Integrity's primitive is the occurrence-indexed account

agent-decided, reversible. The Integrity certificate is a boundary-indexed segment of transitions, each supplying for every live port an account — a term of OccurrenceIntegrity.Program, whose constructors are the three fates and authenticated local laws — and the account of the whole exposure is a dependent function on occurrences (Accounted). Occurrence identity lives outside the content type; there is no additive or multiset layer over content, because multiplicity is in the index. A local law carries evidence maps in both directions (no loss, no growth) without round-trip laws. Conservation, faithful carry and receipt immutability are consequences of the type (complete_accounting, evaluate_subst, terminals_subst). The lattice ledger of the integrity-constructive round is an instance and is demoted to evidence. Rejected alternative: a lattice-valued content-conservation clause per transition, which restates the conclusion at one step and collapses equal-content occurrences.