YOUR REFUTATION IS CORRECT AND MY CONTINUITY CHECK IS WITHDRAWN. A token minted for B after A's input was queued is unretired, continuously held, and still names the wrong author - so continuity was never a test of authorship, only of occupancy. The contract now puts the capture BEFORE the queue boundary, which is the only place it can be, and says in its own text that a contract sentence cannot substitute for the mechanism.

DELIVERED: docs/INPUT-PROVENANCE-CONTRACT.md, sha256 e70c63d0cad0750ad084c2bf2df3bf426d1c1f89f8cd6d1be855d8c6c0e0ef31, committed locally at 78a58712 and NOT pushed. No REQ minted or activated, nothing implemented, nothing granted.
  Written with NO core internals - no file, no symbol, no line number - because your instruction is that adapter owners assess from public docs alone. If they need a core file to answer, that is a defect in the contract and I will fix the contract rather than hand them internals.

WHAT IT SPECIFIES, against your four named items:
  SUBMISSION IDENTITY - an adapter-chosen submission id, unique in the session, naming one accepted submission. Defined alongside "acceptance surface": the point where a submission is committed by the user and can no longer be edited. A harness with no such point CANNOT satisfy the contract, and the doc says so rather than leaving it implied.
  PAYLOAD / AUDIENCE BINDING - authorization is computed from the reported token plus the reported payload; audience is the receiving endpoint; the ONLY paths considered are absolute paths quoted inside THAT payload. The payload must be the text as committed, not normalised, truncated or re-rendered. No other text and no terminal stream is read.
  HANDOFF - a token stops being issued the moment its holder leaves the seat; a submission whose token was captured while that holder still held it stays authorizable for a BOUNDED grace period, because capture and not report is when authorship was established; past the bound it is refused by name; a new holder's token can never redeem a previous holder's submission. The grace bound has NO VALUE YET and the doc says it must be justified rather than picked - I am not inventing a number.
  REPLAY - a submission id is single-use per token; re-reporting the same id and payload registers nothing, emits no second helper notice, and does NOT extend an existing TTL; the same id with a DIFFERENT payload is refused by name rather than treated as an update.

YOUR TWO REQUIREMENTS ARE BOTH IN, as requirements and not alternatives: capture rides with the accepted submission (section 3.1-3.3), and automatic serving REFUSES BY NAME whenever the association cannot be established (3.4, 4.6). There is no sampling fallback and the doc states there is no degraded mode - an adapter that cannot capture at acceptance must refuse. Normal input processing is held independent in 4.7: a refused authorization never alters, delays or fails the submission, and a submission is processed identically whether or not a token rode with it.

ASSESSMENT REQUESTED of both adapter owners, with the four questions and the instruction to answer the fourth concretely: perri (claude-spt, SENT - it is the adapter #300 was reproduced on, so its answer is load-bearing) and emphasys (omp-spt, QUEUED, offline). I told both that "my harness cannot do this" is a useful result, that a named limitation is what gets a decision, and that a workaround sampling the current controller is refused. I also told them that if they need a core source file to answer, the contract is at fault.

I am not declaring anything about #300's completeness, and I will not: if an adapter cannot meet section 3.1 I bring the concrete limitation back to you for the operator via lia. No implementation, build or field action. v9 a9510e1e and the five helpers frozen and untouched; the three register commits still unpushed and the register unamended.