The Rail (V10) — Implementation TODOS

Date: 2026-07-16 · Source: V_SERIES_AMBIENT_RAIL.md (concept doc, 2026-07-16) Status of source decisions: D1–D8 are settled and treated as fixed inputs here (one shared Rail, product-designated V10 — its own V-series product riding V1's identity graph (D8); dual-face channels; granted loudness; Veritas-live video flagship in both modes; third-party docking; V3 Stage + Aphrodite; own native shell via Tauri on V1 identity).

This file is the actionable breakdown of the entire concept document into tasks executable by Claude Code or a similar coding agent. Tasks that are not locally actionable by an agent (rights deals, legal review, content licensing, human dogfooding) are collected in §HG at the bottom and tagged inline as (HUMAN GATE) where they block an agent task — per repo rules they stay [ ] and get skipped with a note, never marked done by an agent.

0. Ground rules for executing this checklist#

These follow CLAUDE.md and are restated because they were written for exactly this kind of long checklist:

• One task at a time, sequentially. Read the code for that task, implement or verify, run its tests, mark [x] with the Edit tool, commit + push (both git push origin <branch> and git push origin <branch>:main). Then the next task. No batch marking, ever.
• Limit parallelism. At most ONE concurrent subagent (session limits have been hit repeatedly on this account). Prefer main-loop work; delegate only large read-only audit sweeps, and design agent prompts to be resumable.
• Zero stubs. Every task below means a full, domain-specific, tested implementation. Where a real integration is absent (no creds, no runtime, no content), build the honest fail-loud seam (not_configured throw / 503 fail-closed / { configured: false }) — never fake success. Run the adversarial stub grep from CLAUDE.md before marking any implementation task.
• Ordering. Phases R0 → RA → RB → RC → RD. Within a phase, tasks are ordered by dependency; do not skip ahead to a later phase before the earlier one's non-gated tasks are done. Gated tasks (tagged GATED:) are skipped with a note when the gate is closed, and revisited when it opens.
• Mac hygiene. This box is a 16 GB MacBook Air. One heavy job at a time (build OR emulator OR browser sweep); check memory_pressure before long runs; tear down dev servers at task boundaries; track PIDs.
• Consolidation invariant (§10 of the source doc). The Rail must be the consolidation, not an eleventh duplicate: exactly ONE channel contract (libs/contracts/src/v10), ONE streaming substrate (generalized from Aphrodite), ONE C2PA signer (libs/shared/content-signing, @oshun/content-signing). Any task that would create a second one of these is wrong — reuse instead.

Proposed code homes (established in R0.1; adjust there if the layout task finds a better fit, then treat as fixed):

Phase R0 — Contracts and policy kernel#

Everything else depends on this. The kernel encodes the four broadcast-media properties from §1 as enforceable constraints: progresses-without-you, glance-legible, absence-is-free, co-presence.

R0.1 Scaffolding and the channel contract (§4)#

• Survey the existing layout before creating anything: read libs/contracts/src/index.ts + one existing domain module (e.g. libs/contracts/src/v9/) and one existing libs/v9/* library's project.json/package.json/tsconfig.json to copy conventions exactly (build targets, path mappings in tsconfig.base.json, vitest setup, catalog deps).
• Create libs/contracts/src/v10/ with the full channel-contract type system, as zod schemas + inferred TS types (match how other contract modules do validation): Verified 2026-07-16: every schema in channel-contract.ts read line-by-line; 5/5 vitest green; exhaustive surface record proven empirically (partial record rejected, zod 4); adversarial stub grep over libs/contracts/src/v10 + libs/v10 clean.
  • Ring — 'wellness' | 'games' | 'adult' (§9).
  • Surface + SurfaceAvailability — desktop-shell, browser-panel, mobile, watch, tv; per-surface boolean matrix. Encode the day-one rule: ring: 'adult' forces mobile/watch/tv = false at the schema level (refinement that rejects violating manifests) (§3.1, §9.1).
  • TileSpec (§4.1) — presence-tile descriptor: render payload schema, coldCacheRender: true required capability, textOnlyDegradation required capability, autoplayMotion: false as the only accepted default (motion allowed only via loudness-3 elevation at runtime, never in the manifest default).
  • DripEvent (§4.2) — discrete timestamped event: channel id, type, payload, glanceText (2-second-readable one-liner), optional deep link. No priority/interrupt field exists on the type — channels cannot request interruption via drip, by construction.
  • MicroActSpec (§4.3) — id, title, expectedDurationSeconds with a schema-enforced ≤30s budget, input schema, completion result schema, deep-link fallback for acts that outgrow the budget.
  • LiveMomentSpec (§4.5) — typed 'scheduled' | 'emergent', rate-limit class, daypart hints. Requests elevation; never grants it.
  • AudioSourceSpec / VideoSourceSpec (§6.1–6.2) — video sources carry contentClass: 'first-party-live' | 'overlay' | 'docked-third-party'.
  • DaypartAffinity (§6.3) — affinity weights per daypart id.
  • FaceSpec (§4.4) — { spectator: TileSpec; player?: TileSpec }; spectator face is mandatory, player face optional (front-door audience first).
  • ChannelManifest (§4.6) — composes all of the above; id format "<v>.<channel>" validated by regex (e.g. v8.case-files).
  • DeepLink (§8) — target product, moment context payload, and a landsInside description; schema forbids bare product-root links (every tile deep-links with context, never to a main menu).
  • Vitest suite: valid manifests for two realistic channels (v8.case-files, v9.wonder-recall) parse; violating manifests (adult ring on mobile, 35-second micro-act, drip event with an interrupt field, context-free deep link) are rejected with specific errors.
• Export the rail module from the contracts index; build + lint the contracts project clean.
• Create libs/v10/rail-kernel library scaffold (project.json, package.json with catalog refs, tsconfig, path mapping in tsconfig.base.json, vitest config) — the home of R0.2–R0.5 engines.

R0.2 Loudness engine (§5)#

• Implement the loudness model in libs/v10/rail-kernel:
  • LoudnessLevel 0–3 with the exact semantics table (hidden / tile only / tile+drip / tile+drip+elevation).
  • effectiveLoudness(channel, daypart, grants, pins) = min(daypartCeiling, channelGrant) with user-pinned exceptions overriding the min (e.g. "always break through for V2 finals") — pins are per-channel + per-moment-type, stored data, never channel-settable.
  • Default grant for every newly subscribed channel is exactly 1.
  • Deep-work audio-lane exemption: the audio lane holder remains active at ceiling 1 (§5, §6.3).
• Implement the elevation budget: per-channel per-day request budget by rate-limit class; unspent budget does NOT accumulate (reset at local-day boundary); requests beyond budget are rejected with a typed reason.
• Implement the Rail invariants as executable policy checks the UI and channel host must consult (single RailPolicy API):
  • no-absence-punishment: channel manifests and drip payloads are rejected if they declare streak-loss/decay/expiring-reward semantics (schema-level flag + runtime assertion; adopt Arete's done|partial|skip|decline|miss vocabulary for anything streak-shaped).
  • no-autoplay-below-3: motion/sound autoplay is a runtime capability granted only at effective loudness 3.
• Vitest suite with specific numeric cases: ceiling 1 + grant 3 → 1; ceiling 3 + grant 2 → 2; pin overrides ceiling; day rollover resets budget and discards unspent; budget exhaustion rejects; default-grant-is-1 on subscribe.

R0.3 Daypart engine (§6.3)#

• Implement dayparts in libs/v10/rail-kernel (or a sibling rail-dayparts module if size warrants):
  • Default schedule exactly per the doc: morning-brief (ceiling 2), deep work (1), breaks (2), lunch (3), wind-down (3), with per-daypart surface descriptions as data.
  • User-tunable boundaries (times per weekday), persisted as user settings; timezone-correct across DST using the user's IANA zone.
  • Daypart transition events (the audio-lane handoff trigger and the director-profile switch consume these).
  • Adult-ring eligibility flag: true only in wind-down + an explicit private daypart the user can define (§6.3, §9.1).
  • Calendar-awareness is Phase RD — leave a typed CalendarSource interface seam that throws not_configured (fail-loud, per rules).
• Vitest: default table matches the doc verbatim; boundary math at midnight/DST; transition event emission; adult eligibility only where specified.

R0.4 Timeline and drip batching (§4.2, risk 4)#

• Implement the merged timeline in libs/v10/rail-kernel:
  • Ingest DripEvents from all subscribed channels into one ordered timeline; channels get a fire-and-forget emit API with no delivery control (batching is Rail policy, not channel courtesy).
  • Batching policy per daypart: deep work holds all drips (delivered at the next break), breaks/lunch deliver in batches, wind-down delivers promptly; policy is data-driven so dayparts own it.
  • Per-channel drip rate limiting AND a global drip budget across all channels per daypart (risk 4: ten channels at loudness 2 is still a noisy timeline) — overflow degrades to a per-channel "n more events" rollup entry, never silent drop.
  • Ordering: batch-internal ordering by timestamp; rollups keyed to channel + type.
• Vitest: deep-work holdback then break flush; global budget overflow produces rollups with correct counts; a hostile channel emitting 1000 events cannot exceed its rate slice; nothing is silently dropped.

R0.5 Live-moment arbitration (§4.5)#

• Implement elevation request handling in libs/v10/rail-kernel:
  • Channels submit typed requests (scheduled announced ≥ N minutes ahead vs emergent); the Rail decides via: effective loudness must be 3 (or a user pin), budget available, daypart allows, ring allows.
  • Scheduled moments can pre-announce in the timeline at loudness ≥2 ("accusation window at 8pm") without elevating.
  • Every decision (granted/denied + reason) is recorded for the calm SLO (R0.8).
• Vitest: emergent request at deep work + grant 3 → denied (ceiling 1); same with user pin → granted; budget-exhausted denial; decision log completeness.

R0.6 Rings and policy walls (§9)#

• Implement the three-ring model in libs/v10/rail-kernel (rings are static channel attributes; walls are Rail-enforced behaviors):
  • Ring registry: wellness (V1 house channels, V9, V3 Motion, Tara/Nyx/Arete, Ori), games (V2, V4, V5, V7, V8, V3 Stage), adult (Aphrodite content).
  • Adult-ring wall, each clause as an enforced check with its own test (§9.1): absent from default channel directory; absent from all recommendation surfaces; opt-in requires an age-verification assertion from V1 identity (integration in RD.3 — until then the opt-in path throws not_configured); web/desktop only; eligible only in private/wind-down dayparts; excluded from Ori narration input set; excluded from watch parties; excluded from all cross-channel promotion.
  • Gambling-adjacency guard (§9.2): prediction micro-acts must declare stakes: 'points-only'; any manifest whose micro-act schema contains value-in/value-out semantics is rejected. Document in the module README that anything wager-shaped requires its own review.
• Vitest: one test per wall clause proving the wall holds; a points-and-bragging-rights prediction act passes; a wagering act is rejected.

R0.7 Discretion mode kernel (§9.3 — P0, not polish)#

• Implement discretion state in libs/v10/rail-kernel:
  • Modes: off, text-only (per-channel), hidden (instant, global).
  • One-keystroke instant hide: kernel exposes a panic() transition that the shell binds to a global shortcut (RA.1); state transition must be synchronous (no awaits between input and hide decision).
  • Per-channel text-only tile option persisted per user.
  • Screen-share auto-engage: kernel consumes a ScreenShareDetector signal (shell provides it; browser fallback provides a degraded getDisplayMedia-based self-share signal); on engage, personal tiles (health, Ori, adult ring, active case) collapse to neutral text immediately; disengage requires explicit user confirmation, never auto-restore.
  • Tile neutral-text transform: every TileSpec must supply its textOnlyDegradation; the kernel refuses to register channels without it (already schema-required in R0.1 — assert at runtime too).
• Vitest: transition matrix; auto-engage collapses the personal-tile set and nothing else in wellness ring is lost; no auto-restore.

R0.8 Calm metrics and the anti-engagement lock (§5, §12 risk 1)#

• Implement the metrics module (libs/v10/rail-kernel or rail-metrics):
  • Event schema + local aggregation for exactly: docked-hours, micro-act completion quality (completed within budget / abandoned / outgrew-to-dive), voluntary-return rate (opens not caused by an elevation), and the calm SLO (elevations per user-day; alert when a channel or the Rail exceeds its ceiling).
  • The forbidden metric is structurally absent: no counter for interrupts-clicked exists; add a code comment + test asserting the exported metric set equals the allowed list (this is the lock the doc asks to install now).
  • Spectator-is-success (§8): face state (spectator vs player) is a dimension on docked-hours, not a conversion funnel stage; no "conversion" naming anywhere in the module.
• Vitest: aggregation correctness with synthetic weeks of events; calm-SLO breach detection at the exact ceiling boundary.

R0.9 Identity, entitlements, persistence (§2 D7, §3, §10)#

• Read the existing V1 identity/entitlement code (libs/oshun/auth, libs/shared/identity, libs/shared/auth, apps/oshun/bff) and write a short mapping note (in the rail-kernel README) of where accounts, entitlements, and grants live today — the shell owns nothing account-shaped (D7), so all Rail state below rides V1's graph.
• Implement Rail user-state persistence on the V1 graph via the BFF:
  • Channel subscriptions (subscribe/unsubscribe, ring-aware: adult ring requires the R0.6 opt-in path).
  • Loudness grants + pinned exceptions (R0.2 shapes).
  • Daypart schedule overrides (R0.3 shapes).
  • Discretion preferences (R0.7 shapes).
  • Ring opt-ins with audit trail (who/when/what-verification).
• Add the BFF endpoints in apps/oshun/bff following its existing composer conventions (read several existing endpoint modules first); wire to the V1 database with migrations matching repo practice.
• Face selection from entitlement state (§4.4): a pure function selectFace(manifest, entitlements) → spectator when the user lacks the product entitlement/progress, player when they have it; per-channel override ("show me the spectator face anyway") supported.
• Vitest + integration tests against the BFF (existing test patterns): round-trip each state kind; adult opt-in blocked without age-verification assertion; face selection for entitled/unentitled users.

R0.10 Channel host runtime (§4, §1 properties)#

• Implement the channel host in libs/v10/rail-kernel — the runtime that loads manifests and mediates every channel interaction:
  • Registration: validate manifest against contracts; reject on any schema violation (fail-loud, listing every violation).
  • Tile lifecycle: request render payloads on a Rail-owned cadence; enforce cold-cache render (a channel whose tile cannot render from the last cached payload is marked degraded and shows its text fallback, never a spinner); enforce text-only degradation availability.
  • Face selection wired to R0.9.
  • Micro-act execution: host the act, enforce the ≤30s budget (soft-warn at budget, offer the deep link — never hard-kill user input mid-act), report completion quality to R0.8.
  • Deep-link dispatch: resolve DeepLink context into the owning product's URL/app scheme; refuse context-free links (schema already forbids; assert at dispatch too).
  • "Progresses without you" is a channel-side property the host makes observable: track per-channel drip/tile-change recency and surface stale channels in a host diagnostic (a channel that drips nothing is worse than no channel — risk 3; the host must make that visible).
• Build a test-channel fixture package (a fully real, tiny channel — a clock/quote channel with genuine tile, drip, micro-act, live moment) used by kernel + UI tests. This is a test double at a dependency boundary, not a stub: it really computes what it shows.
• Vitest: registration rejection cases; cold-cache degradation path; micro-act quality reporting; deep-link context enforcement.

Phase RA — the Rail exists (P0, §11 Phase A)#

Ship order within the phase: web UI against the kernel first (testable in Chrome), then the Tauri shell wrapping it, then pilot channels one at a time.

RA.1 Rail web UI (apps/v10/web) — shared by shell and P1 browser fallback#

• Scaffold apps/v10/web following an existing web app's conventions (read apps/oshun/web setup first: framework, design tokens via libs/oshun/design-tokens / design-language, lint/test wiring). It must run standalone in a browser (that IS the P1 fallback) and inside the Tauri webview unchanged.
• Layout: narrow one-third-split geometry as the design target; vertical stack of presence tiles; merged timeline; audio-lane control strip; video-lane panel; micro-act surface. Responsive from ~320px width up.
• Presence tile stack:
  • Tile renderer honoring TileSpec: silent, no autoplay motion, renders from cached payload, text-only mode, 2-second legibility as the design bar (tile header + one state line + one glance metric).
  • Loudness-0 channels hidden; drag-reorder; degraded/stale channel treatment from the host diagnostic (R0.10).
• Timeline: batched drip rendering with rollup entries; daypart-aware delivery from R0.4; per-event deep links; scheduled live-moment pre-announcements.
• Micro-act surface: hosts MicroActSpec interactions inline; budget indicator; completion/abandon/outgrow flows reporting to R0.8.
• Settings surfaces: channel directory (ring-aware — adult ring invisible pre-opt-in), per-channel loudness grants + pins, daypart editor, discretion preferences.
• Discretion mode UI: instant-hide (also bound to a keystroke inside the web app), text-only rendering, screen-share auto-engage banner + explicit restore.
• Wire everything to the BFF endpoints (R0.9) with the repo's existing client conventions; all state changes optimistic + reconciled.
• Test with Claude in Chrome (mandatory per CLAUDE.md for frontend): visual + functional pass over tiles, timeline batching, micro-acts, loudness settings, discretion hide, using the test-channel fixture.
• Component/unit tests per repo convention for the tile renderer, timeline batcher rendering, and settings forms.

RA.2 Native desktop shell (apps/v10/shell, Tauri — D7)#

• Scaffold a Tauri 2.x app in apps/v10/shell (Rust core), integrated with Nx via nx:run-commands (the repo's polyglot pattern); loads apps/v10/web as its frontend (dev server in dev, bundled dist in release).
• Window management — this is the product (D7, P0 requirements):
  • Launches narrow (one-third-split default size derived from the active monitor's work area).
  • Edge docking: snap to left/right screen edge with drag-to-dock and a keyboard command; remember which edge.
  • Pinned across restarts: persist and restore monitor, edge, size, always-on-top state, and visibility.
  • Always-on-top toggle (menu + shortcut + tray).
• Tray / menu-bar presence (macOS first — this box — with the cross-platform code paths kept honest):
  • Tray menu with: show/hide panel, always-on-top toggle, discretion instant-hide, audio-lane transport (play/pause/skip/handoff), and the top-N tile glance lines (text-only by construction).
  • Tray remains functional with the panel closed (the shell keeps the kernel session alive headless).
• Global shortcuts: discretion panic() (works when unfocused — register a system-global accelerator), show/hide panel.
• Screen-share detection feeding R0.7: on macOS detect active capture (ScreenCaptureKit/CGDisplay capture-status APIs from the Rust side); where the platform offers no signal, expose { supported: false } and surface that honestly in settings (fail-loud seam, no fake detection).
• IPC bridge: typed commands between web UI and shell (window ops, tray updates, shortcut events, screen-share signals); define the contract in libs/contracts/src/v10/ (shell-bridge schema) so web and Rust stay in lockstep.
• Autostart-at-login as an opt-in setting.
• Rust unit tests for window-state persistence + IPC command decoding; portable end-to-end native launch automation; document what still needs eyes. Verified 2026-07-18 on the available Linux host: the 34-test Rust suite round-trips and durably reloads the complete versioned monitor, edge, size, always-on-top, and visibility record; rejects unsupported state schemas and expanded/malformed bridge payloads; decodes every shared contract fixture; and dispatches the closed window command through Tauri's real IPC test envelope. The two-test TypeScript shell contract, Rust format/check/clippy gates, and pnpm verify:launch also pass. The launch gate built the custom-protocol binary, kept its real webview/tray process alive for ten seconds under isolated D-Bus/Xvfb, and validated the complete persisted window-state.json. The checked implementation also includes macOS System Events automation for left/right docking, Keep on Top, close-to-tray, and tray restore, plus an explicit visual-eye checklist in apps/v10/shell/LAUNCH_VERIFICATION.md; no macOS result is claimed from this Linux run.
• GATED: a macOS host with Accessibility permission Run pnpm verify:launch on macOS and record the Dock/Keep on Top/tray result plus the five presentation observations from apps/v10/shell/LAUNCH_VERIFICATION.md. 2026-09-18: the Mac is one of this project's two machines, so the host exists; what is missing is a person granting the Accessibility permission in System Settings and watching the five observations. An agent prepares the run and the recording sheet. blocked:human
• Add shell build/dev commands to root docs (README or docs center entry).

RA.3 Audio lane (§6.1)#

• Implement audio-lane arbitration in libs/v10/rail-kernel (or rail-lanes module):
  • Exactly one holder at a time; the Rail is the mixing desk. Handoffs occur ONLY on user action or daypart transition — the API gives channels no "grab" verb (requests queue as offers the user/daypart policy accepts).
  • Holder lifecycle: acquire → play state (play/pause/volume owned by the Rail transport) → release/handoff; brief voice interjections (Ori, RB.3) modeled as time-boxed ducking overlays the holder must declare support for, not a second holder.
  • Deep-work exemption honored (lane keeps playing at ceiling 1).
• Web UI transport strip + tray transport (RA.1/RA.2) driving the lane.
• Vitest: two channels contending → second queues as offer; daypart transition executes the configured handoff; no API path lets a channel self-acquire.

RA.4 Video lane with third-party docking (§6.2, D5)#

• Implement video-lane arbitration alongside RA.3: one primary holder, same offer/accept model; four content classes carried on VideoSourceSpec, including first-party progressive/VOD without the live substrate.
• Docked third-party (the day-one slot-geometry win):
  • Embed hosting for YouTube and Twitch via their official iframe/embed APIs (user pastes/picks a URL or channel; we host the embed, we do not moderate the content); persist the user's docked source across restarts.
  • Playback state surfaced to the lane transport where the embed API allows (play/pause/mute); where it doesn't, show honest reduced controls.
  • Loudness/daypart integration: at effective loudness ≤2 embeds start muted + paused-until-user-acts (no autoplay invariant applies to third-party video too); ambient posture in deep work only if user-pinned.
  • CSP/frame-ancestors and privacy review of the embeds documented in the module README (what the embed can see, what we send).
• Overlay/second-screen primitives (used by Veritas in RB.1): a synced companion-layer slot tied to an external-video clock source (manual sync control now; provider-time integrations later) — build the slot + sync model, with the Veritas ticker as its first consumer in RB.1.
• First-party live class: stub-free seam — plays HLS/DASH from the streaming substrate once RB.4 lands; until then the class reports not_configured and no channel may declare it (registration-time check), so nothing fake ships in Phase A. V3 Stage's Phase A video (RA.8) uses progressive/VOD playback of real encoded assets, which needs no live substrate.
• Web UI panel: lane holder view, docked-source picker, overlay slot.
• Claude-in-Chrome functional pass: dock a real YouTube embed, verify mute/pause invariants at loudness ≤2, verify persistence.
  • 2026-07-17 environment note: the active Codex toolset exposes no Claude-in-Chrome/Chrome automation MCP, so the named sign-off remains open. The strongest available equivalent passed in desktop Playwright Chromium against the live youtube-nocookie.com iframe and official IFrame API (the Rail BFF policy alone was controlled locally), including quiet start, device persistence, no automatic lane reacquisition, and explicit saved- source handoff. The opt-in probe is retained under RAIL_REAL_PROVIDER_E2E=1. 2026-09-18, reworded by the board audit: CLAUDE.md retires the Chrome-extension route on this Mac (its window is occluded, visibilityState: hidden, no rAF, false readings) and names the Playwright inspect harness instead. The sign-off this item needs is therefore the desktop Playwright Chromium pass the note above records. What is left: a second reader confirms that run covers mute and pause at loudness 2 or less and persistence, and checks the box on that evidence.
• Vitest: arbitration parity with audio lane; content-class gating; no-autoplay enforcement.

RA.5 Pilot channel 1 — V8 Case Files (anchor; §7.8)#

Substrate (verified real per 2026-07-14 audit): libs/v8/case-{bundle,csp,gates}, libs/yemaya/case-{compiler,director,engine,eval,pipeline,contracts,...}.

• Read the case stack's public APIs end-to-end first (compiler → director → engine → gates → bundle) and write the channel-integration note: what a "daily case" run needs as inputs, what the evidence-board state object looks like, where the Ed25519 fairness receipt comes from (@oshun/content-signing path per the audit). Audited 2026-07-17: channel-integration note records the executable Loom path, parallel V8 CSP/bundle representation, pre-reveal-safe board projection, and the shared signing seam plus the currently missing case-level receipt/adapter contracts.
• Daily case cook pipeline (risk 3 — a channel that drips nothing is worse than no channel):
  • A runnable job (Nx target) that cooks one daily case: generate via the solve-first pipeline, verify uniqueness (CSP+DPLL gates), sign the fairness receipt, emit a release schedule (director-paced clue and witness drops across a workday + the evening accusation window). Implemented 2026-07-17 in @oshun/v10-case-files-cook: the Nx cook target composes the real Clew/Minos/Daedalus gates, independently proves the culprit through direct DPLL and finite-domain CSP, emits an IANA-zone workday schedule, and signs/self-verifies the versioned receipt with an injected Ed25519 key pair.
  • Weekend variant: bigger case, longer schedule. Implemented 2026-07-17: Saturday/Sunday dates deterministically select the hard difficulty band, increase VO from 22 to 35 minutes, and extend clue/witness drops plus the local accusation/reveal cadence through 22:15.
  • Determinism + provenance: case id, seed, receipt stored with the bundle; job is re-runnable and fail-loud on any gate failure. Implemented 2026-07-17: canonical cooked JSON embeds a versioned provenance record and the signed receipt; fixed --issued-at plus identical signer/input produces byte-identical re-cooks, while drift, unsafe file permissions, or any false G1–G7 state fails closed.
  • Local scheduler wiring (repo-conventional: cron-style job or BFF scheduled task) producing tomorrow's case daily; document the ops seam for real deployment. Implemented 2026-07-17: the one-shot Nx cook-tomorrow target derives tomorrow and a stable batch instant in the product IANA zone; operations guidance supplies a locked local cron entry and the explicit production scheduler, secret-manager, durable-storage, alerting, and key-rotation seams.
• Channel adapter libs/v10/rail-channel-case-files implementing the manifest against the kernel. Completed 2026-07-17: the contract-valid dual-face adapter now projects leak-safe live/cached boards, emits exact scheduled releases through Rail batching, executes three bounded board acts, requests the scheduled accusation moment and delivers its signed reveal, enforces post-reveal-only social comparison, and resolves every connected dive to its exact board/release context.
  • Tile: evidence-board state (suspects, clues released/total, contradictions marked, time to accusation window) — 2-second-legible; text-only degradation ("Case #214 · 5/9 clues · window 8pm"); cold-cache render from the last board state. Implemented 2026-07-17: the strict CaseFilesBoardStateV1 boundary rejects unreleased/hidden state, while @oshun/v10-rail-channel-case-files maps its latest snapshot to motionless public/player glances, a product-zone accusation countdown, state-derived text-only output, and a fully validated Rail cold-cache record. Desktop and mobile Chromium cover the real adapter through the production tile component.
  • Drip: scheduled clue/witness releases through R0.4 batching; the morning "case opens" event (victim, setting, cast) lands in the morning brief. Implemented 2026-07-17: strict kind-specific public payload schemas guard the cooked schedule; the adapter maps only releases due in a bounded exclusive/inclusive poll window to deterministic case.opened, clue.released, and witness.released events. Real R0.4 integration proves the 08:00 product-zone opening batches in morning-brief, while deep-work clues/witnesses remain held until the next break. Desktop and mobile Chromium render the real opening without exposing future drops.
  • Micro-acts: pin a suspect; mark a contradiction; take a proof-tree minimal hint (wire to the engine's hint mechanism; if the engine exposes none yet, implement it in the case engine — solve-path-derived minimal hint, not a canned string). Implemented 2026-07-17: strict explicit-state pin/contradiction writes commit through a player-scoped atomic store with one-revision updates and replay-safe execution receipts. Clew now selects one new already-released clue from the verified deduction path; the Rail persists that hint cursor and exposes only the clue-derived minimal text, never a canned prelude, solution conclusion, or unreleased evidence.
  • Live moment: accusation-window opening (scheduled class) at wind-down; the reveal delivers the provable-fairness receipt with a verify-locally affordance (signature check in the client). Implemented 2026-07-17: the adapter derives a stable rare scheduled moment and 60-minute+ preannouncement from the cooked product-zone opening, leaving daypart, loudness, ring, and budget authority in the Rail kernel. It reads sealed receipt authority only when reveal enters the poll window, then binds the case, edition, accusation, and reveal instants in a strict case.revealed delivery. The restrained Rail receipt ledger validates the envelope, selects a separately trusted SPKI key by id, reconstructs the cook's shared canonical bytes, and verifies real Ed25519 locally via Web Crypto; malformed, untrusted, unavailable, and changed receipts fail closed.
  • Faces: spectator = today's public case + community solve stats (post-reveal only); player = your board. Social compare-deductions strictly post-reveal (enforced server-side by not serving others' boards before reveal time). Implemented 2026-07-17: the player face remains a player-scoped board and private pin/contradiction counts never enter the spectator payload. The spectator does not touch social storage before reveal; after its board advances to revealed, strict case-bound aggregate counts produce the community solve glance. The server comparison gate likewise performs no friend-board read before reveal, then returns only minimal public-id projections whose participants and references are schema-validated against the revealed case.
  • Deep link: into the case at the exact board moment that prompted the dive. Implemented 2026-07-17: each live/cold-cached tile handoff binds the case, edition, face, board revision, board update instant, tile observation instant, and phase to a deterministic moment id; every case-open/clue/witness/reveal drip likewise binds its exact scheduled source event. The shared Rail resolver proves matching web and app routes/context, while the connected presence surface exposes one motionless 44 px action and suppresses destination copy in text-only discretion mode. Contract, adapter, Rail-host, component, axe, overflow, desktop Chromium, and mobile Chromium coverage are green.
• Tests: pipeline cook test (real small case end-to-end, receipt verifies); adapter unit tests (schedule → drip mapping, board → tile mapping); UI pass via Claude in Chrome with a cooked case; timezone test for the evening window. Verified 2026-07-17: the eight-test cook suite runs a deterministic real weekday case through dual proof, compile, release scheduling, signing, and receipt verification, including a tamper rejection and explicit America/New_York 20:00 accusation / 20:45 reveal round-trips. All 18 adapter tests cover bounded schedule-to-drip and player/spectator board-to-tile behavior. The browser fixture now invokes the real cook CLI with an ephemeral Ed25519 keypair, validates the cooked schedule/provenance/receipt bindings, and renders only the due opening; desktop and mobile Chromium pass with future evidence absent, no horizontal overflow, and zero axe violations. Claude-in-Chrome tooling is not exposed in this environment, so the repository-required strongest available equivalent was the automated Playwright Chromium pass in both viewports.

RA.6 Pilot channel 2 — V9 Wonder & Recall (§7.9)#

Substrate (real FSRS/SM-2/IRT per audit): libs/v9/{aletheia,atlas,chiron,theia,prometheus,lesson-gates,...}.

• Read the V9 scheduler APIs (where FSRS state lives, how reviews are requested/answered, the ≤5s first-truth SLO from the review) and write the integration note. Audited 2026-07-17: the integration note maps the real FSRS transition, due/ranking helpers, immutable lesson schedule, and distinct SM-2 gate path. FSRS traces are currently caller-owned values: there is no durable player store, runtime request/answer transport, or grounded scorer. The Rail must persist exact nextReviewAt alongside the reduced trace, filter due cards before ranking, and commit answers with revision/idempotency protection through applyRetrievalCheckpoint. The source queue defaults to 15 seconds/card (no audited 40-second behavior), while the review's ≤5s first-truth item is an unimplemented progressive wonder-answer recommendation; the Rail adopts it as a measured cached activation-to-grounded-card render budget.
• Channel adapter libs/v10/rail-channel-wonder-recall: Parent rollup verified 2026-07-18 against the current tree: every capability below is complete, the package remains registered in the production directory and Phase A registry, all 27 adapter/service tests and all 8 Phase A invariant tests pass, and standalone typecheck plus graph-aware Nx lint are green.
  • Daily Wonder in the morning brief (drip event + tile spotlight); source it from the real V9 content path — if the Daily Wonder selection job doesn't exist yet, implement it in libs/v9/* (real selection logic over the atlas/kernel content, not a hardcoded pick). Implemented 2026-07-17: V9 now owns an idempotent publish-if-absent selection job that rotates deterministically across proof-anchored Atlas/kernel concepts, retains source/kernel anchors, and binds both the Atlas snapshot and selection policy by SHA-256. The V10 adapter emits one exact wonder.published morning-brief event and restores the same immutable edition as a calm cold-cache spotlight. Contract, selector, repository/job, adapter, timeline/daypart, deep-link, component, axe, overflow, desktop Chromium, and mobile Chromium coverage are green.
  • Micro-reviews as break filler: at break dayparts, pull due cards from the real scheduler; each review is a micro-act (≤30s honored — the scheduler already wants 40-second interactions; split to two cards per act if needed to stay in budget); answers write back to FSRS state. Implemented 2026-07-17: the adapter gates on the resolved break daypart, filters exact due traces before Mnemosyne's real urgency ranking, and budgets 30 seconds as at most two 15-second cards. Only prompts from publish-gated, checkpoint-bound V9 lessons enter the request; grounded truth stays server-side. Atomic revision CAS, batch/idempotency receipts, and applyRetrievalCheckpoint persist the exact FSRS state and nextReviewAt. Contract, scheduler, host, replay, failure-atomicity, axe, overflow, desktop, and mobile coverage pass.
  • First-truth ≤5s: tile → first reviewable card render measured under 5s from cached state; make it a tested performance budget. Implemented 2026-07-17: a cache-declared review adapter measures due trace, publish-gated artifact, and immutable request reads against a strict < 5,000 ms contract; 4,999 ms passes and 5,000 ms fails closed without a prompt. The production Rail surface separately measures from tile activation through the first reviewable DOM render, keeps grounded truth hidden, and exposes an honest unavailable state on cache or budget failure. Unit, contract, axe, overflow, target-size, desktop, and mobile Chromium coverage pass.
  • Kernel drops as drip events; fading-stars as the gentle tile state (due-decay visual, explicitly NOT a punishment mechanic — absence never loses anything, cards just wait). Implemented 2026-07-17: each resolvable Daily Wonder kernel reference is recomputed through Aletheia's real Nyx/Kalika evaluator and emitted as a contract-valid, non-interrupting wonder.kernel-drop with exact value, unit, provenance hashes, and contextual handoff. The player tile projects real FSRS retrievability into silent star opacity while keeping persisted nextReviewAt authoritative; reads never mutate or remove traces and the copy states that cards wait safely. Contract, cold-cache, timeline, no-punishment, axe, overflow, desktop, and mobile coverage pass.
  • Weekly Wonder Report as a wind-down scheduled moment. Implemented 2026-07-17: the adapter builds a deterministic private report from the complete, exact seven-day range of committed FSRS answer receipts, rejects cross-learner, duplicate, out-of-period, and malformed evidence, and emits only calm aggregate counts. A stable, rare Rail live-moment request declares wind-down affinity, preserves a 60-minute preannouncement, and elevates through the real arbitrator in the resolved wind-down daypart. Empty weeks report no recorded reviews without streak, penalty, missed-day, or loss language. Contract, idempotence, hostile-source, scheduling, timeline, axe, overflow, desktop, and mobile coverage pass.
  • Faces: spectator = today's Wonder + a public explore taste; player = your due cards/stars. Implemented 2026-07-17: the communal Daily Wonder spectator face derives a compact public taste only from the edition's proof anchors, recomputing supported Aletheia kernels and otherwise exposing an honest grounding-pin or declared-kernel path without inventing a result. Its payload and exact deep-link context contain no learner review state. The player face remains the separate private due-card projection with calm FSRS retrievability stars. Contract, fallback, cold-cache, text-only, axe, overflow, desktop, and mobile coverage pass.
• Fold V1's Nisaba/Metis rooms into this channel rather than duplicating (§7.1): locate the room implementations (libs/oshun/domain-metis, domain-nisaba, mobile room content wiring) and route their Rail-facing presence through this one channel; document what was folded where. Implemented 2026-07-17: the private player projection now reads the compatible V1 Metis and Nisaba shell adapter contracts with one learner identity, validates their canonical app/web launch pairs, and folds at most one latest real return per room into v9.wonder-recall. Source failures, future state, incompatible contracts, alternate origins, and path lookalikes fail closed without fixtures or invented progress. The full schoolroom, reading desk, mobile study workspaces, writes, and offline behavior remain V1-owned deep-link destinations; no duplicate v1.metis or v1.nisaba Rail channel exists. The audited source and ownership map is recorded in V10/RA6_V1_NISABA_METIS_FOLDING.md. Contract, canonical adapter, cold-cache, text-only, axe, overflow, desktop, and mobile coverage pass.
• Tests: scheduler round-trip (answer updates real FSRS state and the next due time changes accordingly — assert against known FSRS outputs); break-daypart gating; 5s budget test; UI pass via Claude in Chrome. Verified 2026-07-17: a real host-executed good answer advances the pinned New-card state to FSRS difficulty 7.2102, stability 3.1262, revision 1, and exact next due time 2026-07-24T14:35:05.000Z; the test directly proves that this differs from the persisted pre-answer due instant and removes the card from the current due query. The real daypart engine admits the 14:35 break and refuses the 14:50 deep-work window without creating a request. Cached trace, gated-artifact, and request reads pass at 4,999 ms while 5,000 ms fails closed. The requested Claude-in-Chrome connector is not available in this execution environment, so the repository's Playwright harness drove actual desktop and mobile Chromium instead; both due-review and first-truth flows pass target-size, hidden-truth, exact-next-due, overflow, and axe checks.

RA.7 Pilot channel 3 — V3 Motion (audio; §7.3)#

Substrate: V3 music stack (libs/v3/*, libs/lilith/* — locate the adaptive work-music components at task start and record paths in the integration note).

• Read the V3 music/motion stack and write the integration note: what can actually produce/select adaptive work-music today (engine, catalog, generation, or playlist logic), and what movement-break content exists. Choose the real path; if only building blocks exist, compose them into a real adaptive selector (energy/daypart-aware), not a shuffled playlist labeled "adaptive". Audited 2026-07-17 in V10/RA7_V3_MOTION_CHANNEL_INTEGRATION.md: V3/Lilith have governed generation, durable catalog/scoring seams, playback-sync primitives, and real cue/count/asana content, but no playable adaptive work program or short break timelines. The chosen fail-closed path is a deterministic daypart + listener-energy selector over injected, rights-cleared playable rows; seed URLs, sample playlists, generated class inventory, and the still-proposed Mat Mode are explicitly excluded.
• GATED: V3 must ship a canonical Mat Mode product launch target Channel adapter libs/v10/rail-channel-motion: All currently actionable adapter capabilities and verification are complete. Manifest publication remains intentionally unavailable because the shared contract requires a contextual deep link and V3 has not published the canonical Mat Mode launch target. The adapter now exposes the strict port that will unblock publication without accepting a generic substitute. Re-audited 2026-07-18: Quest 3 and Vision Pro profiles enable their underlying passthrough capabilities, but V3's product review still records Mat Mode as a gap and the tree contains no Mat Mode route, launch contract, resolver, or shippable product mode. A fabricated deep link would not satisfy this gate. 2026-09-18, board tag: waits on V3 publishing a canonical Mat Mode launch target. No item in V3/V3_TODOS.md carries that (the registry lists V3 as closed); add one there when V3 reopens and cite it here. blocked:upstream
  • Audio-lane holder: continuous work-music sessions with daypart-adaptive program (morning/deep-work/break energy targets); transport via the lane API only. Implemented 2026-07-17 in @oshun/v10-rail-channel-motion: strict catalog parsing requires rights-cleared delivery plus current playback verification; a deterministic daypart, listener-energy, mood, BPM, continuity, and recency score composes the exact requested horizon with no shuffle or fallback. The service prepares that program and can only offer it through its channel-bound AudioLaneChannelPort; it cannot accept its own offer or control the holder. Focused verification passes 14 Motion tests and the kernel's 9 audio-lane arbitration tests.
  • Micro-acts: stretch break, posture reset, 90-second dance break — each a real guided act (timed steps + the audio bed), with completion quality reporting. Implemented 2026-07-17 as three immutable, source-traced timelines with contiguous step offsets, safety exits, and low-impact modifications. Stretch and posture each occupy one 30-second Rail phase; the exact 90-second dance timeline composes three contiguous 30-second phases, preserving the kernel's hard micro-act budget instead of weakening it. Each act requests an exact break-energy program through the lane-only audio service. Completion reports validate wall-clock elapsed time against the registered act; partition completed, skipped, and unreached steps; distinguish early exits; require real matching holder observations before claiming an audio bed; and explicitly record sensor assessment as unobserved. The focused Motion suite passes 24 tests.
  • Live moments: class schedules (if V3 has real class/schedule data; otherwise the manifest omits live moments until it does — no fake schedule). Implemented as the frozen, empty MOTION_LIVE_MOMENT_SPECS declaration. The boundary exposes no schedule injection seam that could admit the audited GA inventory, and unit coverage proves the omission remains empty and immutable until V3 owns a real runtime reader.
  • Tile: now-playing + today's movement minutes (from completed micro-acts); text-only degradation. Implemented 2026-07-17 with a strict 60-second lane observation and a bounded 500-report completion read. The renderer counts only completed, registered guided-act step durations on the user's explicit IANA-local day; stale, future, malformed, duplicate, oversized, or throwing evidence stays unavailable instead of becoming a false zero. The real payload leads with playback truth, then movement minutes, and preserves both in its exact text-only summary. Focused verification passes all 30 Motion tests and the V10 web's 99 unit tests; desktop and mobile Chromium additionally pass the standard/text-only hierarchy, overflow, Axe, motion-off, no-media, and no-fabricated-live-or-deep-link checks.
  • Deep link: passthrough Mat Mode as the immersion end of the funnel. Implemented as a strict canonical-launch port: only the versioned mat-mode capability envelope with a contract-valid contextual V3 link is accepted, and that link is cloned without rewriting its route or context. Missing, throwing, malformed, generic, product-root, and non-V3 evidence all resolve to no link; the package invents no fallback.
• Tests: adaptive selection is input-sensitive (different daypart/energy → different program, asserted on real selector outputs); lane handoff correctness; micro-act timing; UI/audio pass via Claude in Chrome. Verified 2026-07-17: all 34 Motion tests cover input-sensitive adaptive programs, deterministic catalog scoring, fail-closed eligibility, lane-only offers and handoffs, exact guided timelines and reports, current/local-day tile truth, immutable live omission, and strict Mat passthrough. The kernel's 9 audio-arbitration tests and the V10 web's 99 unit tests also pass. Claude-in-Chrome is not exposed in this environment, so the repository's Playwright harness exercised the real Motion payload in desktop and mobile Chromium instead; all four standard/text-only cases pass Axe, overflow, hierarchy, motion-off, no-media, and no-fabricated-live or deep-link assertions.

RA.8 Pilot channel 4 — V3 Stage (video; legacy Saraswati tenant; §7.3)#

Substrate: libs/v3/saraswati-stage, Calliope stage/performance libs (libs/calliope/*); consolidation audit found Calliope's stage spec substantially complete and uncited by V3.

• Resolve the two flagged bookkeeping items first (they gate honest naming/citation):
  • Citation: read libs/v3/saraswati-stage and the Calliope stage spec; record the relationship (what V3 uses, what it should cite) and fix the citation in the relevant docs/specs. Resolved 2026-07-17 in RA8_V3_STAGE_CHANNEL_INTEGRATION.md: V3 owns the tenant persistence, rights/provenance, recorded-evidence authoring gates, quality gates, and Unreal binding contract; Calliope's 30-service, cross-validated Stage model is the normative concept/setlist/venue/camera/streaming/VOD-plan specification but is not a current V3 runtime dependency. The V3 descriptor and feature/architecture/review docs now cite @calliope/stage explicitly. Neither stack is mislabeled as a renderer: no playable concert VOD or delivery URI exists yet.
  • Naming collision: saraswati (V3 stage) vs libs/saraswati (the other domain — inspect it to confirm what it is). Propose and apply the rename/disambiguation with the smallest blast radius (likely: the channel id becomes v3.stage or similar while brand naming is listed as HG-7); update the source doc's §12.9 note with the resolution. Resolved 2026-07-17: the Rail channel and cross-product technical name are V3 Stage, id v3.stage, and the adapter home is libs/v10/rail-channel-stage. Existing V3 package, Prisma, contract, and Unreal Saraswati identifiers stay in place; the separate @saraswati/* namespace remains the industrial-technology domain for manufacturing, energy, mobility, robotics, IoT, telecom, and health hardware. The source doc's §12.9 risk now records the resolution; final public branding remains HG-7.
• Channel adapter libs/v10/rail-channel-stage:
  • Video-lane programming: a scheduled program of stage performances/music videos/concerts from real rendered assets produced by the V3/Calliope stage pipeline. Build the programming loop (playlist compiler over available performances with daypart-aware pacing) and a cook job that renders/refreshes program items via the real stage pipeline. Human gate HG-2 covers licensed third-party content; first-party/generated performances are agent-actionable and are the Phase A content. Implemented 2026-07-17 in libs/v10/rail-channel-stage: the bounded, stable-id compiler rejects malformed/duplicate rows, ineligible rights, declared drills, failed V3 export evidence, future/stale playback checks, and items that cannot fit the horizon; explicit daypart energy/set-section/camera/cut-density profiles drive scoring, while follows/favorites affect only the player face. The cook job composes injected V3 release, render, immutable-store, delivery-verifier, and catalog-writer ports; it hashes actual returned video/audio/artwork bytes and publishes only when every receipt observes the exact size and SHA-256. It contains no seed catalog or media URL fallback. Package typecheck and 19 focused tests pass.
  • Playback: VOD/progressive playback in the video lane (no live substrate dependency in Phase A); concerts as scheduled live moments once RB.4 gives a live path — until then concerts are premiere-style scheduled VOD events, labeled as premieres (honest, not fake-live). Implemented 2026-07-17: first-party-vod is a distinct admitted video class while genuine first-party-live remains gated. The Stage publisher reads the bounded verified catalog, compiles it, and submits the exact progressive video/audio pair through an offer-only coupled lane; it cannot self-acquire, invent delivery, or accept a forged receipt. The kernel rolls back partial offers, rejects desynchronized halves, and commits or releases both lanes at one prevalidated Rail instant, yielding one effective audio holder. Concert slots create preannounced scheduled V3 Stage premiere moments whose title, glance copy, and payload all say premiere. All 28 Stage tests, 136 kernel tests, contract tests, and focused typechecks pass.
  • Tile: now-playing artwork/title + up-next; audio pairs with the audio lane (video as optional garnish on music — the lane coupling where video holder may feed the audio lane as one holder, not two). Implemented 2026-07-17: the strict Stage renderer resolves one current item from a continuous compiled schedule and projects its delivery-verified artwork, title, artist, and up-next item. The shared PresenceTile renders one silent artwork-led setlist with no tile motion or media, while the web video panel mounts the selected exact progressive URI paused and muted behind explicit Play/Pause and Mute controls. The already-delivered coupled arbiter keeps the matching video/audio identity to one effective audio holder.
  • Faces: spectator = the program; player = follows/favorites shaping the program. Implemented 2026-07-17: the manifest publishes separate calm faces. Spectator compilation ignores and its published schema rejects preference signals; player compilation may order by favorite or followed artist and exposes only that bounded signal. Both faces have exact state-derived text-only degradation and contextual V3 Stage links.
• Tests: programming loop determinism given a catalog fixture of real rendered items; lane coupling (one effective audio holder); UI playback pass via Claude in Chrome. Verified 2026-07-17: all 34 Stage tests cover deterministic programming, render/store/playback evidence, strict schedule and face validation, coupled publishing, truthful premieres, manifests, and tile projection. Coupled-kernel tests prove synchronized transactions and one effective audio holder. Claude-in-Chrome is unavailable in this environment, so the repository's Playwright equivalent ran both real Stage face projections, text-only degradation, and a native progressive player against actual encoded test-only WebM bytes in desktop and mobile Chromium; all eight focused scenarios passed Axe, overflow, hierarchy, exact-source, paused-start, user-only play, mute, and no-autoplay assertions. The WebM is browser-test evidence, not a production V3 catalog artifact.

RA.9 Rail invariant test suite + Phase A hardening#

• Cross-channel invariant suite (runs against all registered channels, pilots + test-channel):
  • No absence punishment anywhere (manifest + runtime probes).
  • No autoplay motion/sound at effective loudness ≤2 (drive the UI and assert).
  • Elevation budgets enforced per channel per day; unspent don't accumulate.
  • Metric exports equal the allowed calm set exactly.
  • Per-surface availability matrix honored (adult ring absent from non-web/desktop payloads — testable now even with no adult channel registered, via a fixture manifest). Implemented and verified 2026-07-17: libs/v10/rail-phase-a is the explicit invariant registry for the contract-ready Case Files, Wonder & Recall, and Stage pilots plus the deterministic clock test channel; Motion remains truthfully deferred until V3 supplies its canonical Mat Mode deep link. The registry suite registers every manifest through the real host, probes hostile manifest/drip/tile/micro-act runtime values, spends every rate class independently for every channel across rollover, locks the four calm metric exports, and checks every surface against both declared matrices and an adult fixture. Hardening found and closed two runtime gaps: the host now applies absence policy to drips, tiles, caches, and micro-act values and rejects undeclared drip types; recommendations now filter by the requested surface. Desktop/mobile Playwright drives all four channels at effective loudness 0–2 and the encoded progressive Stage player, asserting zero autoplay elements or play() calls, no autonomous entry motion, muted/paused media, no overflow, and no Axe violations. All 139 kernel tests, 7 registry invariants, 104 web tests, 12 focused Playwright scenarios, targeted lint, and all three typechecks pass.
• Adversarial pass per CLAUDE.md over every rail-* library and both apps (mandatory grep + silent-stub scan + delegation-chain read) before declaring Phase A code-complete. Completed and verified 2026-07-17: every production file, public entry point, delegated private helper, and test contract in the six rail-* libraries plus the web and Tauri apps was read in confirmatory and adversarial passes (performed inline because the active execution policy prohibited spawning review subagents). The review shipped the three contract-ready pilots in the real app directory and closed fail-open edges in manifest faces, scheduled elevation timing and local-day budgets, coupled audio/video chronology, tile-cache chronology, BFF authority parsing, third-party player providers, StrictMode settlement, recoverable Wonder activation, and out-of-order user-state writes. The exact mandatory grep has zero actionable hits (the five matches explicitly promise that unsupported browser capabilities are not simulated); the full and staged silent-stub scans have zero hits; the empty-body scan resolves only to parameter-property constructors, default-object parameters, and a third-party SDK test double. All 275 library tests (kernel 155, Case Files 18, Motion 34, Stage 34, Wonder 27, Phase A 7), 119 web tests, 34 Rust tests, seven TypeScript typechecks, web lint, Cargo fmt/check/Clippy, the Linux Xvfb launch/state-persistence probe, 44 comprehensive desktop/mobile Playwright cases, and the final eight-case connected-state Playwright rerun pass.
• Dogfood instrumentation for the exit test: local docked-hours readout + a rail dogfood-report command summarizing the week (hours docked, micro-acts, elevations). The exit test itself — the author leaves it docked for a week — is (HUMAN GATE HG-1). Implemented and verified 2026-07-17: the kernel now owns a strict 35-day local journal, visible-only docked sessions with stale-crash recovery and multi-tab ownership, the exact calm metric event union, and overlap-failing rolling seven-day reports by face/channel. The web surface records locally, mirrors only metrics already accepted by the authoritative aggregator, shows a compact hours / 7d footer readout, exports the journal, and queues the same private snapshot to the Tauri app-data store. The native command enforces the schema, a 2 MiB bound, and private atomic persistence. pnpm rail dogfood-report reads that file or an explicit export and emits human or JSON hours, micro-act outcomes, and elevation decisions for a chosen IANA week boundary. Kernel (147), web (108), CLI (5), contract (2), native (34), and Wonder regression (27) tests pass with targeted typechecks, lint, Cargo fmt/check/clippy, desktop/mobile Playwright for the full recorder/export flow, and six desktop/mobile real micro-act outcome regressions. The one-week author observation remains solely HG-1.

Phase RB — the flagship and the voice (P1, §11 Phase B)#

RB.1 Veritas Live — overlay/second-screen mode first (§7.1, D4)#

Substrate: Veritas trust stack (libs/veritas/*, libs/oshun/domain-veritas), 9-factor source scoring, @oshun/content-signing for receipts.

• Read the Veritas claim-extraction/verification pipeline as it exists and write the integration note: what can extract claims from a live transcript today, what the 9-factor scoring consumes, latency characteristics. Audited 2026-07-17 in RB1_VERITAS_LIVE_INTEGRATION.md: the rich in-process extractor, the separate NLP HTTP service, the fact-checking agent, and the unimplemented live STT interface are mapped without treating any of them as an incremental transcript pipeline. The note records every nine-factor input and override, proves the composite is not wired into current verdict or claim-confidence paths, and derives the bounded caption-window / asynchronous verification adapter with honest timeout gaps. Domain Veritas (331), NLP, fact-checking, and fact-checking agent tests pass; the claim extractor and its dependencies compile.
• Overlay mode (rights-light — ships first per risk 2):
  • Live claim ticker as the video-lane overlay slot's first consumer (RA.4): given a transcript stream of an external video (start with real captions/transcript sources where available — e.g. user-provided stream captions — and a local speech-to-text seam that is fail-loud when no engine is configured), extract claims, score/verify against the Veritas pipeline, render verdict + confidence + source receipts in the ticker as they resolve. Implemented and verified 2026-07-17: the browser-safe rail-channel-veritas-live adapter consumes ordered final captions or a configured local-STT seam, bounds and deduplicates transcript windows, preserves claim locators, and exposes detected → checking → terminal state with fail-loud missing engines and verifier timeouts. Verification now sends canonical, reviewer-attested sources through the real nine-factor composite and Veritas fact scorer, then returns linkable stance, citation, factor, rationale, confidence, and verdict receipts. The restrained lower-third VeritasLiveClaimTickerCue is bound as v1.veritas-live, with a production-style caption/evidence harness and desktop/mobile accessibility coverage. Adapter (22), fact-checking (7), claims (1), Domain Veritas (331), and web (121) tests, targeted lint/typechecks/builds, and the complete V10 Playwright suite (124 passed, 2 intentionally skipped) pass.
  • Trust meter: rolling verified/unverified/contradicted tally for the session, C2PA/provenance receipts linkable per claim (@oshun/content-signing — the one canonical signer). Implemented and verified 2026-07-17: every session snapshot now derives one exhaustive meter whose pending, verified, unverified, and contradicted buckets reconcile to the claim total; disputed and unavailable checks remain conservatively unverified. Every terminal verdict requires a linkable, C2PA-aligned Ed25519 provenance envelope binding the exact claim, transcript locator, verdict, source-quality assertions, and timestamps. Service-side issuance delegates exclusively to the canonical @oshun/content-signing signer, while the Rail verifies canonical claim bytes locally against a separately supplied trusted-key registry and fails closed on tampering, unknown keys, invalid envelopes, or unavailable crypto. The quiet lower-third meter and per-claim receipt link are covered through the production-style harness on desktop and mobile. Content signing (6), adapter (22), and web (121) tests, affected lint/typechecks, the signer build, targeted trust-meter Playwright (4), and the full V10 matrix (124 passed, 2 intentionally skipped) pass.
  • Sync controls: manual offset + pause-tolerant re-sync (RA.4's clock model). Implemented and verified 2026-07-17: the RA.4 companion clock accepts an explicit external time and playback state, exposes bounded one-second correction steps and offset reset, and preserves paused anchors across re-sync. Successful user pause/resume actions now mirror their applied state into the next re-sync selection, preventing a stale pre-toggle value from accidentally resuming a paused clock; rejected actions leave the form unchanged. The generic overlay and production- style Veritas flows prove exact clock/offset behavior, paused re-sync, and cue progression on desktop and mobile. Rail kernel (155) and web (121) tests, web lint/typecheck, targeted Playwright (8), and the full V10 matrix (124 passed, 2 intentionally skipped) pass.
• Channel adapter libs/v10/rail-channel-veritas-live: Parent rollup verified 2026-07-18 against the current tree: the tile/briefing, followed claim delivery/live moments, and separate spectator/player faces below remain complete; all 84 channel and integration tests, the two-test production-directory registration check, standalone typecheck, and graph-aware Nx lint pass.
  • Tile: current event being tracked + trust meter state; morning audio Veritas briefing slots into the Thread daypart via the audio lane (the V1-review §5.8 briefing — generate from the real Veritas daily pipeline). Evidence (2026-07-17): the production directory now registers the public v1.veritas-live spectator face. Its cold-cache/text-only tile projects the current source event, uses an exact event deep link, and re-derives the four-bucket trust meter from the published claims. Terminal claim state is accepted only with a provenance receipt bound to the session, exact claim/transcript locator, verdict, sources, and timestamps; unavailable and pending states also fail closed on contradictory payloads. The cardless mono evidence strip is silent, motionless, responsive, and axe-clean. The morning service reads one through six grounded stories from a host-bound published-daily-edition port, invokes Domain Veritas's real narration composer/synthesizer with confidence, source, correction/retraction, and synthetic-voice disclosure truth, rejects both estimated and synthesized audio beyond 180 seconds, validates delivered media, and can only create a channel-bound offer. The existing Thread daypart policy acquires that offer paused; the channel cannot accept or play it. The Node-authority service is isolated behind the /morning-briefing export so the tile's browser root stays portable. Channel tests (31), Domain Veritas tests (331), Rail kernel tests (155), web tests (122), channel/web lint and typecheck, focused desktop/mobile Playwright (6), Veritas browser- boundary Playwright (4), and the full V10 matrix (128 passed, 2 intentionally skipped) pass.
  • Drip: claim-verified events for followed topics; breaking events as emergent live-moment requests (rate-limited class). Implemented 2026-07-18: a strict delivery adapter consumes the canonical Veritas publication feed, canonical follow-recipient profile, and host trust verifier; it emits receipt-bound claim.verified drips only for exact active followed topics while honoring tenant, in-app, mute, cadence, and priority-only controls. Positively verified breaking publications derive stable rare emergent requests without granting themselves elevation; the real Rail arbitrator enforces daypart, loudness, ring policy, and the one-per-day channel budget. Malformed, duplicate, cross-tenant, untrusted, unreconciled, and hostile inputs fail closed. Channel tests (36), Domain Veritas tests (331), Rail kernel tests (155), contracts tests (18), web tests (122), channel/web lint and typecheck, focused desktop/mobile Playwright (2), and the full V10 Playwright matrix (130 passed, 2 intentionally skipped) pass.
  • Faces: spectator IS the product here (front-door audience); player face = your followed topics/sources. Implemented 2026-07-18: the spectator remains the public current-event front door and never reads private follow state. The separate player face requests one canonical read-only snapshot through an explicit authenticated user/tenant binding, then rejects missing, cross-audience, future, duplicate, oversized, malformed, or schema-expanded topic/source records. Its cold-cache and text-only projections expose exact derived totals with bounded labels; empty state stays honest, and user/tenant identities never enter the cached payload or contextual link. Conversely, public event, claim, session, and trust state never enter the player payload. Both faces are cardless, silent, motionless, responsive, and axe-clean. Channel tests (43), V10 contract tests (18), Rail kernel tests (155), web tests (124), focused desktop/mobile face Playwright (8), expanded Phase A invariant Playwright (12), and the full V10 Playwright matrix (134 passed, 2 intentionally skipped) pass.
• First-party produced coverage: rights and operations are human gate HG-3, tracked once in §HG below (this line was a second box for it until 2026-09-18).
  • Agent-actionable production-side pipeline skeleton: program schedule, studio overlay graphics package, and ingest via the RB.3 substrate seam, built against a test stream and clearly gated so it cannot be mistaken for a rights answer. Implemented 2026-07-18: a strict, immutable rehearsal compiler accepts only contiguous bounded schedules whose segments all reference one declared synthetic MPEG-TS stream; callers cannot supply or elevate rights, operations, environment, or publication state. A streamed ingest adapter binds the exact Veritas tenant, channel, program, request time, byte count, and SHA-256 to the future shared-media port, rejects partial consumption or mutated/cross-bound receipts, and accepts only credential-free HLS + DASH manifests on test hosts. The derived 16:9 studio graphics package uses fixed safe areas, a restrained no-crawl visual system, bound accessible copy, and a permanent TEST SIGNAL · NOT FOR AIR mark. The rehearsal has no publish/go-live method, returns HG-3 as required, and surfaces the existing live kernel's not_configured media gate; the parent remains open solely for the human rights/ops proposal and real RB.3 media extraction. Focused contract and pipeline tests (38 of 81 channel tests), Rail kernel tests (155), web tests (130), channel/web lint and typechecks, desktop/mobile axe and reduced-motion Playwright (4), visual inspection at 1440 × 900 and 393 × 851, and the full V10 Playwright matrix (138 passed, 2 intentionally skipped) pass.
• Tests: claim extraction → ticker latency budget; scoring integration asserts real 9-factor outputs on fixture transcripts with known-correct verdicts; receipt signature verification; UI pass. Done 2026-07-18: VeritasLiveClaimSession now records final-caption → synchronous ticker-publication observations against an explicit 250 ms budget, including bound overlay listeners. A production-path integration fixture drives real heuristic extraction, the governed scorer, exact nine-factor vectors and versions, known supporting/contradicting verdicts, RA.4 cue publication, and real Ed25519 verification plus tamper rejection. The web ticker now fails closed while a receipt is checking or invalid: terminal copy, confidence, trust credit, and source assertions remain withheld while the receipt diagnostic stays inspectable. Unit and desktop/mobile Playwright coverage exercise verified, contradicted, unverified, and tampered states, the latency budget, axe, reduced-motion, no-media, and overflow invariants. Channel tests (84), web tests (131), channel/web lint and typechecks, focused Playwright (6), visual inspection at 1440 × 900 and Pixel 5, the full matrix (134 passed, 2 intentionally skipped), and its renderer-heavy Phase A retry at one worker (12 passed) pass.

RB.2 Ori Presence believability beta (§7.6, behind a flag)#

Substrate: V6 consent architecture + Ori continuity (libs/v6/{ori-model,moirai-kernel,cognition-stack,...}), V6 consent/grief architecture as governance.

• Read the V6 Ori/consent stack and write the integration note: what the ori-model can actually do today, where LLM wiring stands (the review flagged it unproven), what the consent grammar looks like. Done 2026-07-18: RB2_ORI_PRESENCE_INTEGRATION.md audits the TypeScript and Rust continuity/runtime boundaries, proves the real governed gateway exists but has no non-test V6 host/provider composition, distinguishes user grants from Aye agent consent and Ori memory autonomy, and fixes the exact default-deny Rail awareness grammar plus input-firewall, remembrance, storage, grounding, and test boundaries. Verification: Prettier/link/diff checks, 46 Vitest files/591 tests, 8 focused canonical consent tests, and 28 Rust service tests all pass.
• Narrator/concierge behind a feature flag (default OFF; the Rail must be whole without it — enforced by RA.9 suite running with the flag off):
  • Cross-channel recap generation: consume the user's timeline (post-batching) and produce the "while you were away" recap ("your ghost won both bouts; the third witness contradicts the first — want the 40-second recap?") via the real LLM path with the V6 model; adult-ring events are structurally absent from its input (R0.6 wall).
  • Consent-gated daypart awareness: Ori sees dayparts/presence only per V6 consent grants; every awareness scope is a recorded consent.
  • Thread greeting: a morning one-liner woven into the morning brief.
  • Voice: brief audio-lane ducking overlays (RA.3 model), never a holder grab; TTS through the repo's real voice path (locate it; fail-loud if unconfigured).
  • Remembrance/ritual moments on meaningful dates via V6's grief/ritual architecture, gentle scheduled moments only.
• Cost ceiling (risk 6): hard per-user-day inference budget with degrade-to-silent behavior + cost telemetry; believability beta gate = flag + cohort config, documented.
• Tests: recap correctness on fixture timelines (asserts real content coverage, not truthiness); consent gating (no grant → no awareness, and the prompt assembly provably excludes ungranted scopes); budget exhaustion degrades silently; flag-off leaves zero Ori surface. Implemented and verified 2026-07-18: the new private v6.ori-presence channel is absent from the default Phase A directory and remains silent unless the default-off flag, exact V1 user cohort, subscription, discretion/crisis, and durable exact-scope consent gates all agree. The BFF composes the real assistant provider through Iris AgentRunManager and the Moirai gateway; the bounded Clio writer/verifier output must then pass Clio source membership and entailment, Sophia grounding, Isis behavior policy, and the Iris quality gate. The server-side firewall accepts only post-batch, subscribed, non-adult channel summaries and omits ungranted daypart, coarse-presence, and continuity bytes before either provider prompt. Read-only recap and Thread generation never write Ori or Iris memory. Morning Thread, explicit-press ElevenLabs voice ducking, and user-selected memorial dates remain independently consented; crisis and screen-share frames suppress them before generation/playback. PostgreSQL stores the append-only fingerprinted consent chain, narration cache, meaningful dates, daily usage, and inference reservations; failed or crash-uncertain dispatches conservatively charge their full reservation. Privacy-admin revocation remains available while the beta is off, account deletion erases every Ori table, and the staged rollout/telemetry/rollback contract is documented in RB2_ORI_PRESENCE_BETA_RUNBOOK.md. Direct contract tests (5), channel tests (10), BFF consent/store/adapter/runtime/route/deletion tests (45), a real PostgreSQL migration-and-restart integration test (1), Phase A invariants (8), Iris agents-core (208), Moirai (15), Sophia (5), Isis (7), Clio (14), assistant provider (9), voice synthesis (59), web tests (149), and desktop/mobile Playwright (12) pass. Affected lint, contract/channel/governance/persistence/web typechecks, Prisma validation, environment ownership/split checks, BFF production bundling, V10 web production build, and git diff --check also pass. The monolithic BFF typecheck was additionally attempted with an 8 GiB heap and remains blocked by the repository's broad pre-existing errors in unrelated Arete/Yemaya/Iris surfaces; focused RB.2 diagnostics report no Ori errors and the production bundle is green.

RB.3 Streaming substrate extraction from Aphrodite (§7.10a, §10)#

Substrate: apps/aphrodite/{streaming,broadcaster,viewer,chat,cdn,notifications,payment,...} (17 services), plus libs/aphrodite/* streaming-adjacent libs.

• Audit pass over the 17 services: for each, record (in a substrate extraction doc next to this file or in docs/) its role, its tenant-specific vs generic parts, and its reuse verdict for the video lane. Sequential read, one service at a time — no agent fan-out beyond one. Evidence: RB3_APHRODITE_STREAMING_SUBSTRATE_AUDIT.md records all 17 deployables in sequential order, a source-level map of 36 directly adjacent Aphrodite libraries, existing shared/Neith stack boundaries, the libs/shared/live-media canonical-home decision, and the incremental tenant-equivalence order. The audit explicitly leaves extraction and all implementation/E2E checkboxes open.
• Extract the generic streaming substrate (the consolidation move — built ONCE):
  • libs/shared/streaming (or repo-conventional home — decide from the audit): ingest, transcode/delivery orchestration, viewer session, live chat, presence/viewer-count, notifications hooks — as tenant-parameterized services with Aphrodite as tenant #1 (its services become thin tenant configs over the substrate, NOT a fork). Completed in the audit-selected repo-conventional home libs/shared/live-media. The canonical package owns each listed organ; Aphrodite's production services retain product policy as tenant-fixed SQL/provider adapters rather than a fork. Detailed organ-by-organ evidence and release gates are recorded in RB3_APHRODITE_STREAMING_SUBSTRATE_AUDIT.md.
  • Migration is incremental and behind equivalence tests: each extracted organ gets a test proving Aphrodite's behavior is unchanged (contract tests against the pre-extraction service behavior). Completed through increments 1–8ak. Existing Aphrodite route/store suites remained the behavior oracle throughout extraction; shared contract/unit, forced-RLS integration, real provider/media, and final four-product equivalence suites now cover the migrated organs. The final 2026-07-22 release run passed 333 shared and 199 Aphrodite-adapter tests plus the product and supervised local ingest-to-Rail gates recorded below.
  • Veritas (RB.1 first-party seam) and V3 Stage (concert live moments) become tenants #2/#3; RA.4's first-party-live class flips from not_configured to real HLS/DASH playback against this substrate, exercised end-to-end with a test stream on this box (mind memory — one service set at a time, teardown after). Progress through increment 6 plus increments 7b–7m's real content-analysis, recording, AES-128 HLS segment-encryption, visible-watermark, browser-HLS/DASH player, browser-WHIP publisher, native HLS/DASH player, and native-SRT publisher providers (including the increment 7a extension-contract foundation), verified 2026-07-19: the canonical @oshun/live-media organ now owns tenant/resource contracts, durable publisher grants and edge reconciliation, real Neith/FFmpeg transcode execution, immutable HLS/DASH publication, durable leased/fenced pipeline jobs, signed playback grants, entitlement-bounded leased viewer sessions, exact multi-node presence, immutable QoE/lifecycle ledgers, and exact-object origin authorization bound to an active viewer lease. It now also owns tenant/resource live-chat memberships, leased presence, durable bounded history, idempotency/rate limits, ordered events, room clears, and server-only tip/system publication. Aphrodite's streaming, viewer, and chat apps are thin production compositions over forced-RLS PostgreSQL adapters and fail closed when configuration, identity, entitlement, media, session, or moderation state is absent. The shared organ now also owns a strict tenant/resource operational-event and metric envelope, resource-exact telemetry authorization, an idempotent durable event ledger, and leased notification/moderation/audit hook delivery with explicit retry, provider-error, lost-lease, and dead-letter outcomes. Migration 00012 adds a forced-RLS warehouse and atomic hook outbox before production composition; Aphrodite supplies only tenant-fixed SQL storage plus thin notification/moderation mappings. Publisher, viewer, QoE, chat, and moderation production paths emit bounded metadata without copying chat bodies; refresh and duplicate paths replay stable semantic identities without inflating counts, and durable Chat polling reprojects committed events after restart. The unauthenticated tenantless legacy analytics taxonomy remains product-owned. Supervised digest-pinned MediaMTX/PostgreSQL gates apply migrations 00005–00012, exercise restart/recovery, concurrent claim/fencing, SQL tenant isolation, duplicate joins, two-store presence/fanout, QoE, expiry, reconnect, revocation, policy/moderation denial, advisory-lock contention, and invalid-tip rejection; prove exactly-once concurrent hook claiming, retry/dead-letter persistence, content non-disclosure, and cross-tenant telemetry denial; decode protected HLS and DASH; prove immediate session/publication revocation; and tear down cleanly. The parent item remains open: the remaining optional media/client adapters, Veritas/V3/Rail tenants, the consolidation guard, equivalence suite, and final ingest-to-Rail flow remain actionable. The shared contract now also names immersive, encryption, DRM, watermark, analysis, recording, publisher/player, guest, and composition adapters while requiring exact active authority, dependency-complete readiness, measured kind-specific conformance, and teardown before success. No simulated Aphrodite package is registered. The real aphrodite.content-analysis.v1 provider now binds one exact ready publication object, performs checksum-bounded reads and real FFmpeg sampling, invokes the audited OpenAI-compatible analyzer with automatic action disabled, and persists privacy-bounded immutable evidence in migration 00013's forced-RLS, database-clock, heartbeat-renewed operation ledger. The supervised MediaMTX/PostgreSQL gate proves real-segment analysis, restart replay without reexecution, concurrent claim and stale-writer fencing, cross-tenant denial, and teardown. The real aphrodite.recording.v1 provider binds a fresh exact publisher connection across durable and live MediaMTX state, performs cancellation-aware bounded FFmpeg stream-copy capture, FFprobes and hashes the container, and persists it through the shared streaming-safe create-only object store. Migration 00014 adds its forced-RLS, database-clock queue with semantic idempotency, renewable fenced leases, backoff, staged object recovery, and exact terminal evidence. The same supervised gate captures and independently probes real H.264/AAC MP4 bytes, reconstructs the provider for no-recapture replay, recovers an expired lease, fences the stale worker, denies another tenant, and tears down. The real aphrodite.segment-encryption.v1 provider accepts only one exact ready HLS VOD publication, validates its complete authoritative MPEG-TS graph, encrypts every segment with AES-128-CBC and media-sequence IVs, and publishes create-only manifests plus a key-free measured descriptor. Migration 00015 adds its forced-RLS, publication-bound, database-clock queue with semantic idempotency, renewable fenced leases, durable wrapped-key custody, staged-publication restart recovery, and exact terminal evidence. A PKCS#11 backend wraps the random data key under an existing nonextractable RSA-3072 HSM KEK; PostgreSQL and object descriptors never receive plaintext key bytes. Internal authenticated routes queue/read operations and deliver exactly 128 recovered bits only from a succeeded durable record with no-store headers. The supervised PostgreSQL/SoftHSM/FFmpeg gate independently decodes the protected H.264/AAC HLS, reconstructs provider and custody state for exact replay, recovers an expired lease, fences the stale worker, and denies another tenant. Increment 7m now completes the bounded AES-128 viewer/client and destructive-cleanup path. A forced-RLS protected-publication lookup selects only the newest active succeeded operation for the exact ready source publication; HLS grants sign its immutable operation prefix and exact external key URI, while DASH stays on the clear source publication and no unsupported protected DASH URL is invented. Browser HLS.js and the native credential proxy admit the Bearer only for the exact protected ledger or signed key URI. The public key route revalidates the active viewer lease, source publication, protected operation, virtual key object, and custody before returning exactly 16 uncached bytes; wrong, stale, releasing, and released access is an indistinguishable empty 401. Migration 00023 adds a database-clock active → releasing → released lifecycle, durable exact deletion plan, reclaimable release lease, custody digest, and an active-publication index. Release fences grants before deleting the exact protected objects, preserves every source object, shreds wrapped custody only after deletion succeeds, replays the same release time, and rejects operation resurrection. Real Chromium AES-128 decoding and sibling-key non-disclosure coverage plus the supervised PostgreSQL/SoftHSM/FFmpeg/native gate prove the complete path across reconstruction and cleanup. CENC/CBCS and external vendor DRM/CDM licensing remain explicitly open. The real aphrodite.watermark.v1 provider accepts one exact ready H.264/AAC MPEG-TS publication object and applies only the tenant-fixed aphrodite.visible-grid.v1 profile. Its payload identity is derived from the publication or an exact active, entitled viewer session; callers cannot choose the profile, key, token, output, or worker. A random data key is wrapped by the existing nonextractable RSA-3072 PKCS#11 KEK, while a domain-separated HMAC derives the 64-bit visible-grid token; plaintext key/token material is never durable. Real FFmpeg output is decoded to extract all 64 cells and measure luma PSNR outside the grid. Migration 00016 adds the forced-RLS, publication-bound, database-clock queue with fenced renewable leases, staged artifact recovery, exact replay, and a durable release fence after both output objects are deleted. The supervised PostgreSQL/SoftHSM/FFmpeg gate proves real transform evidence, restart replay without re-encoding, expired-lease recovery, stale-worker fencing, tenant denial, and destructive cleanup. This is explicitly a visible marker, not an invisible or forensically robust watermark. The real aphrodite.player-client.v1 path now registers one credential-free operation for the exact ready publication, viewer session, playback grant, client instance, and exact HLS or DASH protocol. Migration 00017 adds its forced-RLS, database-clock, leased/reclaimable, QoE-foreign-keyed ledger; only a persisted playing sample with the exact grant and positive decoded frames can create success, and refresh/leave/failure release the operation. @oshun/live-media/browser contains the Bearer to the exact publication prefix through HLS.js or dash.js/MSE, reports ready only after a real decoded frame and matching durable heartbeat, and supplies an accessible protocol-neutral full-stage surface. FFmpeg-backed Chromium automation covers both protocols' repeated heartbeats, prefix escape, authorization loss, release, axe, mobile, and reduced motion; the supervised MediaMTX/PostgreSQL gate proves durable DASH proof, browser-device binding, refresh release, secret non-disclosure, and tenant isolation. A real aphrodite.publisher-client.v1 path now gives browser publishers one exact grant-backed WHIP operation. The same-origin client contains the Bearer to the exact MediaMTX WHIP endpoint, sends supplied audio/video tracks over WebRTC, reports only monotonic outbound RTP counters, and becomes ready only when a durable heartbeat corroborates those counters with positive ingress from the exact authenticated edge connection. Migration 00018 adds the composite grant/resource-bound, forced-RLS, database-clock, leased/reclaimable ledger with one active publisher per stream and repeat-safe release. Unit, route, migration, real MediaMTX/PostgreSQL, and FFmpeg/Chromium automation prove OPTIONS versus source binding, secret containment, live encoded-video ingress, restart replay, tenant denial, authorization failure, and teardown. Increment 7i adds an explicit browser/native runtime discriminator to both client contracts and migration 00019's durable ledgers. Native publishers receive a credential-free SRT URL and, for remote endpoints, a required AES-256 passphrase; an isolated Rust process accepts secrets over standard input, keeps them out of FFmpeg arguments, and sends real MPEG-TS with a pure-Rust SRT 1.4.4 implementation. Native HLS/DASH playback keeps its Bearer in an exact-publication-prefix loopback proxy, constrains redirects and playable manifest references, drives real FFmpeg decode and ffplay rendering, and persists measured QoE. The supervised gate proves native encrypted SRT ingress, durable runtime binding, protected HLS/DASH decode, and non-black Xvfb rendering against real MediaMTX/PostgreSQL. This is a Linux native execution-component claim, not a complete desktop or mobile product UI. Increment 7j retires Aphrodite's public process-local VR simulation behind an explicit no-store 410 gateway and adds a real bounded browser immersive path. @oshun/live-media/browser now projects protected decoded equirectangular 180°/360° video through WebGL for flat/cardboard presentation, renders two cardboard eyes from mono/SBS/top-bottom sources, accepts pointer/keyboard/permission-backed device orientation, and measures Web Audio plus non-black and changed-view proof. Aphrodite Viewer exposes authenticated immersive register/evidence/release under the existing viewer lease. aphrodite.immersive.v1 derives its exact operation/player/publication/session/client binding from the succeeded browser-player operation, while migration 00020 supplies forced RLS, database-clock lifecycle and worker fences, restart replay, expired-lease recovery, immutable privacy-bounded evidence, and release. Generated 1920×960 H.264/AAC stereo HLS and DASH pass single-worker Chromium coverage for real decoded pixels in two distinct eye buffers, 360° device-orientation and 180° pointer view changes on paused source frames, positive audio, axe, mobile/reduced motion, Bearer/raw-tracking non-disclosure, and ordered teardown. The digest-pinned real MediaMTX/PostgreSQL gate proves migration, replay after reconstruction, stale-fence rejection, tenant denial, reconnect release, and explicit teardown. Cubemap/EAC, ambisonics, physical headsets, WebXR/OpenXR/ visionOS, and capture/stitching remain explicit non-claims. Increment 7k retires Aphrodite's unsafe token-in-query, tenantless, schema-free remote-guest network authority behind a compatibility facade and adds a real bounded one-host/one-guest browser path. @oshun/live-media now owns strict registration, provision, signaling, evidence, and release contracts plus the two-person RTCPeerConnection client and accessible full-bleed studio surface. Aphrodite Broadcaster supplies only the authenticated tenant composition, no-store routes, and exact-path single-node WebSocket gateway. One-use invitation and signaling capabilities never enter URLs, SDP/ICE remain transient, and success requires reciprocal RTP evidence whose guest-outbound and host-inbound video flow is linked by a SHA-256 SSRC digest. Migration 00021 and aphrodite.remote-guest.v1 supply exact publisher-grant binding, one active guest per stream, digest-only secret custody, forced RLS, database-clock expiry, semantic idempotency, restart replay, reclaimable/fenced execution, and repeat-safe release. Two-context single-worker Chromium coverage proves real reciprocal audio/video, third-participant rejection, URL/DOM/durable credential non-disclosure, invite-fragment scrubbing, proof and teardown states, axe, keyboard, mobile, and reduced motion. The supervised real PostgreSQL/MediaMTX gate proves secret rotation/one-use denial, durable SDP/ICE and raw-secret absence, restart replay, RLS isolation, database-clock expiry, abandoned-lease recovery, stale-fence rejection, release, and cleanup. SFU/MCU, TURN availability, multi-party, screen share, end-to-end media encryption, native/mobile clients, and multi-node signaling remain explicit non-claims. Increment 7l adds the bounded real browser composition path. @oshun/live-media/browser owns a Canvas 2D/Web Audio compositor and accessible full-stage surface for one to four exact live sources, deterministic single/grid/two-source picture-in-picture layouts, 640–1920-wide 16:9 output at 15–60 fps, optional audio mixing, and publication through the existing credential-contained WHIP client. Only source references, layout/output declarations, changed/non-black frame counts, bounded source-region hashes, and aggregate audio evidence reach the server. Aphrodite registers evidence only against the exact succeeded browser/WebRTC grant-backed publisher and connected edge with positive ingress. Migration 00022 supplies the forced-RLS, database-clock, replay-safe, leased/fenced lifecycle. Full single-worker Chromium coverage proves two changing Canvas sources, a real oscillator, distinct non-black regions, positive audio and MediaMTX RTP, axe, keyboard, mobile/reduced motion, denial, privacy, and ownership-correct teardown. The supervised PostgreSQL/MediaMTX gate proves migration, exact joins, reconstruction replay, abandoned-lease recovery, stale-fence rejection, tenant isolation, non-disclosure, repeat-safe release, and edge cleanup. Custom layouts, switching/transitions, GPU/OBS/native composition, SFU/MCU mixing, and multi-node orchestration remain explicit non-claims. Increment 8a establishes the SQL identity prerequisite for tenant onboarding. @oshun/live-media now owns an immutable, idempotent mapping between a tenant/resource UUID and its product-owned external identity, with memory and forced-RLS PostgreSQL stores. Migration 00024 backfills Aphrodite and any deployed shared ledger rows, normalizes the early telemetry UUID column, and replaces all 13 root shared-ledger streams(id) references with composite (tenant_id, stream_id) references to the substrate registry. New Aphrodite publisher-grant issuance registers the exact canonical stream mapping before writing the grant. A digest-pinned real PostgreSQL gate applies migrations 00005–00024, uses the same substrate stream UUID independently for Aphrodite, Veritas, V3 Stage, and the V10 Rail, issues and authenticates durable grants after reconstruction, proves forced-RLS visibility and the complete constraint catalog, rejects conflicting mappings, and rejects a grant for an unregistered resource. This is identity/credential equivalence only, not completed tenant composition. Increment 8b removes Aphrodite-only assumptions from the canonical browser/native client API. Playback, publisher, immersive, remote-guest, and composition descriptors admit only kind-correct tenant-qualified adapter IDs; the browser controls bind that identity across their full lifecycle and reject swaps. Canonical functions, types, mounts, and DOM roots now use live-media names, while all prior Aphrodite* exports are deprecated exact aliases. Contract tests exercise Veritas playback and immersive plus V3 Stage publisher, composition, remote-guest, and native publisher identities, with non-Aphrodite native playback and negative wrong-kind/swap cases. All 243 shared tests, 19 Chromium scenarios, 14 V10 guard cases, affected Aphrodite suites and typechecks, package lint, and the shared production build pass. This proves a portable client contract and Aphrodite equivalence, not real Veritas/V3/Rail provider composition or a Rail playback lane. The parent remains open for broader composition, remote-guest, and immersive runtimes, CENC/CBCS and vendor DRM, remaining conformance/recovery automation, real Veritas/V3/Rail adapters, the full tenant-equivalence suite, and final ingest-to-Rail flow. Increment 8c now extracts the media-pipeline command/query façade as LiveMediaTenantPipelineJobControl: a product fixes one validated tenant and its operate/manage principals once, while callers can supply only stream-local job inputs. Aphrodite's former façade is an exact thin tenant-#1 subclass with full-result enqueue/replay/get/list/cancel equivalence coverage. The Veritas Rail package supplies the first production-shaped tenant-#2 subclass, and tests prove runtime options cannot replace its tenant or principals. Shared-pipeline coverage uses the same stream UUID and idempotency key for Aphrodite and Veritas while proving independent records, cross-tenant query isolation, replay, cancellation, and invalid-configuration rejection. All 246 shared, 191 passing plus one intentionally skipped Aphrodite adapter, 86 Veritas channel, and 14 V10 Phase A/consolidation tests pass, together with source/spec typechecks, targeted lint, dependency-inclusive builds, and frozen-lockfile validation. This closes a real control-plane extraction slice only: Veritas rehearsal bytes are not yet connected to the shared ingest/publication/viewer path, first-party-live remains not_configured, and V3/Rail production compositions plus the full ingest-to-playback equivalence gate remain open. Detailed evidence is in RB3_APHRODITE_STREAMING_SUBSTRATE_AUDIT.md. Increment 8d extracts the complete durable PostgreSQL pipeline-job store into the canonical server-only substrate. SqlLiveMediaPipelineJobStore receives an injected canonical database transaction port and fixes one tenant at construction while preserving forced RLS, advisory idempotency, SKIP LOCKED claims, database-clock leases, fencing, recovery, cancellation, and settlement. Aphrodite's prior store is now a thin constructor-compatible tenant-#1 wrapper that retains its default database and exact legacy tenant-mismatch error. Veritas control → shared service → shared SQL-store coverage proves tenant/RLS/advisory bindings, while negative coverage rejects Aphrodite cross-tenant enqueue/list calls before opening a transaction. All 248 shared tests, 191 passing plus one intentionally skipped Aphrodite adapter test, 86 Veritas channel tests, and 14 V10 Phase A/consolidation tests pass, together with five typechecks, targeted lint, dependency-inclusive builds, frozen-lockfile validation, and the digest-pinned real PostgreSQL plus MediaMTX persistence E2E. This is durable control-plane persistence progress, not a deployed Veritas database composition, Veritas ingest/publication/HLS flow, or V3/Rail completion; first-party-live remains not_configured. Increment 8e extracts the remaining durable identity/credential prerequisite into the canonical server-only substrate. SqlLiveMediaResourceRegistryStore preserves database-time immutable registration, tenant-wide advisory serialization, exact replay, and crossed-uniqueness rejection; SqlLiveMediaPublisherGrantStore preserves resource-local advisory serialization, atomic rotation, monotonic generations, digest-only lookup, and expected-grant revocation. Both fix a validated tenant, establish transaction-local forced-RLS context, and reject cross-tenant access before SQL while allowing thin product error translation. Aphrodite's former stores are now constructor-compatible tenant-#1 subclasses with the exact legacy mismatch errors. Shared unit coverage exercises Veritas registry and grant service → SQL behavior. The digest-pinned PostgreSQL gate now uses the canonical stores directly for Aphrodite, Veritas, V3 Stage, and V10 Rail, proving same-UUID isolation, immutable mappings, grant issuance/authentication after reconstruction, the composite-FK catalog, RLS visibility, conflict/unregistered denial, and teardown. All 254 shared tests and 191 passing plus one intentionally skipped Aphrodite adapter test pass, along with 86 Veritas channel tests, all 14 V10 Phase A/consolidation tests, four source/spec typechecks, Nx-aware shared/adapter lint, dependency-inclusive builds, formatting, diff checks, and the real PostgreSQL gate. This removes an Aphrodite-named persistence dependency; it does not yet deploy a Veritas/V3/Rail publisher, connect rehearsal bytes to edge/publication/viewer/Rail playback, or flip first-party-live. Increment 8f extracts the durable publisher-edge and media-publication stores into the canonical server-only substrate. SqlLiveMediaPublisherEdgeSessionStore preserves resource-local advisory serialization, exact-connection refresh without revision inflation, atomic replacement, stale-disconnect rejection, and tenant-scoped connected-session listing. SqlLiveMediaPublicationStore preserves publication-local advisory serialization, exact-prefix reservation, durable source metadata, compare-and-swap lifecycle transitions, and exact terminal replay. Both fix a validated tenant, establish transaction-local forced-RLS context, and reject cross-tenant work before SQL; Aphrodite now retains only thin constructor-compatible tenant-#1 wrappers with its exact legacy mismatch errors. Direct shared coverage exercises Veritas behavior, while the digest-pinned PostgreSQL gate uses the canonical stores for Aphrodite, Veritas, V3 Stage, and V10 Rail to persist an isolated grant, SRT edge connection, and publication reservation for the same stream UUID. Per-tenant forced-RLS visibility and recovery of all three authorities after reconstruction pass. All 260 shared tests, 192 passing plus one intentionally skipped Aphrodite adapter test, 86 Veritas channel tests, and all 14 V10 Phase A/consolidation tests pass, along with four strict source/spec typechecks, Nx-aware lint, dependency-inclusive builds, and the real PostgreSQL gate. This does not yet send real non-Aphrodite bytes through MediaMTX, publish a ready HLS/DASH ledger, deploy a Veritas worker/viewer, complete Rail playback, or flip first-party-live. Increment 8g extracts the complete durable viewer-session, QoE, and presence state machine as SqlLiveMediaViewerSessionStore. The canonical server-only store fixes a validated tenant, establishes transaction-local forced-RLS context, serializes each resource, uses the database clock, expires stale leases/entitlements, preserves join/refresh/reconnect idempotency, fences heartbeat/leave by digest-only lease identity, commits lifecycle events and monotonic QoE, and derives active-session/unique-viewer presence atomically. Its former direct streams dependency is now an optional transactional projection port: the canonical default owns no product counter, while Aphrodite's thin tenant-#1 wrapper retains the exact current/peak/total projection, constructor, and legacy mismatch error. Direct Veritas tests and all existing Aphrodite store tests pass. The digest-pinned PostgreSQL gate now persists an isolated active viewer lease for Aphrodite, Veritas, V3 Stage, and V10 Rail beside each tenant's resource, grant, edge, and publication, proves per-tenant RLS visibility, then reconstructs each active session and one-session/one-viewer presence snapshot. Its minimal Aphrodite product table has no viewer-counter columns, proving the canonical authority no longer depends on them. All 264 shared tests, 192 passing plus one intentionally skipped Aphrodite adapter test, 86 Veritas channel tests, and all 14 V10 Phase A/consolidation tests pass, along with four strict source/spec typechecks, Nx-aware lint, dependency-inclusive builds, formatting/diff checks, and the real PostgreSQL gate. The publications remain publishing: no real non-Aphrodite bytes, ready HLS/DASH ledger, playback grant, decoded Rail player, deployed non-Aphrodite worker/viewer, or first-party-live flip is claimed. Increment 8h extracts the complete durable live-chat persistence state machine as SqlLiveMediaChatStore. The canonical server-only store fixes a validated tenant, establishes transaction-local forced-RLS context, uses PostgreSQL time and advisory serialization, and preserves viewer-session/entitlement-bound membership, digest-only leases, join/heartbeat/reconnect/leave/expiry/revocation, presence, rate limits, immutable message idempotency, moderation-bound text, server messages, deletion/clearing, history, and the ordered event outbox/poll cursor. Aphrodite's store is now a thin tenant-#1 wrapper retaining its exact constructor, default database, mismatch error, and product-owned filter/policy configuration. Four direct Veritas tests and all ten Aphrodite SQL-behavior tests pass. The digest-pinned PostgreSQL gate now creates one isolated membership, message, and two ordered events for Aphrodite, Veritas, V3 Stage, and V10 Rail; forced RLS exposes only the current tenant, and reconstructed stores recover digest-authenticated history, one-member/one-participant presence, and ordered event polling after restart. The dedicated live-chat PostgreSQL concurrency/replay/ expiry/moderation/recovery gate also passes. All 268 shared tests, 192 passing plus one intentionally skipped Aphrodite adapter test, 59 passing plus one intentionally skipped Aphrodite chat test, 86 Veritas channel tests, and all 14 V10 Phase A/consolidation tests pass, together with five strict typechecks, shared/adapter/chat lint, dependency-inclusive builds, formatting/diff checks, and both real PostgreSQL gates. The publications remain publishing; no real Veritas/V3/Rail bytes, ready HLS/DASH ledger, playback grant, decoded Rail player, deployed non-Aphrodite chat composition, final tenant-equivalence gate, or first-party-live flip is claimed. Increment 8i extracts the complete durable operational event ledger and hook outbox as SqlLiveMediaOperationalTelemetryStore. The canonical server-only store fixes a validated tenant, establishes transaction-local forced-RLS context, atomically persists each event and its selected configured deliveries, and preserves advisory-lock semantic idempotency, conflict fingerprints, a monotonic database sequence, exact resource queries, database-clock SKIP LOCKED claim/reclaim, final-expiry dead-lettering, and lease-fenced complete/fail/retry transitions. Aphrodite's store is now a thin tenant-#1 wrapper retaining its default database, positional constructor, and exact mismatch error; its hook registrations/providers and legacy analytics remain product-owned. The extraction also corrects the stale UUID casts left after migration 00024 normalized registry stream keys to text, with direct regression assertions and real restart reads covering the fix. Five direct Veritas tests and all five Aphrodite SQL-behavior tests pass. The digest-pinned PostgreSQL gate now commits one isolated operational event and pending rail.audit delivery for Aphrodite, Veritas, V3 Stage, and V10 Rail, proves exact forced-RLS visibility, then reconstructs each store to query the event, claim the delivery, and complete it with a provider reference. The dedicated chat gate additionally proves concurrent hook claims, retry/dead-letter behavior, bounded body-free content, and cross-tenant rejection. All 273 shared tests, 192 passing plus one intentionally skipped Aphrodite adapter test, 59 passing plus one intentionally skipped Aphrodite chat test, 86 Veritas channel tests, and all 14 V10 Phase A/consolidation tests pass, together with five strict typechecks, shared/adapter/chat lint, dependency-inclusive builds, formatting/diff checks, and both real PostgreSQL gates. Hook-provider deployment for Veritas/V3/Rail, real non-Aphrodite bytes, a ready HLS/DASH ledger, playback grants, decoded Rail playback, the final tenant-equivalence gate, and first-party-live remain open. Increment 8j extracts the remaining viewer-session, operational-telemetry, and playback-grant authority facades as LiveMediaTenantViewerSessionControl, LiveMediaTenantOperationalTelemetryControl, and the server-only LiveMediaTenantPlaybackGrantControl. Each validates and fixes one tenant/principal at construction, mints its request scope internally, validates exact stream/publication identities, and exposes no caller tenant or capability override. Aphrodite's former controls are now thin constructor-compatible tenant-#1 wrappers retaining its exact principals, timing/ID seams, SQL default, product hook registrations, and playback-service injection. Direct shared tests prove same-stream tenant isolation, viewer/QoE/telemetry behavior, idempotent hook creation, invalid fixed authority, and Veritas/V3/Rail grant delegation; existing operational, protected-playback, and all 105 viewer integration tests remain green. The four-tenant PostgreSQL gate now enters viewer join plus restart active/presence through tenant-fixed viewer controls and operational writes through tenant-fixed telemetry controls for all four tenants. All 279 shared tests, 192 passing plus one intentionally skipped Aphrodite adapter test, 59 passing plus one intentionally skipped Aphrodite chat test, 105 viewer integration tests, 86 Veritas channel tests, and all 14 V10 Phase A/consolidation tests pass, together with eight strict typechecks, graph-aware shared/adapter lint, dependency-inclusive shared/adapter builds, the direct viewer production bundle, formatting/diff checks, and both real PostgreSQL gates. The publications remain publishing; deployed Veritas/V3/Rail viewer/grant/ hook compositions, real non-Aphrodite bytes, a ready HLS/DASH ledger, decoded Rail playback, final tenant equivalence, and first-party-live remain open. Increment 8k extracts publisher-grant issuance/registration and transcode execution authority as the server-only LiveMediaTenantPublisherGrantControl and LiveMediaTenantTranscodeExecutionControl. Each fixes and validates a tenant at construction and accepts no runtime tenant or capability. The publisher control also fixes the owner-product mapping, registers the immutable resource before issuing a secret, and binds authenticate, rotation, and revocation to the same tenant. The transcode control fixes its worker principal and absolute output root, then mints exact operate scopes, execution identities, resources, and tenant-namespaced output URIs internally. Aphrodite's prior controls are now thin constructor- compatible tenant-#1 wrappers retaining their SQL defaults, optional registry behavior, product mapping, principal, error text, timing, and random-ID seams. Seven direct tests prove Veritas/V3 same-stream grant isolation, mapping, V10 management authority, invalid configuration, and Veritas/V3/Rail transcode delegation. The four-tenant PostgreSQL gate now enters registration, grant issuance, and restart authentication through the publisher control for all four tenants, while the real digest-pinned MediaMTX/PostgreSQL gate passes through the transcode wrapper and worker path. All 286 shared tests, 192 passing plus one intentionally skipped Aphrodite adapter test, the full Aphrodite streaming and broadcaster test targets, 86 Veritas channel tests, and all 14 V10 Phase A/consolidation tests pass, together with six strict typechecks, graph-aware shared/adapter lint, dependency-inclusive shared/adapter builds, direct streaming/broadcaster production bundles, formatting/diff checks, and both real container gates. The publications remain publishing; deployed Veritas/V3/Rail ingest/worker compositions, real non-Aphrodite bytes, a ready HLS/DASH ledger, playback grants, decoded Rail playback, final tenant equivalence, and first-party-live remain open. Increment 8l extracts publisher-edge callback and reconciliation authority as the canonical LiveMediaTenantPublisherEdgeControl. It validates and fixes one tenant and edge principal at construction, parses every stream, creates operate scopes internally, binds provider reconciliation to that tenant, and preserves stable publisher/live and disconnected/ended telemetry from durable connection revisions. Aphrodite's former implementation is now a thin tenant-#1 constructor wrapper retaining its default forced-RLS store, default telemetry, injection opt-out, principal, clock, request-ID seam, routes, and errors. Three canonical tests prove Veritas/V3 same-stream isolation, duplicate event identity, V10 Rail reconciliation, and invalid fixed authority; all 289 shared tests and 192 passing plus one intentionally skipped adapter test pass, together with the full Streaming target, 86 Veritas tests, all 14 Phase A tests, six strict typechecks, graph-aware shared/adapter lint, dependency- inclusive shared/adapter builds, the direct Streaming bundle, formatting/diff checks, and both digest-pinned real container gates. The four-tenant PostgreSQL gate now enters publisher observation through the fixed-tenant edge control. This does not claim deployed non-Aphrodite edges, real non-Aphrodite ingress, ready HLS/DASH, playback grants, decoded Rail playback, final tenant equivalence, or a first-party-live flip. Increment 8m extracts the remaining media-publication publish/get/ revoke authority as LiveMediaTenantMediaPublicationControl. It fixes and validates one tenant plus worker/reader/manager principals, mints request/publication identities and exact scopes internally, and accepts no caller tenant, resource, timestamp, or capability. Aphrodite's prior class is now a tenant-#1 wrapper retaining its constructor, timing/ID seams, and deprecated legacy grant compatibility method; current protocol-aware viewer grants remain in AphroditePlaybackGrantControl. Three direct canonical tests prove same-stream/same-publication-ID Veritas/V3 isolation through ready in-process object ledgers, fixed V10 Rail authority, caller-authority replacement, tenant-local revocation, and invalid fixed configuration. All 292 shared tests and 192 passing plus one intentionally skipped adapter test pass, together with the full Streaming target, 86 Veritas tests, all 14 Phase A tests, six strict typechecks, graph-aware shared/adapter lint, dependency-inclusive builds, the direct Streaming bundle, formatting/diff checks, and both digest-pinned real container gates. This does not claim deployed non-Aphrodite publication workers, real non-Aphrodite bytes, ready non-Aphrodite HLS/DASH, issued playback grants, decoded Rail playback, final tenant equivalence, or a first-party-live flip. Increment 8n extracts the remaining live-chat runtime authority as LiveMediaTenantLiveChatControl. It fixes one validated tenant plus presence/system/payment/fanout principals, creates exact scopes internally, validates every resource identity, and binds join, viewer-resolution, membership, moderation, messages, presence, system/ tip publication, event polling, and content-free operational telemetry to that tenant. Aphrodite's former class is now a thin tenant-#1 wrapper retaining its constructor, exact error identity/codes, SQL participant/ entitlement/moderation policies, filter and service tuning, telemetry, routes, and socket runtime. Five direct shared tests prove same-stream/ session/message-key Veritas/V3 isolation over one store, tenant-local moderation/presence/events, fixed V10 Rail system/tip principals, fixed scopes, content-free telemetry, and fail-closed authority; an Aphrodite runtime assertion proves exact compatibility errors. All 297 shared tests, 192 passing plus one intentionally skipped adapter test, 60 passing plus one intentionally skipped Chat test, 86 Veritas tests, and all 14 Phase A tests pass, together with six strict typechecks, graph- aware shared/adapter/Chat lint, dependency-inclusive shared/adapter/Chat builds, formatting/diff checks, the real Chat/PostgreSQL policy/store gate, and the four-tenant durable PostgreSQL gate. This does not claim deployed Veritas/V3/Rail chat policy/socket/hook compositions, real non-Aphrodite chat use or media bytes, ready HLS/DASH, playback grants, decoded Rail playback, final tenant equivalence, or a first-party-live flip. Increment 8o extracts content-analysis probe/analyze/teardown authority as LiveMediaTenantContentAnalysisControl. It fixes and validates one tenant plus one adapter ID, creates exact operate scopes and resources internally, and reconstructs the strict content-analysis request so callers cannot replace tenant, adapter, kind, capability, or resource authority. Aphrodite's prior class is now a tenant-#1 wrapper fixing aphrodite.content-analysis.v1 while retaining its constructor, schema/type exports, timing/ID seams, publication binding, advisory policy, provider, forced-RLS queue, worker, and Streaming routes. Three direct shared tests drive one real optional-adapter service with independent in-process Veritas/V3 providers and equal stream/publication/operation/idempotency identities, proving fixed provider/binding/scope/result/teardown isolation plus V10 caller-override and malformed-authority rejection. All 300 shared tests, 192 passing plus one intentionally skipped adapter test, 108 passing plus one intentionally skipped Streaming test, 86 Veritas tests, and all 14 Phase A tests pass, together with six strict typechecks, graph-aware shared/adapter/Streaming lint, dependency-inclusive shared (+6), adapter (+13), and Streaming (+14) builds, formatting/diff checks, and the digest-pinned real MediaMTX/PostgreSQL/FFmpeg content-analysis gate. This does not claim deployed or real Veritas/V3/Rail analyzers, policies, queues, workers, or analysis; non-Aphrodite media, ready HLS/DASH, playback grants, decoded Rail playback, final tenant equivalence, and a first-party-live flip remain open. Increment 8p extracts durable recording admission/query and worker authority as LiveMediaTenantRecordingControl and LiveMediaTenantRecordingWorker. They fix one validated tenant and adapter at construction; own strict inputs, exact operate scopes, publisher-connection binding, readiness, semantic fingerprinting, queue reservation/read, and worker execution; and reject mismatched durable tenant/adapter authority before provider access. Aphrodite's control and worker are now thin tenant-#1 wrappers retaining their constructors, schema/type exports, forced-RLS queue and record validation, MediaMTX binding/source authority, retention policy, FFmpeg executor, create-only object store, scheduler/routes, clocks/IDs, and shutdown cancellation. Its legacy fingerprint delegates to the shared canonical implementation. Three direct shared tests drive one real optional-adapter service with independent Veritas/V3 providers and equal recording identities, proving queue, fingerprint, binding, scope, provider, and result isolation plus caller-override, malformed-authority, and durable mismatch rejection. All 303 shared tests, 192 passing plus one intentionally skipped adapter test, 108 passing plus one intentionally skipped Streaming test, 86 Veritas tests, and all 14 Phase A tests pass, together with six strict typechecks, graph-aware shared, adapter, and Streaming lint, dependency-inclusive shared (+6), adapter (+13), and Streaming (+14) builds, formatting/diff checks, and the digest-pinned MediaMTX/PostgreSQL/FFmpeg gate, which now admits and executes the real Aphrodite recording through the wrappers before probing its H.264/AAC MP4 while preserving replay, recovery, fencing, tenant denial, and teardown. This does not claim deployed Veritas/V3/Rail recording sources, policies, stores, workers, or real capture; ready non-Aphrodite HLS/DASH, playback grants, decoded Rail playback, final tenant equivalence, and a first-party-live flip remain open. Increment 8q extracts segment-encryption probe/admission/query, protected-key delivery, repeat-safe release, and worker authority as LiveMediaTenantSegmentEncryptionControl and LiveMediaTenantSegmentEncryptionWorker. They validate and fix one tenant plus adapter at construction; own the strict input and canonical fingerprint, exact operate scopes/resources, policy/binding/readiness checks, bounded queue reservation/read, custody recovery gate, signed optional-adapter teardown, and worker execution; and reject a durable operation, resource, adapter, tenant, or fingerprint mismatch before custody or provider access. Aphrodite's control and worker are now thin tenant-#1 wrappers retaining their constructors, schema/type exports, exact product error class/codes, static key policy, PKCS#11 custody, forced-RLS queue, AES-128 provider, routes, scheduler, and timing/ID seams. Its legacy fingerprint delegates to the shared canonical implementation. Three direct shared tests drive one real optional- adapter service with independent Veritas/V3 providers and equal encryption identities, proving queue/fingerprint/binding/scope/provider, 128-bit key URI/custody, result, and release isolation plus caller- override, malformed-authority, policy, and durable-mismatch rejection. All 306 shared tests, 192 passing plus one intentionally skipped adapter test, 108 passing plus one intentionally skipped Streaming test, 86 Veritas tests, and all 14 Phase A tests pass, together with six strict typechecks, graph-aware shared/adapter/Streaming lint, dependency- inclusive shared (+6), adapter (+13), and Streaming (+14) builds, formatting/diff checks, and the digest-pinned MediaMTX/PostgreSQL/ SoftHSM/FFmpeg/Chromium gate. The real ready Aphrodite HLS publication is now admitted through the wrapper and encrypted through its worker before independent protected H.264/AAC decode; restart replay, exact key authorization/non-disclosure, sibling denial, lease recovery, stale- writer fencing, tenant denial, destructive release, source preservation, custody shredding, and teardown remain green. This does not claim deployed Veritas/V3/Rail key policies, custody, queues, workers, or real encryption; CENC/CBCS/vendor DRM, ready non-Aphrodite HLS/DASH, playback grants, decoded Rail playback, final tenant equivalence, and a first-party-live flip remain open. Increment 8r extracts visible- watermark probe/admission/query, repeat-safe release, and worker authority as LiveMediaTenantWatermarkControl and LiveMediaTenantWatermarkWorker. They validate and fix one tenant plus adapter at construction; own the strict input and canonical semantic fingerprint, exact operate scopes/resources, policy-derived profile, payload, and key references, publication/viewer binding and readiness checks, bounded queue reservation/read, durable-authority validation, signed optional-adapter teardown, and worker execution; and reject a durable operation, resource, adapter, tenant, or fingerprint mismatch before release or provider access. Aphrodite's control and worker are now thin tenant-#1 wrappers retaining their constructors, schema/type exports, exact product error class/codes, visible-grid policy, PKCS#11 custody, forced-RLS queue, FFmpeg provider, routes, scheduler, and timing/ID seams. Its legacy fingerprint delegates to the shared canonical implementation. Three direct shared tests drive one real optional-adapter service with independent Veritas/V3 providers and equal stream/operation/publication/viewer/source/idempotency identities, proving queue/fingerprint/binding/scope/provider/result and release isolation plus caller-override, malformed-authority, policy, and durable-mismatch rejection. All 309 shared tests, 193 passing plus one intentionally skipped adapter test, 108 passing plus one intentionally skipped Streaming test, 86 Veritas tests, and all 14 Phase A tests pass, together with six strict typechecks, graph-aware shared/adapter/ Streaming lint, dependency-inclusive shared (+6), adapter (+13), and Streaming (+14) builds, formatting/diff checks, and the supervised real MediaMTX/PostgreSQL/SoftHSM/FFmpeg gate. The real Aphrodite watermark is now admitted and transformed through the wrappers and released through the reconstructed control while real 64-cell extraction, luma PSNR, restart replay, lease recovery, stale-writer fencing, token/custody non-disclosure, RLS tenant denial, exact artifact deletion, resurrection denial, and teardown remain green. This does not claim deployed Veritas/V3/Rail watermark policies, custody, queues, workers, or real transforms; the visible-grid marker is not invisible or forensically robust, and ready non-Aphrodite HLS/DASH, playback grants, decoded Rail playback, final tenant equivalence, and a first-party-live flip remain open. Increment 8s extracts player-grant registration, decoded-media observation, synchronous provider execution, and release authority as LiveMediaTenantPlayerClientControl. It validates and fixes one tenant, adapter, and service principal; binds the grant to an active leased viewer session by tenant, stream, session ID, and subject before probe; owns runtime selection, readiness, canonical exact-issuance fingerprinting, reservation, positive playing/decoded-frame QoE staging, execution, durable success, and teardown/released validation; and rejects a mismatched durable resource, adapter, operation, session, grant, or fingerprint before provider access. AphroditePlayerClientControl is now a thin tenant-#1 wrapper retaining its constructor, operation alias, product errors, forced-RLS PostgreSQL queue/parser, lease/fencing provider, browser/native HLS/DASH references, protected-playback composition, and routes. It fixes the Aphrodite service principal after caller options are spread, and its legacy fingerprint delegates to the shared canonical implementation. Three direct shared tests drive one real optional-adapter service with independent Veritas/V3 providers and equal stream/publication/session/grant/QoE/operation identities, proving queue, fingerprint, binding, scope, provider, evidence, result, and release isolation plus caller-override, malformed-authority, unsupported cast, durable-mismatch, and stale-fingerprint rejection. An adversarial Aphrodite compatibility case additionally proves runtime-only tenant, adapter, principal, parser, and descriptor overrides cannot weaken the wrapper. All 312 shared tests, 194 passing plus one intentionally skipped adapter test, 108 passing plus one intentionally skipped Streaming test, 86 Veritas tests, and all 14 Phase A tests pass, together with six strict typechecks, graph-aware shared/adapter/Streaming lint, dependency-inclusive shared (+6), adapter (+13), and Streaming (+14) builds, formatting/diff checks, and the supervised real MediaMTX/PostgreSQL/SoftHSM/FFmpeg/Chromium gate. The real protected-playback path exercises the reconstructed wrapper from grant registration through positive decoded DASH QoE, durable proof, replacement/RLS isolation, and final release. This does not claim deployed Veritas/V3/Rail player providers, stores, policies, or decoded runtimes; ready non-Aphrodite HLS/DASH and playback grants, decoded Rail playback, final tenant equivalence, and a first-party-live flip remain open. Increment 8t extracts active publisher-grant registration, independently authenticated edge binding, positive publisher-runtime evidence staging, synchronous provider execution, query, and repeat-safe release authority as LiveMediaTenantPublisherClientControl. It validates and fixes one tenant, adapter, and service principal; reparses the active non-revoked, unexpired grant before readiness access; owns strict runtime/protocol and edge-identity input, exact-issuance fingerprinting, reservation, legacy unregistered-grant compatibility, protocol and timestamp binding, durable two-sided evidence admission, success validation, and teardown; and rejects a mismatched durable tenant, stream, adapter, operation/grant identity, or fingerprint before binding, provider execution, query, or release. AphroditePublisherClientControl is now a thin tenant-#1 wrapper retaining its constructor and operation alias, exact product errors, forced-RLS PostgreSQL queue/parser, active-grant and authenticated MediaMTX edge checks, leasing/fencing provider, browser WHIP and native SRT runtime references, production runtime composition, and ingest and broadcaster flows. It fixes the Aphrodite tenant, adapter, principal, parser, descriptor, and error factory after caller options are spread; its legacy fingerprint delegates to the shared canonical implementation. Three direct shared tests drive one real optional-adapter service with independent Veritas/V3 providers and tenant queue views over one record map using equal stream/grant/client/edge/connection/evidence identities. They prove queue, fingerprint, scope, verifier, provider, evidence, result, query, and release isolation plus inactive/cross-tenant grants, malformed edge/fixed authority, runtime/protocol mismatch, wrong durable tenant/adapter, and stale-fingerprint rejection before protected access. An Aphrodite compatibility case additionally proves runtime-only tenant, adapter, principal, parser, descriptor, and error-factory overrides cannot weaken the wrapper while registration replay, durable active-grant revalidation, product errors, and repeat-safe release remain compatible. All 315 shared tests, 195 passing plus one intentionally skipped adapter test, 108 passing plus one intentionally skipped Streaming test, 86 Broadcaster tests, 86 Veritas tests, and all 14 Phase A tests pass, together with eight strict source/spec/consumer typechecks, graph-aware lint for all six affected/guard projects, dependency-inclusive shared (+6), adapter (+13), Streaming (+14), and Broadcaster (+16) builds, formatting/diff checks, and the supervised real MediaMTX/PostgreSQL/SoftHSM/FFmpeg/Chromium gate. The real native-SRT publisher path exercises the reconstructed wrapper from registration through exact authenticated edge binding, positive client/ingress evidence, execution, restart replay, forced-RLS sibling denial, and final release; the same gate retains the browser-WHIP publisher and broader protected-media assertions. This does not claim deployed Veritas/V3/Rail publisher providers, stores, edge integrations, or client runtimes; ready non-Aphrodite HLS/DASH, playback grants, decoded Rail playback, final tenant equivalence, and a first-party-live flip remain open. Increment 8u extracts host registration, one-use invitation exchange, signaling authority, reciprocal transport-evidence admission, synchronous provider execution, query, and repeat-safe release as LiveMediaTenantRemoteGuestControl. It validates and fixes one tenant, adapter, service principal, and credential-free secure WebSocket base; generates operation/session identities and raw capabilities internally; owns the compatible canonical registration and exchange fingerprints, readiness scope, digest-only queue boundary, two-sided role-correct evidence gate, durable success/release checks, and tenant-fixed signaling claims; and reparses every returned record to reject a wrong tenant, stream, adapter, operation/session/grant/client identity, or fingerprint before returning a descriptor or invoking downstream authority. AphroditeRemoteGuestControl is now a thin tenant-#1 wrapper retaining its constructor and session aliases, exact product errors, forced-RLS PostgreSQL queue, active publisher-grant binding, one-use secret rotation, WebSocket hub, leasing/fencing provider, Broadcaster routes, and two-browser WebRTC runtime. It fixes the Aphrodite tenant, adapter, principal, parser, descriptor, and error factory after caller options are spread; both legacy fingerprints delegate to the shared canonical implementations. Three direct shared tests drive one real optional-adapter service with independent Veritas/V3 providers and tenant queue views over one record map using equal stream, grant, operation, session, host/guest client, invitation, signaling, evidence, and request identities. They prove queue, fingerprint, scope, verifier, provider, signaling, evidence, result, query, and release isolation plus replay rotation, malformed fixed authority, role mismatch, cross-tenant signaling, wrong durable authority, and stale-fingerprint rejection. An Aphrodite compatibility case additionally proves runtime-only tenant, adapter, principal, parser, descriptor, and error-factory overrides cannot weaken the wrapper while the exact product error survives. All 318 shared tests, 196 passing plus one intentionally skipped adapter test, 6 remote-guest compatibility tests, 108 passing plus one intentionally skipped Streaming test, 86 Broadcaster tests, 86 Veritas tests, and all 14 Phase A tests pass, together with eight strict source/spec/consumer typechecks, graph-aware lint for all seven affected and guard projects, dependency-inclusive shared (+6), adapter (+13), remote-guest compatibility (+7), Streaming (+14), and Broadcaster (+16) builds, formatting/diff checks, two single-worker Chromium desktop/ mobile scenarios, and the supervised real MediaMTX/PostgreSQL/SoftHSM/ FFmpeg/Chromium gate. The real gate exercises reconstructed Aphrodite registration replay and capability rotation, invitation exchange, exact signaling, reciprocal proof, restart replay, forced-RLS sibling denial, durable SDP/ICE/raw-secret non-disclosure, lease recovery and stale fencing, and repeat-safe release; the browser gate independently proves reciprocal media, accessibility, mobile/reduced motion, third- participant denial, credential containment, and teardown. This does not claim deployed Veritas/V3/Rail guest providers, stores, publisher-grant integrations, signaling gateways, or browser/native runtimes; SFU/MCU, TURN availability, multi-node signaling, ready non-Aphrodite HLS/DASH, playback grants, decoded Rail playback, final tenant equivalence, and a first-party-live flip remain open. Increment 8v extracts protected- browser-player registration, descriptor/client admission, privacy- bounded render-evidence observation, synchronous optional-provider execution, and repeat-safe release as LiveMediaTenantImmersiveSessionControl. It validates and fixes one tenant, immersive adapter, and service principal; reparses the active player request and its canonical fingerprint; binds exact tenant, stream, viewer session, grant/operation, publication, browser client, lifecycle, descriptor, and capabilities before readiness or queue access; owns the compatible canonical immersive fingerprint and exact evidence-to-request gate; and rejects a mismatched durable resource, adapter, operation/session/grant identity, or fingerprint before provider execution or teardown. AphroditeImmersiveSessionControl is now a thin tenant-#1 wrapper retaining its constructor and operation alias, exact product errors, forced-RLS PostgreSQL player/immersive stores, lease/fencing provider, Viewer routes/runtime, timing/ID seams, and bounded browser renderer. It fixes Aphrodite tenant, adapter, principal, parser, descriptor, and error authority after caller options are spread; its legacy fingerprint delegates to the shared canonical implementation. Three direct shared tests drive one real optional- adapter service with independent Veritas/V3 providers and tenant queue views over one record map using equal stream, publication, session, grant/operation, client, evidence, and request identities. They prove player, queue, fingerprint, scope, verifier, provider, evidence, result, and release isolation plus malformed fixed authority, cross-tenant and stale player records, unsupported native runtimes, capability mismatch, evidence mismatch, wrong durable authority, and stale-fingerprint rejection before protected access. An Aphrodite compatibility case additionally proves runtime-only tenant, adapter, principal, parser, descriptor, and error-factory overrides cannot weaken the wrapper while wrong-operation and released-replay product errors remain exact. All 321 shared tests, 197 passing plus one intentionally skipped adapter test, the full Viewer target, 108 passing plus one intentionally skipped Streaming test, 86 Veritas tests, and all 14 Phase A tests pass, together with eight strict source/spec/consumer typechecks, graph-aware lint for all six affected and guard projects, dependency-inclusive shared (+6), adapter (+13), and Streaming (+14) builds, the direct Viewer production build, formatting/diff checks, two single-worker real Chromium immersive scenarios, and the supervised MediaMTX/PostgreSQL/ SoftHSM/FFmpeg/Chromium gate. The real gate exercises the reconstructed Aphrodite wrapper from the exact succeeded protected player through compatible registration, privacy-bounded render/audio/orientation evidence, execution, restart replay, recovery/fencing, forced-RLS sibling denial, and release while retaining the wider protected-media assertions. This does not claim deployed Veritas/V3/Rail immersive providers, stores, player integrations, or client runtimes; native OpenXR/visionOS and real-headset WebXR conformance, ready non-Aphrodite HLS/DASH, playback grants, decoded Rail playback, final tenant equivalence, and a first-party-live flip remain open. Increment 8w extracts exact browser-publisher composition registration, bounded render-evidence admission, synchronous optional-provider execution, query, publisher-cascade release, and repeat-safe direct release as LiveMediaTenantCompositionControl. It validates and fixes one tenant, composition adapter, publisher-client adapter, and service principal; requires the exact unexpired succeeded browser/WebRTC publisher request and canonical fingerprint before readiness or reservation; owns the compatible one-to-four-source registration schema and canonical composition fingerprint; and reparses every reserved, staged, queried, publisher-selected, succeeded, and released record. Evidence must match the exact composition/client/runtime/layout/ordered sources/output before queue mutation, while provider results and teardown responses must name the fixed tenant/resource, adapter, kind, operation, and provider reference before a matching durable terminal record is accepted. AphroditeCompositionControl is now a thin tenant-#1 wrapper retaining its constructor, schema/type exports, exact product errors, forced-RLS PostgreSQL composition and publisher stores, independent edge-evidence join, leasing/fencing provider, Broadcaster routes/runtime, timing/ID seams, and Canvas/Web Audio compositor. It fixes Aphrodite's tenant, both adapters, principal, parser, descriptor, and error factory after caller options are spread; its legacy fingerprint delegates to the shared canonical implementation. Three direct shared tests drive one real optional-adapter service with independent Veritas/V3 providers and tenant queue views over one record map using equal stream, grant, operation/composition, client, evidence, and request identities. They prove publisher, queue, fingerprint, scope, verifier, provider, evidence, result, query, and release isolation plus malformed fixed authority, cross-tenant/stale/expired/inactive publisher records, evidence mismatch, wrong durable authority, stale fingerprints, and wrong provider/teardown identity rejection. An Aphrodite compatibility case additionally proves runtime-only tenant, adapters, principal, parser, descriptor, and error-factory overrides cannot weaken the wrapper while released replay retains the exact product error. All 324 shared tests, 198 passing plus one intentionally skipped adapter test, the complete Broadcaster and Streaming targets, 86 Veritas tests, and all 14 Phase A tests pass, together with eight strict source/spec/ consumer typechecks, graph-aware lint for all six affected and guard projects, dependency-inclusive shared (+6), adapter (+13), Streaming (+14), and Broadcaster (+16) builds, formatting/diff checks, three single-worker real Chromium composition scenarios, and the supervised MediaMTX/PostgreSQL/SoftHSM/FFmpeg/Chromium gate. The real gate exercises the reconstructed Aphrodite wrapper from the exact succeeded WHIP publisher through compatible registration, independently joined edge proof, privacy-bounded render/audio evidence, execution, restart replay, recovery/fencing, forced-RLS sibling denial, and repeat-safe release while retaining the wider protected-media assertions. This establishes reusable composition lifecycle authority, not deployed Veritas/V3/Rail composition providers, stores, publisher integrations, or client runtimes. Custom layouts, transitions/switching, GPU/OBS/native or distributed mixing, ready non-Aphrodite HLS/DASH, playback grants, decoded Rail playback, final tenant equivalence, and a first-party-live flip remain open. Increment 8x extracts entitlement- to-lease-to-grant orchestration, authenticated viewer mutations, optional player/immersive lifecycle sequencing, presence validation, and compensating lease cleanup as LiveMediaTenantProtectedPlaybackControl. It validates and fixes one tenant, player adapter, immersive adapter, and identity-denial result; parses bounded join inputs and product-supplied entitlement decisions; requires exact tenant/stream/subject/decision/client authority from joined and heartbeated viewer leases; and requires exact tenant, stream, publication, subject, and session authority from issued grants before optional client access. Player and immersive results must retain the fixed adapter, grant/operation identity, runtime/protocol or render geometry, and lifecycle status; leave and presence results must retain the authenticated fixed resource. Downstream grant or lifecycle failure compensates the already joined lease without replacing product policy. AphroditeProtectedPlaybackControl is now a thin tenant-#1 wrapper that preserves its positional constructor, public result/input/lifecycle types, methods, denial reasons, entitlement and identity policies, viewer and playback services, optional providers, Viewer routes, and Streaming real-edge composition while fixing Aphrodite and both adapter identities. Three direct shared tests use independent Veritas/V3 policies, sessions, issuers, and lifecycle ports with equal user, stream, publication, decision, session, grant, and evidence identities. They prove issue/heartbeat/immersive/leave/presence isolation plus malformed entitlement, cross-tenant session/grant, wrong player or immersive adapter, missing principal, mismatched heartbeat/presence, downstream-access ordering, compensation, and optional-adapter denial. An Aphrodite compatibility case proves the positional wrapper rejects a sibling-tenant grant or player result and retains compensating cleanup. All 327 shared tests, 199 passing plus one intentionally skipped adapter test, the complete Viewer target, 108 passing plus one intentionally skipped Streaming test, 86 Veritas tests, and all 14 Phase A tests pass, together with strict source/spec/consumer typechecks, graph-aware lint for all six affected and guard projects, dependency-inclusive shared (+6), adapter (+13), and Streaming (+14) builds, the direct Viewer production build, formatting/diff checks, 12 single-worker Chromium HLS/DASH player and immersive scenarios, and the supervised MediaMTX/ PostgreSQL/SoftHSM/FFmpeg/Chromium gate. The real gate exercises the reconstructed Aphrodite wrapper from SQL entitlement through exact leased session and protected grant, player registration/QoE, immersive registration/evidence, restart/recovery and RLS assertions, and final release while retaining the broader protected-media suite. This establishes reusable protected-playback orchestration, not shared product entitlement rules or deployed Veritas/V3/Rail policies, issuers, sessions, providers, ready HLS/DASH, decoded Rail playback, final tenant equivalence, or a first-party-live flip. Increment 8y closes the next edge-identity prerequisite exposed by the Veritas tenant audit. The shared SQL authority was already (tenant, stream UUID), but MediaMTX path discovery still treated a bare stream UUID as globally unique. @oshun/live-media now owns the versioned live-media.v1/<tenant>/<stream UUID> codec, and the MediaMTX provider defaults to that canonical tenant/resource path. It filters a sibling tenant even when both tenants use the same stream UUID, rejects malformed paths inside its owned namespace, and accepts bare UUIDs only through an explicit legacy-stream-id compatibility mode. Every current Aphrodite provider composition opts into that legacy mode rather than receiving it implicitly; external-auth and lifecycle-hook routes dual-read canonical Aphrodite paths plus legacy UUIDs while rejecting a canonical sibling tenant path before durable state access. Veritas rehearsal contracts are versioned to .2 and separate the product source ID from the substrate resource UUID; request/receipt authority now binds the exact Veritas resource, canonical media path, publication UUID, and canonical publication-specific HLS/DASH manifest paths. Equal-ID cross-tenant, legacy opt-in, malformed namespace, cross-resource, cross-path, and cross-publication adversarial coverage passes. All 328 shared tests, 108 passing plus one intentionally skipped Streaming test, 92 Veritas tests, and all 14 Phase A/consolidation tests pass, together with strict shared, shared-spec, Streaming, and Veritas typechecks; lint for all three affected projects; dependency-inclusive shared (+6) and Streaming (+14) builds; formatting/diff and stub checks; and the supervised real MediaMTX/PostgreSQL/SoftHSM/FFmpeg/Chromium gate. The real gate confirms the explicitly selected Aphrodite legacy path remains compatible; this increment does not claim that Aphrodite publishing has migrated to the canonical path or that Veritas/V3/Rail publishers, ready media, playback grants, decoded Rail playback, final tenant equivalence, or the first-party-live flip exist. Increment 8z extracts the production pipeline assembly itself. The server-only createLiveMediaPipelineRuntime fixes one tenant and constructs the durable job service, execution service, publication service, attempt executor, and fenced worker once from product-supplied stores and media adapters. Aphrodite production and real-gate restart compositions now use that shared factory without changing their public controls or deployment adapters. Direct tests run the same factory for Aphrodite, Veritas, and V3 Stage with an equal stream UUID and idempotency key, proving isolated ready HLS/DASH publications and immutable prefixes; hostile worker options cannot replace the fixed tenant. The supervised gate simultaneously publishes the equal UUID through Aphrodite's explicit legacy path and Veritas's canonical tenant path, proves provider isolation and decodes canonical Veritas edge HLS, durably registers the Veritas resource in PostgreSQL, and uses shared forced-RLS SQL stores plus the generic worker and real Neith/FFmpeg adapter to transcode that live RTSP source, persist a ready Veritas HLS/DASH publication, and independently decode both stored manifests. All 330 shared tests, 108 passing plus one intentionally skipped Streaming test, 92 Veritas tests, all 14 Phase A tests, focused typechecks/lint/builds, formatting/diff checks, and the real MediaMTX/PostgreSQL/SoftHSM/FFmpeg/ Chromium gate pass. This establishes one reusable production-shaped assembly and canonical Veritas ingest-to-ready-media evidence, not the rehearsal-to-runtime wiring, deployed durable Veritas publisher grants, Veritas viewer/playback grants, decoded Rail playback, V3 production composition, Aphrodite canonical-path migration, final equivalence, or the first-party-live flip. Increment 8aa connects the audited Veritas rehearsal byte port to that shared runtime. A strict root contract and server-only LiveMediaTestIngestRuntime bind exact tenant/resource, length, SHA-256, one-MiB chunks, and a 64-MiB ceiling; fsync and retain a read-only content-addressed MPEG-TS input; drive only an isolated queue for the fixed tenant; and return its exact successful durable publication. Replays reuse the durable job/publication, while tenant, path, integrity, or queue violations fail closed. A thin Veritas adapter reparses the v2 request, binds the canonical Veritas path, fixes the bounded H.264/AAC 360p job, and maps only exact HLS/DASH keys at a credential-free test HTTPS origin into the existing frozen v2 receipt. The supervised gate generates real MPEG-TS bars/audio, passes them through the actual rehearsal pipeline and shared SQL Veritas runtime, runs real Neith and FFmpeg transcode plus HLS/DASH publication, and independently probes both stored manifests for H.264/AAC 640x360 media and positive duration. All 332 shared tests, 108 passing plus one intentionally skipped Streaming test, 94 Veritas tests, and all 14 Phase A tests pass with affected typecheck, lint, builds, frozen-lockfile validation, and the real MediaMTX/PostgreSQL/SoftHSM/FFmpeg/Chromium gate. This closes the rehearsal-to-runtime byte wiring only: the bridge remains synchronous, test-only, and isolated-queue-only. Deployed Veritas publisher grants and scheduling, viewer/playback grants, decoded Rail playback, V3 production composition, Aphrodite canonical-path migration, final equivalence, HG-3, and the first-party-live flip remain open. Increment 8ab replaces the real gate's process-local Veritas publisher credential with product-composed durable authority. The canonical root now exposes the injected tenant-fixed grant control without exposing server stores; VeritasProductionPublisherGrantControl fixes tenant veritas, owner veritas, and the immutable v1.veritas-live registry identity after all caller options. Its API accepts only principal and stream UUID while create/manage scopes, registration, authentication, rotation, and revocation remain inside the shared control. Direct Veritas tests prove exact delegation and reject hostile tenant/product/mapping options plus malformed stream identity. The supervised MediaMTX gate now issues through the Veritas wrapper into the forced-RLS PostgreSQL registry and publisher-grant stores, reconstructs the wrapper before publishing, rejects an unknown valid-shaped secret, authenticates a real FFmpeg SRT publisher on the canonical tenant path, decodes its edge HLS, and reconstructs the database client, stores, service, and wrapper while retaining exact grant authentication. All 332 shared tests, 108 passing plus one intentionally skipped Streaming test, 96 Veritas tests, and all 14 Phase A tests pass with affected typechecks, lint, builds, frozen-lockfile validation, formatting/diff checks, and the real MediaMTX/PostgreSQL/SoftHSM/FFmpeg/Chromium gate. This closes durable Veritas publisher-grant composition and real edge authentication at the code and local release-gate boundary, not a deployed long-running publisher/scheduler host. Scheduling, viewer/playback grants, decoded Rail playback, V3 production composition, Aphrodite canonical-path migration, final equivalence, HG-3, and the first-party-live flip remain open. Increment 8ac adds tenant-fixed Veritas viewer-session, playback-grant, and protected-playback controls; fixed authority fields include tenant/service principals, veritas.player-client.v1, veritas.immersive.v1, and bounded identity denial. The Rail gate can now accept exact HLS/DASH behind one explicit shared-media authority while its exported default stays fail-closed. Channel registration, lane admission, and the web player use that same authority ID, and the canonical browser player revalidates tenant, stream, protocol, API base, and manifest before credentialed playback. The supervised gate carries generated rehearsal bytes through the real Veritas SQL publication, signs a viewer-bound grant, mounts the actual Rail panel in Playwright-controlled Chromium, decodes both HLS and DASH with positive QoE, and proves presence, explicit lane release, zero presence, and immediate VIEWER_SESSION_INACTIVE token denial without placing the token in the DOM. This closes a local product-composed ingest-to-decoded-Rail slice, not deployment: the gate's player lifecycle remains test-only and in-memory; the default Rail composition has no authority; and no durable player adapter, playback-route host, long-running scheduler, V3 composition, Aphrodite canonical migration, final equivalence, HG-3, or production first-party-live flip is claimed. Increment 8ad migrates Aphrodite's production MediaMTX boundary from bare stream UUIDs to the canonical live-media.v1/aphrodite/<stream UUID> namespace. Broadcaster WHIP and native-SRT provisioning now carry that exact path; the shared browser policy binds authorization to the full tenant/resource WHIP suffix; the native TypeScript/Rust boundary validates and sends the canonical path; edge reconciliation, lifecycle callbacks, recording RTSP sources, and pipeline runtime composition agree on it. Separately shaped legacy RTMP and lifecycle callback bodies remain compatibility inputs, but a bare UUID in a MediaMTX path is rejected before grant lookup. Equal-ID sibling-tenant and bare-path adversarial coverage passes. The supervised real gate rejects a valid Aphrodite grant on a bare SRT path, then publishes, transcodes, records, composes, protects, and decodes Aphrodite and Veritas traffic through canonical tenant-qualified paths on the same edge. Affected shared, Aphrodite adapter, Streaming, and Broadcaster tests, four strict typechecks and lints, the Rust native publisher tests/build, dependency-inclusive builds, the 19-scenario single-worker Chromium gate, formatting/diff checks, and the supervised real-media gate pass. This closes Aphrodite's canonical-path migration, not deployment scheduling, durable Veritas player hosting, V3 production composition, final tenant equivalence, HG-3, or the production first-party-live flip. The parent RB.3 and equivalence-test checkboxes remain open. Increment 8ae adds the missing V3 Stage tenant-#3 product composition over the canonical shared-media controls. Pipeline jobs, publisher grants/resource mapping, leased viewer sessions, signed playback grants, and protected playback now fix tenant v3-stage, product-owned principals, the v3.stage:<stream UUID> external identity, Stage player/immersive adapters, and bounded identity denial after all injected options. Contract tests prove equal stream, job, publication, entitlement, and session identities remain isolated from a sibling Veritas tenant and hostile authority options cannot replace Stage ownership. The full Stage suite, strict typecheck, lint, dependency-inclusive build, Streaming regression checks, frozen-lockfile validation, formatting/diff checks, and the supervised real PostgreSQL/MediaMTX gate pass; the gate proves equal-ID durable Stage/Veritas resource and grant isolation plus reciprocal secret denial. This closes the V3 tenant-fixed authority composition only: no rendered artifact/catalog row, cook-to-Unreal binding, deployed scheduler/publisher/player host, final equivalence, or production first-party-live flip is claimed. The parent RB.3 and equivalence-test checkboxes remain open. Increment 8af now closes the cook's immutable-storage and public-delivery-verification portion. The tenant-fixed adapter writes only below live-media.v1/v3-stage/catalog/v1 through the canonical shared create-only object-store contract, admits a closed role/MIME matrix, applies bounded role sizes and immutable caching, and accepts an exact existing object only as an idempotent replay. It rechecks storage and then retrieves the exact credential-free HTTPS object with redirects disabled; HTTP status, content type, length, and SHA-256 must all match before a private transient-file ffprobe pass proves a positive-duration video/audio stream or decodable artwork dimensions. Unit coverage binds all three roles through the full cook and rejects changed-key bytes, role/MIME substitution, credentialed origins, and escaped receipts. A focused Streaming release gate generates real H.264/AAC MP4, AAC M4A, and PNG bytes with FFmpeg, persists them through the canonical local create-only store, retrieves their exact delivery bytes, decodes all three with real ffprobe, and publishes only to an in-memory test catalog. Those generated bytes are release-gate evidence, not a rendered V3 artifact. Increment 8ag now closes the cook's authoritative V3 release-evidence port. The dedicated @oshun/v10-rail-channel-stage/release entry point keeps V3 authoring/export dependencies out of the browser-facing channel root. V3StageRecordedReleaseGateAdapter consumes the actual Saraswati recorded-authoring editor state and V3 concert-export readiness types, fixes item/version/concert identity, and requires every recorded authoring gate, the published Sequencer receipt, full provenance attachment, and GA cadence to agree. Ready export reports must be fresh and retain unique exact-subject canonical proofs plus matching verdicts for every non-human gate. A suite that declares human signoff additionally requires the exact fresh promotion and canonical human_approval proof; drill evidence, stale/future reports, duplicate, expired, substituted, detached, or contradictory proof state fails closed. Contract coverage uses the real recorded Saraswati state builder and exercises drill denial, identity substitution, stale export, proof substitution, missing/hostile promotion, and forged readiness. This is a release adapter, not deployed content. Increment 8ah now closes the durable candidate/Calliope source code boundary. The canonical OSHUN PostgreSQL schema stores immutable, SHA-256-bound candidate revisions and admits only one current ready version through a partial unique index. Transactional publication accepts exact idempotent replay, requires increasing versions, supersedes the prior revision, and makes withdrawal terminal for that version; bounded reads revalidate every indexed identity and the full projection hash. The projection consumes the owning V3 persona/concert/setlist/track and Calliope setlist/camera/streaming schemas, requires recording authority, exact V3 track coverage and duration, a bijective title-preserving slot binding, shared Calliope identities, and a programming anchor present in all selected plans. Energy, section, and perspective derive from those plan values; numeric cut density requires a separately cited editorial measurement rather than parsing Calliope's prose cadence. Adversarial tests plus a disposable real-PostgreSQL full-migration, restart, supersession, and withdrawal gate pass. No production candidate row is seeded. Increment 8ai now closes the durable rendered-catalog writer/reader code boundary. Canonical OSHUN migration 20260721230000_v10_stage_rendered_catalog stores immutable, SHA-256-bound catalog revisions, admits only one active version, and fences identity or payload mutation in PostgreSQL. Transactional publication accepts exact replay, requires increasing version and publication time, supersedes the former active row, and makes explicit withdrawal terminal; bounded playback reads return only due active rows after rebinding every indexed identity and recomputing the full item hash. Unit/adversarial coverage plus a disposable full-migration, restart, direct-tamper, concurrent-retry, supersession, and withdrawal PostgreSQL gate pass. No production catalog row is seeded. An Unreal renderer code boundary and real local UE5.5 release gate are now closed by increment 8aj. The minimal headless worker loads the exact persisted level, published LevelSequence, and uniquely labeled CineCamera; a native compilation barrier waits for assets/material shaders and flushes rendering commands so black placeholder frames or shader-cancellation shutdown cannot pass. The server-only adapter rebinds candidate/version, concert, export hash, and Sequencer identity; supervises Unreal without a shell; verifies the exact contiguous PNG manifest, dimensions, hashes, variation, and declared file set; enforces pixel-frame and scratch-space budgets; copies digest-authorized audio into a private job; and requires real FFmpeg/FFprobe H.264/AAC geometry, rate, frame-count, stream, and duration evidence. Sixteen adversarial tests, the 79-test Stage suite, typecheck, and lint pass. On this box the editor module builds, an isolated test-only fixture renders 24 distinct 640x360 RGBA frames through UE5.5/Lavapipe with exit 0, and the full adapter's real FFmpeg/FFprobe gate passes in 12.79 seconds with cleanup. No production binding or inventory is seeded. Increment 8ak now closes final local four-tenant equivalence without creating a second media stack. The Oshun BFF owns thin tenant-#4 Rail pipeline, publisher-grant, viewer-session, playback-grant, and protected-playback controls over @oshun/live-media; hostile constructor options cannot replace the fixed tenant, principals, product mapping, player/immersive adapters, or bounded identity denial. One cross-product suite exercises Aphrodite, Veritas, V3 Stage, and Rail with equal stream/job identities, proves exact tenant-local pipeline scopes, reciprocal publisher-secret denial, independent leased presence, cross-tenant lease rejection, and isolated teardown. The 333 shared, 199 Aphrodite-adapter, 79 Stage, 98 Veritas, 21 Phase A, and four new BFF tests pass, as do the focused strict typecheck, lint, formatting, BFF production build, and the supervised real PostgreSQL/MediaMTX/SoftHSM/FFmpeg/Chromium Veritas-ingest-to-Rail HLS/DASH decode gate. A real first-party candidate, production binding and rendered artifact/catalog row, deployed hosts, and the production first-party-live default flip remain open. Increment 8al adds the actual Rail-app deployment composition: one credential-free public manifest binds exact source/tenant/stream/media/API authority, absence retains not_configured, hostile configuration fails closed, and the supervised real-media browser fixture now uses this production path. A focused desktop/mobile Playwright flow proves admission, authority identity, no autoplay, and release cleanup without fabricating decoded media. The production Next/PWA build and freshly rerun supervised real PostgreSQL/MediaMTX/SoftHSM/FFmpeg/Chromium ingest-to-decoded-Rail gate also pass with clean teardown. This closes client deployment wiring, not content or server deployment. Detailed evidence is in RB3_APHRODITE_STREAMING_SUBSTRATE_AUDIT.md.
• Consolidation guard: a dependency-check test (repo lint or a custom check) asserting no second streaming stack appears under libs/v10/* or apps/v10/* — the Rail consumes the substrate only. Implemented 2026-07-19 in the existing @oshun/v10-rail-phase-a invariant project. The real-workspace gate walks both V10 ownership roots without following symlinks or generated directories; parses package dependencies plus static, re-exported, import-equals, type, require, and dynamic imports; and inspects target-specific, renamed, and table-form Cargo dependencies. It permits only the @oshun/live-media contract and its browser/native client subpaths. V10-owned live-media/streaming/ingest/transcode package roots, canonical server/private subpaths, direct Aphrodite or Neith media control, direct browser media engines, @oshun/streaming, and native FFmpeg/GStreamer/WebRTC/SRT stacks fail with deterministic diagnostics. Six adversarial focused cases, all fourteen Phase A tests, strict typecheck, and the project lint gate pass.
• Tests: substrate unit/integration per organ; tenant equivalence suite; one full local end-to-end (test ingest → viewer playback in the Rail video lane). Completed locally 2026-07-22 by increment 8ak. The final cross-product suite covers all four tenant-fixed compositions and the supervised real-media gate carries generated Veritas MPEG-TS through the canonical durable HLS/DASH pipeline into decoded playback in the actual Rail panel, including viewer heartbeat/presence/QoE, credential containment, release, revocation, and teardown. The parent extraction remains open for deployment and production-content requirements, not for missing automated equivalence or local ingest-to-viewer coverage.

RB.4 Browser side-panel / PWA fallback surface (P1, §3.1)#

• Ship apps/v10/web standalone: PWA manifest + service worker (cold-cache tile rendering doubles as offline behavior), install flow, and a browser side-panel build target if the repo's extension patterns support it (there is an apps/oshun/clipper-extension — read it and reuse its side-panel approach if present). Completed and verified 2026-07-21: the static export now owns a standalone manifest, install UI driven only by a real browser prompt, revisioned same-origin shell precache with a 32 MiB build budget, and network-first offline navigation without caching or fabricating BFF account state. The existing Clipper extension has no side_panel pattern, so the supported narrow browser fallback is the PWA rather than a second extension surface. The production export is 2.95 MB across 37 cached assets; Chromium reports zero installability errors.
  • Honest capability matrix in-product: no tray, no always-on-top, no system screen-share detection — settings show these as shell-only with an install pointer (fail-loud, not silently absent). Startup now carries the cardless browser/desktop capability ledger, including service-worker registration state and an honest browser-menu fallback when no install event exists.
  • Keystroke discretion hide still works in-tab; getDisplayMedia self-share signal wired where available. The Privacy surface can start and stop its own display-media capture; only that Rail-initiated track is observed, its end keeps protection active pending explicit restore, and Escape remains immediate online and offline.
• Claude-in-Chrome pass over the PWA build (install, offline cold-cache, discretion). The named connector is unavailable in this environment, so this human/tool-specific sign-off remains open. Automated production Playwright covers the same installability, cache/offline, discretion, and self-share paths on desktop and mobile Chromium with accessibility checks (6/6 passing on 2026-07-21). 2026-09-18, reworded by the board audit: as for RA.4, the named connector is retired by CLAUDE.md in favour of Playwright. The 6/6 production Playwright run the note records is the sign-off; a second reader confirms it covers install, offline cold cache and discretion, and checks the box on that evidence.

RB.5 Mobile surface (P1, §3.1)#

• Read the existing mobile app structure (apps/oshun/mobile) and its BFF wiring conventions (the 2026-07-04 memory notes the composer pattern). Audited 2026-07-21: the implementation reuses the Expo Router shell, authenticated OshunBffClient, session/dev-token selection, domain route builder, web-anchor parity guard, channel manifests, RingPolicy, DaypartEngine, and MergedTimeline; no second mobile app or timeline composer was introduced.
• Rail-on-mobile inside the existing V1 mobile app (not a new app):
  • Timeline as a feed screen (batched drips, rollups, deep links into the products' mobile surfaces where they exist). Completed and verified 2026-07-22: the cardless native feed, runtime-validated mobile projection, humane daypart batching/rollups, V1/V3 internal routes, web fallbacks, auth, retry behavior, and bounded server-side time window now have a deployed BFF composition. server.ts resolves a fixed, bearer-authenticated channel-runtime read model for exact user/window drips; all-or-none boot configuration, strict versioned envelopes, cross-user/window rejection, a 2,000-event response bound, HTTP timeout, and route-side manifest/time filtering keep the boundary fail-closed. Unconfigured environments remain honestly quiet rather than fabricating a feed. Adapter plus route coverage passes 11/11, the focused strict TypeScript gate passes, and the production BFF bundle builds.
  • Micro-acts on the go (case pin, review cards, tendencies) reusing the act schemas. Quick acts are projected directly from canonical MicroActSpec manifests and Case Files pin plus Wonder Recall review launch through their declared deep-link fallbacks. Tendencies has no current channel manifest and is still owned by RC.2; executable native act handlers also remain open.
  • Second-screen mode for TV: the overlay companion (Veritas ticker) rendered full-screen against an external broadcast. Completed and verified 2026-07-22: the reduced-motion full-screen companion, live/idle states, trust meter, bounded claims, polling, and explicit exit consume the deployed BFF's configured Veritas runtime authority. The authority response is bearer-authenticated, schema/version validated through the canonical tracked-event parser, observation-time bound, and rejected if malformed or future-dated; an explicit null event alone produces the honest idle state. The mobile route still caps the rendered claim list at 24. Adapter plus route coverage passes 11/11, the focused strict TypeScript gate passes, and the production BFF bundle builds.
  • Per-surface availability enforced from the manifest matrix (adult ring structurally absent — R0.1 schema + payload filtering server-side in the BFF, not client-side hiding). The authenticated BFF projection applies RingPolicy to canonical manifests before serialization, then rejects malformed, non-mobile, adult, stale, and future drips. Contract refinement prevents timeline and second-screen channel escape; route tests prove the adult manifest and payload are structurally absent.
• Maestro flows for the new screens per repo e2e conventions (guard suites exist for route parity — extend them). Added to both core and regression suites with Home launch, feed, case pin, review, second-screen enter/exit, and accessibility selectors; Expo/web route parity guards cover both Rail routes. Maestro syntax and the platform command matrix pass. Native flow execution could not run on 2026-07-21 because this host exposes only Web Chromium (adb devices is empty and no iOS runtime is installed).

Phase RC — the game broadcast wave (P2, §11 Phase C)#

RC.1 Director cut profiles (§6.2 — developed against RB streams, lands here)#

Substrate: V4 broadcast/commentary pipeline and V5 broadcast-director + highlight ranker. Verify exact lib paths at task start (candidates found 2026-07-16: libs/neith/broadcast, libs/neith/vp-broadcast, libs/calliope/match-commentary, libs/uzume/broadcast; the 2026-07-14 V4/V5 audits are the ground truth for which pipelines are real).

• Locate and read the real director pipelines (V4 and V5); write the integration note mapping their cut-decision inputs/outputs.

• Implement the two cut grammars as data-driven profiles in the owning pipelines (same pipeline, two profiles — not a fork):

  • Ambient cut: wide shots, slow cut cadence, low-motion shot selection bias, commentary at murmur level or off.
  • Highlight cut: fast cadence, replay insertion, full commentary.
  • Profile switching by daypart transition (R0.3 events) and by user action; commentary loudness rides the audio-lane rules.

• Exercise against Phase B streams (Veritas/V3 Stage program content) before any game channel exists — a profile-switch demo over a real stream, verified visually.

• Tests: profile parameters demonstrably change cut decisions on a fixture match/event timeline (assert specific cut-cadence/shot-class deltas, not just "different").

  Evidence (2026-07-21): RC1_DIRECTOR_CUT_PROFILE_INTEGRATION.md records the source-level V4 replay/live-commentary and V5 live-director/ highlight-ranker inputs, decisions, outputs, trust gates, adapter mapping, and honest non-goals. @uzume/broadcast now owns one validated BroadcastDirectorCutProfileEngine and one physical BroadcastDirectorExecutionPipeline; the ambient/highlight records alter cadence, shot/motion scoring, transition, replay eligibility, and commentary targets without forking execution. Its full suite passes 12 files / 45 tests, including exact same-timeline deltas (ambient cuts at 0/12 s and selects only low-motion wides; highlight cuts every 3 s and selects tight/tracking/replay/ detail), real R0.3 DaypartEngine transitions, explicit user authority, registered replay playback, acknowledged switcher cuts, and commentary gain derived from a real AudioLaneArbiter holder/effective-loudness/user-volume state. The V10 web Stage exercise keeps the existing encoded progressive WebM mounted and playing while the real engine switches profiles; a sparse program monitor cue makes the selected wide/replay decision visible without claiming extra camera bytes. Playwright passes both cases on desktop and mobile Chromium (4/4), covering decode, exact profile/cadence/shot/commentary state, user switching, visual captures, accessibility, 44 px controls, overflow, no autoplay, and reduced motion. The full V10 web Vitest suite passes 35 files / 158 tests; both affected lint scopes, both source typechecks, and the Uzume library compile pass. The Uzume all-spec tsc remains stopped by four pre-existing union-narrowing errors in broadcast-switcher-integration-engine.spec.ts:107-110; Vitest compiles and executes that full suite successfully. Per the repository's <32 GiB hard gate, the Next production build was not run on this 15 GiB host without user approval.

RC.2 V2 Ghost Dojo League (§7.2 — announced destination, never gates the Rail)#

Substrate: libs/shakti/fighting-ruleset-bridge (the one working cross-domain game bridge). GATED: V2 cooked content — the review found zero cooked content; build the league so it is real the day fighters are, and do not register the channel until bouts are real.

• Read the fighting-ruleset-bridge and the V2 fight-sim state; write the integration note: what can actually simulate a bout headlessly today.

• RC.2.P1 (added 2026-09-18: the prerequisite RC2_GHOST_DOJO_HEADLESS_BOUT_INTEGRATION.md names and no tracker carried) Build the headless, tendency-driven bout in V2 that the league needs. In V2/ue (Unreal 5.5 is on the executing machine; run the editor as ueagent): a commandlet or headless target that loads two real cooked fighters and a legal bout environment, a deterministic ghost policy that turns persisted tendencies into both fighters' frame inputs for FV2SimWorld, and the normal move, collision and round authorities run to a match outcome with nothing injected or preselected. Verify: the same seed, content version and tendencies reproduce the same result hash twice; changing one tendency changes a measured behaviour by a tested delta; the run is recorded with the exact Unreal command. If no fighter is cooked yet, the first step is to cook two — that is work, not a blocker. The cooked fighters, the stage and the headless bout are tasks V2.VS.2 to V2.VS.5 of V2/V2_TODOS.md section 0; this item adds the tendency-driven ghost policy on top of them.

• Persistent league service (progresses without you — the property is the product): 2026-09-18, board tag: waits on RC.2.P1, the headless tendency-driven bout. blocked:upstream

  • League model: ladders, seasons, seeding, scheduling of bouts across the day; ghosts fight via the real ruleset bridge simulation (no canned results — if headless bout simulation isn't runnable yet, the league stays unshipped; that is the gate). 2026-09-18, board tag: waits on RC.2.P1, the headless tendency-driven bout. blocked:upstream
  • Ghost tendency model: user-tunable parameters that demonstrably alter simulated bout behavior (assert in tests). 2026-09-18, board tag: waits on RC.2.P1, the headless tendency-driven bout. blocked:upstream
  • Rival/upset detection over real results for drip generation. 2026-09-18, board tag: waits on RC.2.P1, the headless tendency-driven bout. blocked:upstream

• Channel adapter libs/v10/rail-channel-ghost-dojo: 2026-09-18, board tag: waits on RC.2.P1, the headless tendency-driven bout. blocked:upstream

  • Tile: record, rank, next bout. Drip: results, upsets, rival callouts. 2026-09-18, board tag: waits on RC.2.P1, the headless tendency-driven bout. blocked:upstream
  • Micro-acts: adjust tendencies, scout next opponent, call the outcome — stakes: 'points-only' enforced by R0.6's guard. 2026-09-18, board tag: waits on RC.2.P1, the headless tendency-driven bout. blocked:upstream
  • Video lane: auto-commentated bouts through RC.1 profiles (ambient cut during work). Live moment: your ghost's final. Spectator face: the featured league. 2026-09-18, board tag: waits on RC.2.P1, the headless tendency-driven bout. blocked:upstream

• Tests: league progression determinism from a seed; tendency sensitivity; points-only guard on the prediction act; drip generation from real result streams. 2026-09-18, board tag: waits on RC.2.P1, the headless tendency-driven bout. blocked:upstream

• Marketing it from Phase A is human gate HG-4, tracked once in §HG below (this line was a second box for it until 2026-09-18).

  Gate evidence (2026-07-22): RC2_GHOST_DOJO_HEADLESS_BOUT_INTEGRATION.md records the source-level audit. The Shakti bridge is an authoring-time frame-data transform, not a runtime simulator. V2's real FV2SimWorld can deterministically step supplied inputs, resolve supplied collision events, snapshot, hash, and replay the 200-manifest golden corpus. No current path turns tendencies into both fighters' inputs, derives runtime collisions, runs rounds to an authoritative winner, or loads real fighter/stage content. The named BotHarness only validates and hashes scripted action records, while CombatBot computes authored damage-minus-armor arithmetic without invoking FV2SimWorld; their referenced map, pawn, scripts, models, and input files are absent. V2/ue/Content has eight regional data assets, zero maps, and no cooked packages. The local UE 5.5 focused golden-corpus run was attempted as ueagent, but test discovery is blocked by an installed editor/EOS module build-ID mismatch documented in the note. Per the explicit no-canned-results rule, the league, channel registration, tests premised on real results, and mobile tendency act remain unchecked until the note's reopen criteria are met.

RC.3 V7 Realm Surf + My Realm (§7.7 — creator tile first)#

Substrate: libs/maya/crucible-* incl. crucible-live; Mawu economy sim (real per 2026-07-14 audit). GATED: network runtime for public realm broadcast; the creator face is NOT gated and leads.

• Read the Mawu economy sim + crucible-live APIs; integration note: what overnight economy simulation actually produces per realm.

• RC.3.P1 (added 2026-09-18: the prerequisite RC3_MY_REALM_ECONOMY_INTEGRATION.md names and no tracker carried) Give V7 the realm-overnight authority My Realm reads: a versioned projection built from the authoritative Moremi, Nephthys and Abundantia event sequences (visitors, sales, inventory effects, incidents) with stable cursor and window reads; creator ownership and entitlement checks; and idempotent, persisted collaboration, price and governed-patch commands with optimistic concurrency and receipts. Verify: a harness advances a known realm night, reads the projection, runs each command, restarts the authority and observes the committed changes.

• My Realm (creator/player face — the shopkeeper's back-office glance): 2026-09-18, board tag: waits on RC.3.P1, the V7 realm-overnight authority. blocked:upstream

  • Tile: your realm's overnight ticker (visitors, sales, sim events) from real economy-sim output. 2026-09-18, board tag: waits on RC.3.P1, the V7 realm-overnight authority. blocked:upstream
  • Drip: notable sim events (sell-outs, visitor spikes, incident flags). 2026-09-18, board tag: waits on RC.3.P1, the V7 realm-overnight authority. blocked:upstream
  • Micro-acts: approve a collab, adjust a price, greenlight a patch — each writing back to the real realm state through the governed crucible paths. 2026-09-18, board tag: waits on RC.3.P1, the V7 realm-overnight authority. blocked:upstream

• Realm Surf (spectator face) — GATED: network runtime + vendor-wired safety: channel-surfing live windows into UGC realms via crucible-live once the runtime exists; safety wall: vendor-wired moderation precedes any executable UGC in the video lane (fail-closed — no safety config, no surf). 2026-09-18, board tag: waits on RC.3.P1 and the crucible-live network runtime, and on a moderation vendor being contracted and configured, which is the owner's to arrange. blocked:upstream blocked:external

• Tests: ticker reflects real sim deltas (assert against a simulated night's known outputs); micro-act writebacks round-trip; surf path fail-closed without safety config.

  Gate evidence (2026-07-22): RC3_MY_REALM_ECONOMY_INTEGRATION.md records the source-level Crucible and adjacent V7 authority audit. The real Crucible core currently produces deterministic game-balance outcomes, agent stats, generic team resource snapshots, event logs, and state hashes; its economy loop emits equal resource_tick gains and does not model realms, visitors, listings, sales, inventory depletion, incidents, or overnight windows. crucible-live analyzes supplied balance telemetry rather than streaming or simulating realms. Moremi, Nephthys, Abundantia, Eunomia, and the Mawu gateway contain substantial ledger, persistence, commerce, governance, gateway, and safety primitives, but the runnable Abundantia and Eunomia services expose only health routes, Nephthys is an in-process API, and no authenticated realm projection or persisted collaboration/price/patch command contract exists. Per the no-canned-data and round-trip requirements, My Realm and Realm Surf remain unregistered and their dependent items stay unchecked until the note's explicit reopen criteria are met. 2026-09-18, board tag: waits on RC.3.P1, the V7 realm-overnight authority. blocked:upstream

RC.4 V5 Period Channel (§7.5 — newspaper + radio before world windows)#

Substrate: V5 persona/daily systems + broadcast-director (real per audit; libs/uzume/* — verify at task start), V8 case engine for the Mind Palace layer.

• Read the V5 simulation/persona/daily systems; integration note: what the world-sim actually produces daily that a newspaper can be compiled from.

• RC.4.P1 (added 2026-09-18: the prerequisite RC4_PERIOD_DAILY_SIM_INTEGRATION.md names and no tracker carried) Give V5 the daily event stream the newspaper compiles from: a persisted, versioned, per-save stream of committed outcomes with a cursor and state hash; a read boundary that returns a complete in-game day or fails loud; editorial eligibility and public-safety metadata per event class; and a TTS render receipt for sim-derived bulletins. Radio cue ids must resolve to playable, rights-cleared assets, which is the one part an agent cannot supply. Verify: an integration fixture advances a known period day and proves the exact events, their order and the issue-to-state provenance.

• Daily newspaper: procedurally real — compiled from what actually happened in the simulation (sim event log → editorial selection → layout), as drip (headlines) + a readable issue (tile deep-link). No Lorem-ipsum, no canned stories: if the sim isn't producing events, the paper doesn't print (fail-loud). 2026-09-18, board tag: waits on RC.4.P1, the V5 daily event stream. blocked:upstream

• Diegetic period radio in the audio lane: program compiled from the period-audio assets + sim-derived interstitials (news bulletins read from the newspaper pipeline via the real TTS path); an audio-lane holder like Motion. 2026-09-18, board tag: waits on RC.4.P1, and its cue ids must resolve to rights-cleared period audio that does not exist yet. blocked:upstream blocked:corpus

• Mind Palace slow-drip case: a V5-flavored case cooked on the V8 engine (RA.5 pipeline parameterized by V5 setting/cast data) dripping over days instead of hours. Implemented 2026-07-22 in the existing governed @oshun/v10-case-files-cook: a strict V5 snapshot contract binds real cast and setting records into the V8 canon/spec before Clew generation, and required geography now reaches ground truth. The unchanged Minos + DPLL + finite-domain CSP + G4–G8 + Daedalus + Ed25519 path emits a signed 3–14-day schedule. End-to-end and file-backed CLI tests prove six source cast members, four source locations, multi-day evidence, DST-stable local accusation time, eight green gates, and receipt verification.

• World windows (slow TV): GATED: the world shipping — streets/ harbor/trains ambient-cut windows via RC.1 + RB.3 when render/runtime exists. 2026-09-18, board tag: waits on the V5 world runtime and render source the gate document names; no V5 tracker item produces it yet. blocked:upstream

• Channel adapter + tests: newspaper compiles deterministically from a fixture sim-day with correct editorial selection; radio program validity; case drip pacing.

  Gate evidence (2026-07-22): RC4_PERIOD_DAILY_SIM_INTEGRATION.md records the source-level V5 audit. V5's real systems can advance the day clock, resolve an NPC schedule at a supplied time, evaluate a route crossing, close a period case with one deterministic headline, describe twelve planned Year-1 world events, and select descriptor-only radio segments. They do not persist or expose a complete per-save daily outcome log: schedule state is caller-supplied, the world-event records are authored plans rather than settlements, and a case headline is not an issue. Radio cue IDs have no checked-in audio media, the 18 station loops remain open in the V5 ledger, and bulletin injection accepts text but does not produce a TTS/audio receipt. Per the fail-loud/no-canned-story rule, the newspaper, derived radio, channel, and source-dependent tests remain unchecked until the note's reopen criteria are met. The independent V5-to-V8 slow-case adapter is now complete; world windows retain their explicit shipping gate. 2026-09-18, board tag: waits on RC.4.P1, the V5 daily event stream. blocked:upstream

RC.5 V4 Match Channel (§7.4)#

GATED: V4 game launch. Substrate: V4 commentary/broadcast pipeline with its consent/bias gates evidence-gated fail-closed (audit 2026-07-14) — those gates are a feature for public broadcast and must stay in the path.

• Channel adapter for the 24/7 auto-directed match channel: RC.1 profiles × RB.3 substrate × the V4 pipeline; esports events as scheduled live moments + watch parties (RD.2).

• Player face: your squad's persistent campaign ticking between sessions (tile + drip from the real campaign sim).

• Tests: the consent/bias gates remain in the broadcast path (a gate-removed configuration must fail closed); profile switching on daypart.

  Gate evidence (2026-07-22): RC5_V4_MATCH_CHANNEL_INTEGRATION.md records the source-level launch, spectator, commentary, consent, and campaign audit. The new @oshun/v10-rail-channel-v4-match activation boundary has no permissive gate defaults: missing/failed consent or Calliope bias/quality authority, partial/stale participant review, any opt-out, incomplete personal-voice receipts, contradictory clearance, absent launch evidence, and non-live/cross-tenant media all fail closed before a manifest exists. Ten focused tests exercise those failures and real R0.3 daypart profile switching. The 24/7 channel remains unchecked because V4's launch is 2026-10-01, its checked-in spectator portal synthesizes fixture telemetry and has no media segments, and no v4-match RB.3 tenant exists. The player face also remains unchecked: current V4 persistence saves supplied state and campaign completion, but no authority advances a squad between sessions. The note lists exact reopen criteria.

Phase RD — rings and satellites (P3, §11 Phase D)#

RD.1 Watch surface (§3.1)#

• Read the existing watch companions (2026-07-03 memory: native watchOS + WearOS with phone bridge) and extend: ONE tile (the user's chosen channel) + haptic-gentle live-moment alerts (grant-3 moments only), honoring the availability matrix (no adult ring, structurally).
• Text-only tile payloads reuse textOnlyDegradation verbatim.
• Tests per existing watch test conventions; bridge payload contract test. Implemented in the canonical v10.watch-rail.1 contract, existing phone bridge, native watchOS/Wear OS codecs, cached one-channel surfaces, and the single Wear OS Rail tile. The ring type is structurally wellness or games only; alert payloads are structurally granted/effective-3 only and native haptics deduplicate while respecting disabled haptics and quiet hours. Contract/bridge/native parity coverage and host constraints are recorded in V10/RD1_WATCH_SURFACE_INTEGRATION.md.

RD.2 TV / cast surface + watch parties (§3.1, §6.2)#

• Video lane full-screen on TV/cast (second-screen pairing from mobile — RB.5's mode is the remote); read existing cast infrastructure if any before building.
• Watch parties: shared sessions on the RB.3 substrate's chat organ (V3 Stage concerts and V4 esports as the content); adult ring excluded (R0.6 wall); synced playback state.
• Human gate HG-5, tracked once in §HG below (this line was a second box for it until 2026-09-18): legal review of the moderation boundary for our chat next to docked third-party streams — until reviewed, watch-party chat is enabled only for first-party content (fail-closed default, enforced in code). The human review remains open. The pre-review boundary is now structural: third-party sessions contain no chat room, and the RB.3 bridge rejects them before resolving a tenant control.
• Tests: party session sync; ring exclusion; fail-closed third-party chat. Completed 2026-07-22. The full-screen progressive/HLS/DASH receiver, authenticated program authority, mobile pairing/remote, revisioned and idempotent shared playback, Stage/V4-only contract, pre-allocation adult exclusion, and exact-resource RB.3 chat bridge are documented in V10/RD2_TV_CAST_WATCH_PARTY_INTEGRATION.md. Focused contract/kernel/BFF, Stage, mobile, web, accessibility, Playwright, formatting, type, and production-bundle evidence is recorded there. HG-5 itself remains deliberately unchecked pending legal review.

RD.3 Aphrodite adult content ring (§7.10b, §9.1 — walled tenant)#

(HUMAN GATE HG-6 — policy/legal sign-off before any user-visible launch; build behind the wall.)

• Integrate Aphrodite's own age-verification service (libs/aphrodite/age-verification, apps/aphrodite/auth) as the verification assertion R0.6's opt-in path requires; flip that path from not_configured to real. Completed 2026-07-22: Aphrodite Auth now issues a strict, PII-free, short-lived assertion from its canonical age-verification decision table through a service-authenticated internal route. The BFF validates the shared contract, exact subject, HTTPS and bounded response before translating it into R0.6's V1 assertion; inactive decisions deny opt-in and configuration, storage, network, malformed-proof, and upstream failures all fail closed. The canonical service now requires bounded jurisdiction-adequate age evidence, a sufficient verification level, a single recorded-jurisdiction read, and correct webhook session lookup. Focused contract, age-service, Auth, BFF, kernel typechecks and 12 tests pass; the remaining channel/surface work stays behind HG-6.
• The channel: Aphrodite live content as a tenant of the RB.3 substrate (its own services already speak it post-extraction) inside the ring: separate brand identity end-to-end (distinct name/visual tokens — brand naming itself is part of HG-6), web/desktop only, private/wind-down dayparts only, discretion mode interlock (ring content cannot render with discretion unsupported or off — hard requirement). Completed behind the HG-6 wall 2026-07-22: @oshun/v10-rail-channel-aphrodite fixes the real RB.3 tenant, stream, publication, HTTPS HLS/DASH source, and exact v10.aphrodite.rb3-playback.v1 authority over the one canonical @oshun/live-media player. Its strict activator withholds the manifest unless exact adult access, surface, daypart, discretion, consent, body-dignity, aftercare, and shared-live-media gates all clear. The protected web surface requires a fresh entry gesture, collapses and destroys media on interlock loss, and exposes actionable stigma-free aftercare. Distinct near-black/warm-neutral/muted-consent tokens and the Private live label are explicitly hg6-pending; production registration remains prohibited until human naming/policy approval. Full architecture and evidence: RD3_APHRODITE_ADULT_RING_INTEGRATION.md.
• Verify every R0.6 wall clause against the real channel (directory, recommendations, Ori input exclusion, watch-party exclusion, cross-promo exclusion, surface matrix) — rerun the RA.9 fixture suite against the live manifest. Completed 2026-07-22: RA.9 now constructs the canonical Aphrodite live manifest rather than a hand-authored adult fixture and has independently named passing tests for the surface matrix, recommendations, default directory, Ori input, watch-party, cross-promotion, and daypart walls. Production unit and desktop/mobile browser coverage separately proves the pre-HG-6 channel remains absent from the shipped directory.
• Inherit and enforce Aphrodite's consent/aftercare/body-dignity constraints at the Rail surface (read those libs; surface their consent gates in the viewing flow, fail-closed). Completed 2026-07-22: activation consumes the canonical ViewerConsentManager and BodyDignity, denies inactive or paused sessions, viewer mismatch, pending warnings, missing per-trigger opt-in, or unsafe frames, and requires a strict exact-viewer/stream, post-observation, PII-free aftercare-readiness proof. The viewing flow surfaces cleared protections before entry and provides real support and return actions after immediate media teardown.
• Tests: one per wall clause against the real channel; age-verification round-trip; discretion interlock. Completed 2026-07-22: 100 focused Vitest assertions across the channel, Phase-A, kernel, web, BFF, Auth, and age-verification boundaries pass, plus 4/4 desktop/mobile Chromium flows with axe. Coverage includes exact-subject age assertion translation, every named wall clause, absent/wrong RB.3 authority, unsupported/off and screen-share discretion, live ready→held teardown, consent warnings and trigger opt-out, dignity rejection, aftercare failure/actionability, and production non-exposure. TypeScript, ESLint, Prettier, and frozen-lockfile checks pass; see RD3_APHRODITE_ADULT_RING_INTEGRATION.md.

RD.4 Calendar-aware dayparts (§6.3, §11 Phase D)#

• Implement the CalendarSource seam from R0.3 for real: calendar integration per repo conventions (locate existing calendar integrations in the monorepo first — read before building), meeting detection clamping to deep-work ceiling during events, focus-time respect, user-visible explanation of every automatic clamp.
• Tests: fixture calendars produce the expected daypart overrides; no-calendar-configured stays fail-loud/manual. Completed 2026-07-22: V1 now composes the existing per-user OAuth store and shared Google transport into a PII-free CalendarSource; active busy and focus-time intervals enforce canonical Deep work (ceiling 1, adult ineligible), focus time wins overlaps, and every automatic clamp has a local-time explanation. The authenticated BFF and connected web surface fail loudly to an explained persisted-manual posture for absent or unavailable calendars and hold ambient media while checking. Kernel, adapter, route, client, React, and production-surface Playwright fixtures cover clamps and failure states; see RD4_CALENDAR_AWARE_DAYPARTS_INTEGRATION.md.

Cross-cutting tasks (from §10 and §12)#

• X-1 Orphan reuse audit (§10): read the three flagged complete-but-uncited assets — libs/aphrodite/* game-bridge adapters, the Calliope stage spec (partly covered in RA.8), and Concordia (libs/oshun/concordia-integration and/or its own home — locate it) — and record a reuse verdict for each against Rail components; file follow-up tasks here for any adopted reuse.

  • X-1a Adopted reuse — Calliope Stage: retain Calliope's canonical setlist, camera, and streaming-plan schemas at the V3 Stage durable candidate boundary; never treat a plan as rendered or playable media. Completed by RA.8's direct @calliope/stage/contracts composition and exact-identity candidate validation.

    Evidence (2026-07-22): X1_ORPHAN_REUSE_AUDIT.md records the full source-backed inventory and verdicts. All six Aphrodite bridge packages are substantial but process-local Aphrodite game simulations, not production integrations, and are rejected for Rail reuse against their plausible Hathor/V5, Isis/media, Lilith/Tara, Maya/Realm, Nike/Motion, and Nyx/sky touchpoints. Calliope is the one adopted orphan and is already bound canonically by RA.8. Concordia's actual homes are libs/contracts/concordia, apps/concordia/orchestrator, the thin Oshun integration, and the existing workbench; its mediation authority does not overlap a current Rail component, so it is not adopted. The six bridge targets pass 679 tests total; @calliope/stage and @oshun/concordia-integration test targets also pass.

• X-2 Consolidation guards (§10): automated checks (lint rule or dependency-check tests) that (a) only @oshun/content-signing is used for signing across all rail-* code, (b) no duplicate channel-contract types exist outside libs/contracts/src/v10, (c) RB.3's no-second-streaming-stack guard. The duplication census (7 matchmaking, 5 rollback, ~6 battle-pass, 3 voice/SFU, 2 C2PA signers) is the cautionary tale.

  Evidence (2026-07-22): `@oshun/v10-rail-phase-a` now owns a bounded,
  deterministic consolidation guard over the real `apps/v10` and
  `libs/v10` trees. It rejects alternate JavaScript/package and Rust/Cargo
  signing dependencies, raw Node/WebCrypto signing (including aliased,
  namespace, element-access, `require`, dynamic-import, re-export, and
  type-import forms), duplicate canonical contract declarations, renamed
  structural contract clones, and copied closed-enum vocabularies outside
  `libs/contracts/src/v10`. A symbol-census test keeps the guard aligned
  with every exported V10 channel-contract schema/type; existing RB.3 live
  media consolidation coverage remains in the same project target. The
  browser signing surface and all affected V10 fixtures now use
  `@oshun/content-signing`. Verification: Phase A 21/21 tests, content
  signing 7/7 tests, affected web 7/7 tests, desktop Chromium Playwright
  3/3, targeted typechecks and lint for all affected projects, and the
  content-signing build all pass; both repository-owned Nx test targets
  pass.
  

• X-3 The Thread composition (§7.1, §10): implement the morning daypart as the composed ritual the V1 review specified (wake → today's practice → Veritas briefing (audio) → case opens → Daily Wonder → Nyx sky/weather) — a daypart-scoped composition over the house channels' real content, in the kernel's daypart programming (verify against the V1 review §4.1/§5.1 text before building). Evidence (2026-07-22): @oshun/v10-rail-thread now composes one exact, morning-only six-slot program over canonical Tara, Veritas Live, Case Files, Wonder & Recall, and Nyx material; the generic kernel contract rejects reordered, substituted, cross-date, future, or malformed editions. The authenticated private/no-store BFF route applies the persisted schedule and V1 calendar clamp, returns 204 outside morning, and fail-closes deploy-authority output. The cardless web ritual is hidden by discretion, obeys global text-only mode, exposes shell deep links only when mounted, and starts Veritas audio only on an explicit press through the single arbiter. Kernel 172/172, Thread 5/5, Phase A 33/33, focused BFF 7/7, and full web 178/178 tests pass; affected typechecks and graph-aware lint, the BFF production bundle and disposable-migrated-database artifact smoke check, frozen filtered install, and Axe-enabled desktop/mobile Playwright 2/2 also pass. Integration detail: V10/X3_THREAD_COMPOSITION_INTEGRATION.md.

• X-4 V1 house channels not otherwise covered (§7.1): one adapter task each, after their substrate read (libs/nyx/*, libs/tara/*, libs/arete/*, libs/oshun/domain-*):

  • Nyx sky-and-awe: tonight's sky events tile (real ephemeris from libs/nyx/ephemeris/sky-clock), aurora/sky-event drips, live sky cams in the video lane where real feeds exist (docked-third-party class initially), wind-down affinity.

    Evidence (2026-07-22): `@oshun/v10-rail-channel-nyx` now projects
    real `@nyx/ephemeris` moon culmination and genuine visible planetary
    conjunction calculations through `@nyx/sky-clock`'s above-horizon,
    location-bucketed nightly materialiser. Its strict Nyx tile exposes no
    precise coordinates; bounded `nyx.sky-event` drips carry the same real
    event authority. A concrete `@nyx/events` NOAA SWPC adapter produces
    `nyx.aurora` only for overlapping, locally plausible geomagnetic
    forecasts. An explicitly configured real feed may enter only as a
    `docked-third-party` video source; none is declared when no verified
    feed is configured. The calm manifest has no autoplay/elevation, no
    absence punishment, and `wind-down` affinity 1. Nyx 11/11 tests,
    channel/web/Phase A typechecks and lint, V10 web 166/166 tests, Phase A
    29/29 tests with Nyx in the post-pilot invariant set, frozen filtered
    lock validation, and production-directory Playwright 4/4 across
    desktop/mobile Chromium pass. Integration detail:
    `V10/X4_NYX_RAIL_CHANNEL_INTEGRATION.md`.
    

  • Tara presence micro-channel: hourly bell (gentle drip, never an elevation), one-breath micro-act with real breath pacing from the Tara stack; explicitly no guilt mechanics (invariant-suite covered).

    Evidence (2026-07-22): `@oshun/v10-rail-channel-tara` reads the canonical
    coherent-breath cadence, accessibility fallback, and safety note
    directly from `@tara/features`, then paces exactly one five-second-in,
    five-second-out cycle through a strict Rail micro-act. IANA-local hour
    boundaries, including fractional offsets and DST, produce bounded
    `tara.hourly-bell` drips with no priority, interruption, delivery
    instruction, autoplay, live moment, or elevation path. The manifest and
    completion vocabulary contain no score, streak, reward, penalty, or
    obligation state. Tara is shipped in the production directory and added
    to the post-pilot invariant set without retroactively becoming a Phase A
    pilot. Tara 12/12 tests, Tara taxonomy 5/5 tests, channel/source/web/Phase
    A lint and typechecks, web 166/166 tests, Phase A 30/30 tests, frozen
    filtered lock validation, and production-directory Playwright 4/4 with
    automatic Axe coverage across desktop/mobile Chromium pass. Integration
    detail: `V10/X4_TARA_RAIL_CHANNEL_INTEGRATION.md`.
    

  • Arete gentle progress tile: humane-streak semantics (done|partial|skip|decline|miss from libs/arete/habits) rendered as the tile; its semantics feed the R0.2 no-absence-punishment vocabulary.

    Evidence (2026-07-22): `@arete/habits/check-in-status` now consolidates
    the exact ordered humane vocabulary and its engaged/grace/no-count
    meanings; the habits recovery and friction models consume that shared
    authority. `@oshun/v10-rail-channel-arete` renders every status from an
    explicit user-scoped persisted check-in, never infers `miss` from
    absence, publishes the exact tuple in its manifest, and exposes no user
    id, count, score, flame, countdown, urgency, autoplay, drip, micro-act,
    live moment, or elevation path. Arete is shipped in the production
    directory and included in the post-pilot invariant set. The full habits
    suite passes 252/252, Arete channel 12/12, Phase A 31/31, web 166/166,
    all affected typechecks and lint, frozen filtered lock validation, and
    production-directory Playwright 4/4 with automatic Axe coverage across
    desktop/mobile Chromium pass. Integration detail:
    `V10/X4_ARETE_RAIL_CHANNEL_INTEGRATION.md`.
    

• X-5 Naming (§12.9): the product is V10 (D8), so v10 is the code namespace; "the Rail" stays the working product name and "the Thread" names the morning ritual. The V3 venue collision is resolved in RA.8 as technical name V3 Stage, id v3.stage, while legacy V3 Saraswati implementation names remain distinct from the @saraswati/* industrial domain; final brand naming is (HUMAN GATE HG-7).

• X-6 Source-doc sync: after Phase A ships, update V_SERIES_AMBIENT_RAIL.md status header from "Concept / design exploration" and record deviations discovered during implementation (e.g. the RA.8 naming resolution, RB.3 substrate home). Completed 2026-07-22: the source now reports Phase A as code-complete without claiming the open human exit gate, and records the implemented V10/Tauri ownership split, v3.stage naming boundary, canonical libs/shared/live-media substrate home and still-open deployment edge, VOD/premiere Stage truth, Thread composition boundary, and release-wording discipline. The source links back to this requirement ledger as the evidence authority.

• X-7 Docs-center entry: add the Rail to the docs center per its conventions (architecture page: kernel, contract, lanes, rings, surfaces; link the source doc and this TODOS file). Done 2026-07-16: V10 product space registered in the docs-center generator (v10-rail), with V10/V10_features.md + V10/V10_ARCHITECTURE.md covering kernel/contract/lanes/rings/surfaces and linking both source docs; portal, capability matrix, search index, and repo map regenerated to ten products; 17 generator tests green.

• X-8 V10 product registration (D8): register the Rail as V10 in the V-series machinery: add a V10 entry to scripts/audit/capability-truth-registry.json per its schema (V_SERIES.md is generated from it — never hand-edit its status claims); create the V10/ product directory when the first product-level doc lands; fold V10 into the V-series review/audit cadence (product review + autonomous-content audit) alongside V1–V9. Implemented 2026-07-22: the capability-truth registry and schema now require the tenth product and publish its evidence-backed blocked status; the bounded canonical verification manifest credits all 19 V10 Vitest configurations; the coherence manifest samples each credited configuration; and the autonomous-content seed/inventory machinery now extracts V10 beside V1–V9. V10_PRODUCT_REVIEW_2026-07-22.md records the independent product review, while the canonical autonomous-content audit contains the V10 findings, composition algorithms, evidence, and acceptance slice. The legacy evidence/v1-v9 and dated audit filename remain stable locators, but their generated scope is V1–V10.

§HG — Human/business gates (NOT agent-actionable; tracked for completeness)#

These stay [ ] until a human closes them; agent tasks blocked by them say so inline above.

• HG-1 Phase A exit test: the author actually leaves the Rail docked next to Claude Code for a full week (instrumented by RA.9's dogfood report). blocked:human
• HG-2 V3 Stage content operations: licensing/rights for third-party music video/concert content; first-party/generated content is not gated. blocked:governance
• HG-3 Veritas first-party live coverage: rights + ops business proposal (§12.2 — its own proposal, not a tech feature). blocked:governance
• HG-4 Ghost Dojo League go-to-market: announce-as-destination marketing from Phase A. blocked:governance
• HG-5 Legal review of the docked-third-party moderation boundary (embed hosting vs content responsibility; watch-party chat adjacency). blocked:governance
• HG-6 Adult-ring policy sign-off: age-verification adequacy, separate brand identity, jurisdiction review — before any user-visible launch of RD.3. blocked:governance
• HG-7 Final product naming ("the Rail", "the Thread", the V3 Stage brand disambiguation). blocked:human
• HG-8 Ori default-on decision: after the believability beta + cost ceiling data (RB.2), a human decides whether/for whom the narrator flag defaults on (§12.6). blocked:human
• HG-9 App-store review strategy for mobile/watch satellites given the ring model (the matrix is enforced in code from day one; store policy conversations are human work). blocked:governance

Completion definition#

The checklist is done when: every non-gated [ ] above is [x] with task-by-task verification per the ground rules; every gated task is either [x] (gate opened, work done) or carries a dated skip note naming its gate; and the RA.9 invariant suite + X-2 consolidation guards run green in CI.