# Protocol delta after the executable connection probe

`test_read_only_connection_to_mutable_port` failed against unchanged Hearth 1.1.0:
`permission-kind` prevented a consumer from connecting to a landing that also offered a restricted
resurfacing grant. See `failing-connect-probe.txt`. The extension submitted no writes and required
actual support/headroom at the public endpoint.

The general fix is in `Scene._instantiate`: `Binding(..., verb='connect')` now records a read-only
connection, capacity use and dependency without acquiring a mutation grant, whether or not the
port also has a grant. All other verbs retain their original checks. A connection never authorizes
writing to the host. The extension cannot implement this using its own effects because binding
permissions are enforced by the kernel before effects are applied; requesting unrelated mutation
permission would misrepresent its authority. No component-name dispatch or signature change was added.

The regression suite adds a negative case proving that a connected consumer cannot overwrite the
landing. Old artifact structures and serialized contract schemas are unchanged. This is a self-authored
extension/protocol exercise, not independent review.

## Explicit replacements in a coupled replay

The bridge replacement test exposed conservative host invalidation: removing contact output can
invalidate earlier platform surveys even though their principal intent is unchanged. Replaying only
the link correctly refuses to finalize stale platform observations. Replaying hosts and link together
was possible, but the public API could only replace the first target, while the changed link must
come after its hosts. The proposed `replacements` call failed before the change; its TypeError is
retained in `failing-replay-probe.txt`, and the original stale-input result remains in
`../extension-corpus/focused-tests.txt`.

`Scene.regenerate(..., dependents=(...), replacements={path: component, ...})` now accepts explicit
replacements for any named replay target. Targets remain explicitly ordered, retain their frames,
scopes and bindings, and replay in one bounded transaction. Undeclared or duplicate targets fail.
No automatic graph-wide update loop or stale-flag bypass was added. A link can be replaced while its
unchanged hosts are recomputed first from their inputs. Reloaded branches may likewise supply their
implementations explicitly through this mapping. Existing calls keep their previous behavior.