D-164: one coordinate, one PURL — the maven identity seam for the asserted tier

[MoSLoF]

What

Fixes the Maven purl-separator inconsistency the elastic-agent validation flagged at the asserted tier's merge fallback — a defect left open from D-162/D-163, verified against the source before writing the fix:

• With no Declarer seam for maven, mergeResolved's fallback names a deps.dev-asserted child pkg:maven/org.postgresql:postgresql@42.7.4 (colon kept in the name) while the adapter's observed node is pkg:maven/org.postgresql/postgresql@42.7.4 (namespace form). Two IDs for one package: observed-beats-asserted dedupe can't match, the same direct dependency re-enters as a colon-form twin, and advisories/registry data split across the pair — the D-15 identity leak, one tier up, exactly what the Identify contract doc says the seam exists to prevent.
• Compounding it: the walk skips ecosystems without a declarer as expansion candidates, so D-162's "-expand can deepen Clojure trees" held only through the asserted tier — whose merged children then carried the malformed IDs.

Fix

clojure.WalkSource — an identity-only Declarer for ecosystem maven:

• Identify splits group:artifact into the adapter's own purl.NewMaven namespace form (bare name → group==artifact, the Leiningen convention).
• Declared is honest-empty: reading a Maven package's declared dependencies means fetching and interpreting poms (parents, properties, dependencyManagement) — the pom.xml problem, its own decision. The walk's contract counts an absent coordinate as not read, which is the true state — disclosed, never presumed. Real transitive resolution stays with the asserted (deps.dev) tier, whose children this seam now names correctly.
• Registered in the -expand source list.

Validation

• Identify pinned against the adapter's emitted node for the same manifest — one coordinate, one PURL, whichever tier names it first.
• An asserted-merge test through the real Walker with a deps.dev-shaped stub: the queried dep dedupes against the observed node, the asserted child lands at the namespace-form PURL with asserted truth, and no colon-form ID exists.
• The mutation half is permanently encoded: the same scenario run without the seam reproduces the split (with a skip-and-revisit note should the engine's raw fallback ever learn purl grammar).
• Full suite green (35 packages), -race clean, gofmt/vet silent. D-164 entry in docs/DECISIONS.md.

Residuals

The registration is one literal inside the inline -expand source construction — no cheap seam to pin it from a test without a refactor this bug fix shouldn't smuggle in; coverage is the encoded contrast. Declared stays empty until pom reading is its own decision. The engine's raw fallback still writes pkg:eco/name@version for any future ecosystem that gains asserted resolution before its identity seam — this seam is the pattern to copy.

---

🤖 Generated with Claude Code

---

Generated by Claude Code