legitimacy is internal ∧ external; Robust Openness is external; the registered spine is renamed under an old-to-new map

Maintainer decision, landed by the legitimacy-internal-external round. (1) Legitimacy = internal legitimacy ∧ external legitimacy, of a segment of the principal's trajectory within an interaction whose channels of influence are declared. Internal legitimacy is Integrity (with authentication of the record) and authorship (V = F(R)); external legitimacy is Robust Openness (what should reach the trajectory can) and transparency (what reaches it does so only through declared channels, R = κ(x, z)). Lean Legitimacy.Segment with Internal, External, Segment.trans, Segment.toOpenIntegrity, Segment.payload_of_view (V = G ∘ x is internal ∘ external). (2) Robust Openness is external (this placement and the names internal/external are agent-decided, reversible; the rest is the maintainer's). Integrity is a relation between two accounted states of the actual history; Robust Openness is a condition at one state reaching into the declared counterfactual branches, and the Non-Capture contract it issues is the access half of non-capture — a boundary condition in the direction opposite to transparency's. The alternative placement (openness as part of the trajectory's continuity, the maintainer's first gloss) is recorded and rejected: under it the two halves would be "record" and "channel", which is a different axis from where the conditions act. The names internal/external are kept over continuity/boundary; the risk of reading them as "inside her head / outside" is met by stating that both halves are properties of her trajectory within a declared interaction. (3) The registered conjunction straddles the halves and is kept as an intermediate object, the open Integrity evolution (OpenIntegritySegment, OpenIntegrity), because the activated-value stack consumes exactly it (the occurrence-local projection of Theorem 9.6). The claims are renamed: legitimacy.evolution-conservation, .propagate-to-segment, .receipts-immutable, .faithful-carry, .multiplicity-witness → integrity.*; legitimacy.segment-trans, .endpoint-trans, .answerable → open-integrity.*; legitimacy.endpoint-only-insufficient → openness.endpoint-only-insufficient; the Lean namespace LegitimateEvolution → OpenIntegrityEvolution with LegitimateSegment → OpenIntegritySegment and Legitimate → OpenIntegrity, deprecated aliases kept for one release in LegitimateEvolution.lean; the old entries stay in the registry superseded. The map is in the registry's legitimacy-spine preamble and the round's report; every renamed statement is re-verified by the build and keeps lean-proved. (4) This supersedes the ruling that authorship is not a conjunct of legitimacy (wiki/Legitimacy.md's "third contract" paragraph, wiki/Deference.md, wiki/Openness-Coverage-and-Non-Capture.md): a verdict that does not factor through the reason trace is not the trajectory's own change, whatever the record says of it. (5) Placements: authentication is part of Integrity; hollow ratification is a refinement of authorship, counterfactual responsiveness its diagnostic; informedness and affordability are not part of legitimacy; the influenceable-preferences problem is transparency's scope; non-capture is stated for all influencers; legitimacy does not certify the starting state. (6) The queued reference-fidelity entry of the transparent-channel round is closed: transparency enters as a conjunct of external legitimacy, with reference fidelity as its alias. Rejected alternatives: Robust Openness internal (and the registered conjunction as internal legitimacy); retiring the conjunction outright; renaming without deprecated aliases; keeping the old claim ids with new prose.