Make link/state.json's instance_id always equal jid_from_spki of the journal's own committed CA whenever a committed CA exists. Legacy random UUIDs from pre-self-certification journals are normalized on identity access through one shared helper, removing the legacy-preserve branch (one baseline, no fallback). - establish._normalize_instance_id_against_ca re-derives the id from the existing committed CA (never generates one), preserves home_label, sets locked_at when unset, and verifies the rewrite with an in-memory RuntimeError invariant (no disk re-read). - create_link_state() and lock_in() route their existing-state branch through the helper; LinkState.load_or_create() delegates to create_link_state(). LinkState.load() stays a pure read. - Invert the legacy-preserve test to assert normalization; add coverage for no-CA (no generation), idempotence, already-derived, the invariant raise, and CA/mark stability. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>