@@ -9,6 +9,12 @@ for the accepted compatibility boundary and publication constraints.
 The entries below retain the evidence state at each implementation step. The
 release notes and capability ledger record the current acceptance state.
 
+- Restore the edition 2026 generic declaration contract from 0.25; apply the
+  stricter public layout declaration boundary only to edition 2027 owners.
+  Preserve constraint spelling and explicit abilities during formatting, and
+  accept nominal `ScriptHash` inputs in native `exact_hash` lifecycle clauses.
+  See [the syntax compatibility audit](docs/CELLSCRIPT_0_25_0_30_SYNTAX_AUDIT.md).
+
 - Make cost evidence mandatory in CI/backend and both release gates: missing
   RISC-V target libraries or the selected Rust toolchain's `llvm-strip` fail
   instead of silently skipping. Require a fresh execution report, independent
 
@@ -1542,6 +1542,11 @@ fn validate_public_interface_metadata(metadata: &Value, module: &str, expected_h
     {
         return Err(metadata_binding_error("compile metadata public interface has an invalid schema, version, or module identity"));
     }
+    let edition = interface.get("edition").and_then(Value::as_str);
+    if !matches!(edition, Some("2026" | "2027")) || edition != metadata.get("edition").and_then(Value::as_str) {
+        return Err(metadata_binding_error("public interface edition must match compile metadata"));
+    }
+    let strict_layout = edition == Some("2027");
     let canonical = canonical_json_value(&Value::Object(interface.clone()));
     let canonical_bytes = serde_json::to_vec(&canonical)
         .map_err(|error| metadata_binding_error(format!("failed to serialize canonical public interface: {error}")))?;
@@ -1555,7 +1560,7 @@ fn validate_public_interface_metadata(metadata: &Value, module: &str, expected_h
     let callables = validate_public_interface_items(interface.get("callables"), "callable")?;
     for item in types {
         let identity = item.get("identity").and_then(Value::as_str).unwrap_or("<unknown>");
-        validate_public_type_parameters(item.get("type_parameters"), &format!("{identity}.type_parameters"), true)?;
+        validate_public_type_parameters(item.get("type_parameters"), &format!("{identity}.type_parameters"), strict_layout)?;
         validate_public_value_abilities(item.get("value_abilities"), &format!("{identity}.value_abilities"))?;
     }
     for item in callables {
@@ -8049,6 +8054,7 @@ mod tests {
             "schema": "cellscript-package-interface-v3",
             "version": 3,
             "module": "api",
+            "edition": "2027",
             "types": [{
                 "identity": "api::Pair",
                 "type_parameters": [{
@@ -8062,7 +8068,7 @@ mod tests {
             "callables": []
         });
         let hash = public_interface_hash(&interface);
-        let metadata = serde_json::json!({ "public_interface": interface });
+        let metadata = serde_json::json!({ "edition": "2027", "public_interface": interface });
         validate_public_interface_metadata(&metadata, "api", &hash).unwrap();
 
         let mut compact_machine_form = metadata.clone();
@@ -8077,6 +8083,11 @@ mod tests {
         let unsafe_hash = public_interface_hash(&unsafe_layout["public_interface"]);
         let error = validate_public_interface_metadata(&unsafe_layout, "api", &unsafe_hash).unwrap_err();
         assert!(error.message.contains("public layout boundary"), "{}", error.message);
+        unsafe_layout["public_interface"]["edition"] = serde_json::json!("2026");
+        let legacy_hash = public_interface_hash(&unsafe_layout["public_interface"]);
+        assert!(validate_public_interface_metadata(&unsafe_layout, "api", &legacy_hash).unwrap_err().message.contains("edition"));
+        unsafe_layout["edition"] = serde_json::json!("2026");
+        validate_public_interface_metadata(&unsafe_layout, "api", &legacy_hash).unwrap();
     }
 
     #[test]
 
@@ -386,6 +386,15 @@ mod tests {
         assert_eq!(result["runtime"]["fail_closed_obligations"], serde_json::json!([]));
     }
 
+    #[test]
+    fn wasm_preserves_legacy_public_generics_in_2026_only() {
+        let source = "module legacy\npublic struct Box<T: copy> has copy { value: T }\naction verify() -> u64 { verification let b: Box<u64> = Box<u64> { value: 7 } return b.value }";
+        let legacy: serde_json::Value = serde_json::from_str(&compile_metadata_json(source, "2026", None)).unwrap();
+        assert!(legacy.get("error").is_none(), "{legacy}");
+        let strict: serde_json::Value = serde_json::from_str(&compile_metadata_json(source, "2027", None)).unwrap();
+        assert!(strict.get("error").is_some(), "{strict}");
+    }
+
     #[test]
     fn wasm_playground_accepts_the_canonical_public_value_generic_surface() {
         let source = r#"
@@ -514,6 +523,9 @@ type_script TokenTransfer on type_group<Token> {
         let result: serde_json::Value = serde_json::from_str(&compile_metadata_json(source, "2027", None)).unwrap();
         assert_eq!(result["edition"], "2027");
         assert_eq!(result["actions"][0]["name"], "transfer");
+        let typed_source = source.replace("recipient: Address", "recipient: ScriptHash");
+        let typed: serde_json::Value = serde_json::from_str(&compile_metadata_json(&typed_source, "2027", None)).unwrap();
+        assert_eq!(typed["actions"][0]["name"], "transfer", "{typed}");
 
         #[cfg(feature = "language-service")]
         {
 
@@ -0,0 +1,94 @@
+# 0.25 to 0.30 syntax compatibility audit
+
+The 2026 edition retains the checked source meaning of 0.25. New 2027 authoring
+forms remain opt-in. Compiler requirements, package locks, source editions,
+and artifact compatibility are separate axes; accepting old source does not
+promise identical ELF bytes across compiler releases.
+
+## Comparison boundary
+
+The audit compared tag `v0.25.0` (`3b481eb019a1fdc358d4efbe8340d28d3e6a9441`)
+with the pre-fix 0.30 candidate `9007851852072f6757686bdea2abfb79d87269c2`.
+The original 0.25 compiler was built from that exact source archive. Of 86
+historical source samples compiled outside their original package contexts,
+52 compiled with 0.25 and all 52 also compiled with the candidate. This is a
+bounded acceptance comparison, not a proof of semantic equivalence for all
+programs. Package-context failures from old lock schemas were classified
+separately; intentional repinning uses `cellc lock` or `cellc update`. The same
+86-source comparison was repeated after the fixes: all 52 old-accepted sources
+still compile. The exact original 0.25 compiler also successfully generated
+ELF from the historical generic seed after formatting with the fixed compiler.
+
+Targeted examples exposed three gaps that the broad historical sample did not
+cover. The regression tests now enforce the following boundaries.
+
+## Public generic declarations
+
+This 0.25 program remains valid in edition 2026:
+
+```cellscript
+module legacy
+struct Box<T: copy> has copy { value: T }
+action main() -> u64 {
+    verification
+    let value: Box<u64> = Box<u64> { value: 7 }
+    return value.value
+}
+```
+
+Unconstrained public templates remain accepted in 2026 as well. Concrete
+specializations still enforce declared abilities, bounded monomorphization,
+layout validity, phantom restrictions, and the prohibition on hiding Cells.
+Edition 2027 requires public non-phantom layout parameters to declare `fixed`,
+`serializable`, and `non_linear`. This stricter rule belongs to the template
+owner's edition, including imports across editions.
+
+The compiler, canonical interface validator, Registry API, and independent
+artifact checker agree on this distinction. Current interface editions must
+match their enclosing metadata or publication record. Registry publication
+continues to accept only its existing supported edition; this fix does not
+expand Registry admission to preview packages.
+
+## Full Script hashes in native lifecycle syntax
+
+Both ordinary replacement relations and native `type_script` lifecycle
+clauses accept `ScriptHash` for `exact_hash(...)`. Native replacement, pool,
+and fresh-output paths share the fixed 32-byte hash representation. Existing
+native-preview `Address` and `Hash` arguments remain compatibility inputs.
+Ordinary replacement relations retain their stricter nominal-domain check:
+use `ckb::script_hash(hash)` when explicitly interpreting a trusted raw `Hash`
+as a complete Script hash. No arbitrary integer or unrelated nominal value
+is accepted as a lock hash.
+
+The native witness builder uses `EntryWitnessArg::Bytes` for the nominal
+`ScriptHash` value, with exactly 32 bytes. This matches the existing nominal
+fixed-byte encoding rather than introducing a new wire ABI. Real CKB-VM tests
+exercise typed fresh outputs and replacement group binding.
+
+## Formatting is not a source migration
+
+`cellc fmt` preserves expanded generic constraints and explicit `has` clauses.
+If the source already uses `fixed_value`, it keeps that compact spelling.
+Formatting does not introduce `fixed_value` into a 0.25-compatible file or
+remove an explicit ability declaration that an older compiler needs. Compact
+and expanded constraints still produce the same canonical interface identity.
+This applies to the shared formatter used by CLI and editor consumers.
+
+Opting into new shorthand or inferred abilities is an intentional source
+change. It requires a compatible compiler requirement; formatting alone does
+not change that requirement or repin a package.
+
+## Regression evidence
+
+- `tests/syntax_compatibility.rs`: legacy declarations, strict 2027 rejection,
+  formatter stability and interface identity, native hash-domain acceptance.
+- `compile_file_monomorphizes_imported_generic_types_and_functions_in_their_owner_module`:
+  dependency-owned contracts across both importer/owner edition directions.
+- `tests/native_group_binding.rs` and `tests/native_lifecycle_binding.rs`:
+  actual CKB-VM typed lock-hash execution and adversarial transaction shapes.
+- Interface, independent checker, Registry, and WASM tests cover the consumer
+  boundaries; the syntax matrix includes a nominal ScriptHash native seed.
+
+Local gate results are recorded with the implementing change. Branch pushes
+are separate from publication: this work creates no release tag, invokes no
+Release workflow, and does not publish packages or trigger TAC.
@@ -92,12 +92,16 @@ The machine ledger is the detailed source of truth. At this candidate point:
   likewise reports no moderate/high/critical advisories after its release-tool
   refresh; its three remaining low findings are the same unsafe-fix class.
 
-The current product gitlinks supersede the historical recovery pins above:
+The pre-syntax-audit candidate superseded the historical recovery pins above:
 VS Code `ee0f259a` and website `6a61e49` were pushed and read back with root
 `74cff5fd` on 2026-09-19. That candidate passed `dev`, full `ci` within
 `release`, `backend`, and `release` on 2026-09-18. Its canonical WASM is
 571,696 bytes gzip with SHA-256
 `419e8260c3c6acc9f950adf422de90163533c14af96043ebb7429f935b1393d6`.
+The subsequent [syntax compatibility fixes](CELLSCRIPT_0_25_0_30_SYNTAX_AUDIT.md)
+rebuild the current workspace WASM to 571,644 bytes gzip, SHA-256
+`8df77dde17da89b14dc31e1f08cb14e262a7e35516f415783b20f2bd68fcdb0d`.
+The historical release-gate result above belongs to its stated candidate.
 The [dated issue audit](releases/CELLSCRIPT_0_30_ISSUE_STATUS.md) records all
 24 issue dispositions and the remaining publication boundary.
 
 
@@ -63,7 +63,7 @@ resource Token has store, replace, relock {
 type_script TokenTransfer on type_group<Token> {
     entry transfer(
         input token: Token from group_input[0],
-        witness recipient: Address from group_witness.input_type,
+        witness recipient: ScriptHash from group_witness.input_type,
         output next: Token from group_output[0],
     ) {
         verify {
@@ -282,7 +282,8 @@ rules:
   output-producing dispositions follow declared `group_output` order so the
   checked backend index and source role cannot diverge;
   every schema field and fixed envelope clause appears exactly once in
-  canonical order; every `exact_hash(...)` subject has type `Address`; and
+  canonical order; `exact_hash(...)` accepts the nominal `ScriptHash` domain;
+  the native preview also retains `Address` and `Hash` inputs for compatibility; and
   `effects` is final and non-empty;
 - a `pool` has non-empty, unique, explicitly named input and output sets; at
   least one unsigned numeric schema field uses `= conserve`, which generates
@@ -471,7 +472,7 @@ The following remain outside `preview4`:
 - foreign/open roles, Script handles, ProtocolBundle, or `.celltx`
   choreography;
 - non-positional selectors and bounded variable-cardinality native roles;
-- Script-valued lock construction beyond the current Address-based transfer
+- Script-valued lock construction beyond the current full-hash-based transfer
   primitive;
 - audit evidence kinds beyond the metadata-only `external_policy(subject)`
   declaration;
 
@@ -50,8 +50,9 @@ expanded abilities is a duplicate-constraint error. Combining `cell` and
 
 The expanded spelling remains accepted. Compact and expanded source forms
 produce the same AST constraints, public interface, interface hash, typed
-instantiation evidence, IR, and artifact. The formatter writes the compact
-profile.
+instantiation evidence, IR, and artifact. The formatter preserves whether the
+source used the compact profile or expanded constraints, and retains explicit
+`has` clauses so formatting does not raise the minimum compiler version.
 
 ## Visibility and layout boundary
 
@@ -62,10 +63,12 @@ profile.
 - Edition 2026 retains its historical public-by-default behavior, although new
   package APIs should spell visibility explicitly.
 
-Every non-phantom parameter of a public generic struct or enum must declare at
-least `fixed + serializable + non_linear`. `fixed_value` is the normal spelling
+In edition 2027, every non-phantom parameter of a public generic struct or enum
+must declare at least `fixed + serializable + non_linear`. Use `fixed_value`
 when the parameter also supports copy, drop, and store. Missing public layout
-requirements fail with `E2110` and point to `fixed_value`.
+requirements fail with `E2110` and point to `fixed_value`. Edition 2026 retains
+the 0.25 declaration contract, including unconstrained public templates;
+concrete specializations still undergo ability, layout, and hidden-Cell checks.
 
 A phantom parameter contributes to canonical type identity and occupies no
 serialized bytes. Using a phantom parameter in a field remains `E2110`.
@@ -135,16 +138,15 @@ monomorphization identities in typed semantics.
 
 ## Migration
 
-The existing expanded nightly spelling remains source-compatible. Run
-`cellc fmt` to convert an exact six-constraint list to `fixed_value` and remove
-an explicit generic `has` clause when it exactly matches structural derivation.
-The formatter round-trip test proves this rewrite is deterministic and does not
-change the canonical interface identity.
+The expanded 0.25 spelling remains source-compatible under edition 2026.
+`cellc fmt` preserves expanded constraints and explicit `has` clauses. Adopting
+`fixed_value` or removing an explicit ability clause is an intentional source
+migration requiring a compiler that supports those forms.
 
-Packages with public generic layouts that omit `fixed`, `serializable`, or
-`non_linear` must add the missing contract or make the template
-`public(package)`/`private`. This is an intentional stabilization error rather
-than an implicit change to the accepted type set.
+When opting into edition 2027, public generic layouts must add any missing
+`fixed`, `serializable`, or `non_linear` constraints, or change visibility to
+`public(package)`/`private`. Dependency templates use their owning package
+edition; the importer cannot silently select a stricter declaration contract.
 
 ## Evidence boundary
 
 
@@ -27,16 +27,18 @@ private fn internal_identity(value: u64) -> u64 {
 `fixed_value` is the source shorthand for the canonical expanded constraint set
 `copy + drop + store + fixed + serializable + non_linear`. Machine-readable
 interfaces always contain the expanded list. When a generic struct or enum
-omits `has`, the compiler derives its abilities from the field contract; the
-formatter therefore removes an equivalent redundant `has` clause.
+omits `has`, the compiler derives its abilities from the field contract. The
+formatter preserves explicit `has` clauses and the chosen constraint spelling
+to avoid silently raising the source minimum compiler version.
 
 CellScript monomorphizes concrete value uses before IR lowering. The compiler
 records every instantiation and applies fixed nesting, count, and identity-size
 budgets. Ordinary generic containers cannot hide a Cell-backed value.
-Public generic layouts require every non-phantom type parameter to be fixed,
-serializable, and non-linear. Public templates may be imported from
-dependencies; specializations remain in the owning module and do not become
-public-interface entries in the consumer.
+Edition 2027 public generic layouts require every non-phantom type parameter
+to be fixed, serializable, and non-linear. Edition 2026 preserves the 0.25
+declaration rules while validating every concrete specialization. Public
+templates may be imported from dependencies. Their specializations remain in
+the owning module and do not become public-interface entries in the consumer.
 
 Value abilities are not Cell authority. `copy`, `drop`, `fixed`,
 `serializable`, and `non_linear` describe ordinary values; `create`, `consume`,
 
@@ -935,8 +935,12 @@ function validateTypeParameters(value: unknown, label: string, layoutType: boole
 }
 
 function validatePublicInterfaceGenerics(publicInterface: Record<string, unknown>): void {
+  const edition = publicInterface["edition"];
+  if (edition !== "2026" && edition !== "2027") {
+    throw new ApiError(400, "invalid_public_interface", "unsupported public interface edition");
+  }
   for (const item of interfaceItems(publicInterface["types"], "types").values()) {
-    validateTypeParameters(item["type_parameters"], `${requireString(item, "identity")}.type_parameters`, true);
+    validateTypeParameters(item["type_parameters"], `${requireString(item, "identity")}.type_parameters`, edition === "2027");
     canonicalValueAbilities(item["value_abilities"], `${requireString(item, "identity")}.value_abilities`);
   }
   for (const item of interfaceItems(publicInterface["callables"], "callables").values()) {
@@ -1073,6 +1077,9 @@ function validateRegistryEntry(
       validateHash(interfaceHash, "interface_hash", "invalid_interface_hash");
       const publicInterface = assertPlainObject(published["interface"], "invalid_public_interface");
       validatePublicInterfaceVersion(publicInterface);
+      if (publicInterface["version"] === 3 && publicInterface["edition"] !== published["edition"]) {
+        throw new ApiError(400, "invalid_public_interface", "public interface edition must match the published edition");
+      }
       const computedInterfaceHash = ckbBlake2bHex(canonicalJson(publicInterface));
       if (computedInterfaceHash.replace(/^0x/, "") !== interfaceHash.replace(/^0x/, "")) {
         throw new ApiError(400, "interface_hash_mismatch", "interface_hash must bind the canonical public interface");