feat: scienting-math/1 sources and derived/math.jsonl; lode references; stress fixes

Math content may say its source is in scienting-math/1's canonical TeX (form,
in no hash); derived/math.jsonl holds papermath's tree, symbols and issues,
and the validator now checks derived files. A symbol annotation names its
symbol by key; lode claim references use lode's tag and pin syntax. The zip
reader refuses entries zipfile cannot read, and checkpoint lines end in LF only.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017R7sgDNvUGWY2zFPCq2JH6

spec/12-package.md

@@ -32,6 +32,7 @@ Paths use `/`, are relative, have no empty, `.` or `..` segment, no backslash an
 No two paths are the same once case-folded, so a package reads alike on every file system.
 A package folder carries no symbolic links, and a consumer refuses one that does, as it refuses a package whose files exceed its own size limit.
 In a zip, entries are UTF-8 named, sit under one top-level folder named by the key, are stored or deflated, carry no symbolic links, and are unique; a consumer refuses an archive that breaks any of these, or whose expanded size exceeds its own limit.
+It refuses in the same way (`package.zip.entry`) an archive it cannot read, such as one whose entries need a later version of the zip format than it implements, or whose deflated data does not inflate.
 A producer that wants byte-identical archives writes entries sorted by path, dated 1980-01-01 00:00, with no extra fields; `fixtures/packages/tiny2026tiny-j4qm.sct.zip` is such an archive.
 
 ## 12.3 The manifest
@@ -50,7 +51,7 @@ Every stage that uses a model or an outside service records where it ran ([14](1
 | Policy | Means |
 | --- | --- |
 | `full` | Every leaf keeps its content. |
-| `checks-only` | Every leaf has `withheld: true` and no `content`; panels drop their figure text; references keep their resolution but no CSL; there are no corrections, suspects or datasets; and the hashing scheme is keyed: `hmac-team` between the team's machines and `hkdf-pages` outside the team ([5.8](05-hashes.md#58-keyed-hashes)). |
+| `checks-only` | Every leaf has `withheld: true` and no `content`; panels drop their figure text; references keep their resolution but no CSL; there are no corrections, suspects, datasets or derived files; and the hashing scheme is keyed: `hmac-team` between the team's machines and `hkdf-pages` outside the team ([5.8](05-hashes.md#58-keyed-hashes)). |
 
 A checks-only package is how a team shares its annotations on a paywalled paper without sharing the paper.
 Its text lives in the team's private asset store, and only key holders can check its values.
@@ -63,8 +64,17 @@ Bytes that live only in the asset store are listed in the manifest with `present
 
 ## 12.7 Derived files
 
-`derived/` holds what a pinned tool makes from the package, such as `derived/mathml.jsonl`, whose lines are `{node, run, tool, mathml}` with `run` null for an equation node.
-Nothing derived is content, and a consumer may delete and rebuild it.
+`derived/` holds what a pinned tool makes from the package.
+Each line of a derived file names a formula by `node` and `run`, the index of a math run among the node's runs, or null for an equation or equation line, and the `tool` (`{name, version}`) that made it.
+
+| Path | Lines | Schema |
+| --- | --- | --- |
+| `derived/mathml.jsonl` | `{node, run, tool, mathml}`: the formula rendered as MathML. | `mathml.schema.json` |
+| `derived/math.jsonl` | `{node, run, tool, form, tree, symbols, complete, issues, label?}`: the formula read in a math form ([9.4](09-figures-tables-equations.md#94-the-math-form)). | `math.schema.json` |
+
+Nothing derived is content, and a consumer may delete and rebuild it; a validator does not recompute a derived file, since it does not run the tool, but checks its lines against their schema and that each names a formula of the package (`doc.derived.node`), and that a math line's formula is TeX and its `complete` and `symbols` agree with its tree (`doc.derived.math`).
+A derived file reads the text, so a checks-only package carries none ([12.5](#125-text-policies)).
+A correction can delete a formula, change it or move its run, so a producer that applies one rebuilds the derived files or leaves them out.
 
 ## 12.8 Media type and extension