Bind Janus invariants L6 and L7 to tests

CONFORMANCE.md

@@ -39,6 +39,8 @@ Tests that bind an ID from the Janus invariant registry (`jfa-conformance-suite.
 | Registry ID | Test | What it adds beyond the package's existing tests |
 |---|---|---|
 | **L1** — each exchange moves two balances netting to zero | `internal/economy` `TestInvariant_L1_ZeroSumBalance` | Concurrent payers across two ledgers sharing one store; per-record netting; replay reproduces every balance |
+| **L6** — no update-in-place, no delete; dismissal is annotation | `internal/record` `TestInvariant_L6_AppendOnly` (dismissal half: `internal/covenant` `TestAnswersCloseTheSymmetryBreach`) | A correction appends and leaves the corrected entry and all earlier proofs intact; an in-place rewrite done directly on storage fails consistency against a checkpoint taken before it; a module-wide source scan finds no update or delete verb on any append-only type — tracked by name (Store/Log/Ledger/Book) or by an "append-only" doc comment, with `market.Catalog` and `techtree.Tree` pinned so they cannot drop out of scope |
+| **L7** — commons holds hashes, types, timestamps, references only | `internal/record` `TestInvariant_L7_CommonsSchema` | Every commons type, field by field, admits only byte arrays, unsigned integers, `time.Time`, and `[]byte` fields named in an explicit allowlist of ed25519 keys and signatures — no string, map, interface, float, or unlisted `[]byte`; every allowlisted field, padded with a memo, fails verification against a passing unpadded control and never enters a log |
 | **L8** — full distribution carried; no scalar score anywhere | `internal/covenant` `TestInvariant_L8_NoScalarAggregation` | Two members with equal means and different shapes stay distinguishable; a module-wide source scan for score-named or float-returning exported functions, score-like JSON tags, and float fields in reputation packages |
 
 ## Stand-ins and open residuals