[F0.1] Replace hybrid LcsColor with a context-bound LCS occurrence

[lemone112]

Roadmap ownership and position

This is the first implementation slice of the existing local-roadmap F0 — freeze fundamental contract. It does not create a new roadmap.

merged F0a/F1a/F2a/G1a physical foundations
-> F0.1 context-bound LCS occurrence
-> F0.2 release/projection registry
-> C7c public Program freeze and R1/R2/R3 consumers

The owner local roadmap remains sequence authority. This Issue may proceed alongside unrelated C8d work only with no file collision.

Problem

Current public LcsColor is a hybrid value object: it stores CAM16-UCS J-prime/derived s, stores Oklab hue and CAM hue together, represents exact achromatic hue as a number, permits to_hex_with_vc(other_context), and mixes stimulus, observation, difference geometry and rendering.

Target algebra

ColorSignal
  --decode(profile)-->
ColorimetricStimulus { XYZ, ColorimetricFrameId }
  --observe(AppearanceContextId)-->
LcsOccurrence
  --named derived view / evaluator / render-->
evidence or encoded output

Required identities: ColorSignal, ColorimetricStimulus, ColorimetricFrameId, AppearanceContextId, LcsOccurrence, OutputProfileId, RenderProfileId and HueState { Defined, UndefinedExact, PowerlessBy(profile) }.

The colorimetric frame fixes observer, reference white, absolute/relative scale and release. Appearance context is immutable and content-identified from semantic inputs; compiled CAM constants are private cache. Client variant/mode names remain opaque and compile to a context profile ID.

Ownership laws

• XYZ + explicit frame is the canonical stimulus, not a public universal edit space.
• CAM16 is a named context-bound appearance view.
• Oklab/OKLCH is a named authoring/output projection.
• Difference calibration is not mutable coordinates of one color.
• decode, observe, render, matchAppearance and difference are distinct operations.
• Only an explicit edit/match operation creates a new stimulus.
• Output/composition profiles are not inferred from appearance context.
• Cleanliness and sentiment consume LCS evidence; neither is an LCS coordinate.

RED first

• impossible to create contradictory views for one occurrence/context identity;
• compile-fail/context-type test for arbitrary-context inversion;
• mutation of a ghost derived coordinate cannot affect equality because no such stored coordinate exists;
• exact achromatic hue is not 0 degrees;
• stimulus/context/output mismatch is typed;
• sRGB/P3 boundary requires explicit output profile; silent clamp mutation fails;
• arbitrary client VariantKey survives without fixed light/dark enum;
• public numeric constructors reject NaN/infinity/out-of-domain;
• current transform kernels remain differential-equal on admitted inputs.

Required removal

Delete or make private with one-way migration: public hybrid LcsColor fields, lpc_surface, to_hex_with_vc, ViewingConditions::srgb as a claimed viewing profile, is_dark_theme/high_contrast inference and stored dual hue. Do not preserve a compatibility constructor that recreates the invalid state.

Evidence and claims

CIECAM16 is a related-colour appearance model requiring declared viewing conditions, not a universally uniform editable geometry: CIE 248:2022. Li et al. evaluate CAM16-UCS over distinct small-, large-difference and illuminant datasets, supporting explicit applicability/release identity: doi:10.1002/col.22131.

Acceptance

• context mismatch is unrepresentable by the public/core type graph;
• one finite stimulus and immutable context identity own every derived view;
• typed achromatic hue and separate output profile;
• current admitted transforms/final bytes preserved unless an explicit versioned contract changes them;
• no client semantic vocabulary in Core;
• public API inventory, conformance and deletion ledger updated;
• blocks C7c/public schema freeze until complete.

Refs #408 #428 #431 #434.