres/branded_sql.sql    + the extension’s reject and vector blocks

Any behavioral change arrives spec-first: a version bump in the contract, in vectors.json, and in the crate; new or amended vectors; a same-change update to every conformant suite — in that order. A runtime may lag the canon only while its boot-time self-check still passes the shipped vectors; the moment it cannot, it is out of contract and fails loudly rather than serve.

The dialect — the translation layers that grow at every polyglot boundary. Identities can be the only thing that crosses because they mean the same thing on every side; this is the property the law's second clause quietly spends. The minting law guards it from beneath: the same fourteen bytes never name two things, on any node, in any millisecond, drained or not.