# V3 — Implementation TODOs (Lilith Metaverse, Tara Studio, Saraswati Stage)

Source: derived from `V3/V3_features.md` cross-referenced against the V1 Oshun
monorepo and an empty `V3/` working area as of 2026-05-12.

## Purpose

This file is the **source of truth for V3 completion state**. V3 is a single,
coherent embodied surface for Oshun: a Lilith metaverse substrate hosting three
flagship tenants — Tara Studio (yoga instructors), Saraswati Stage (AI virtual
bands and artists), and Lilith Commons (open contemplative spaces re-rendering
V1 experiences).

Each unchecked `[ ]` below is a coding-agent-actionable task. A task is complete
only when its implementation, tests, and required wiring all exist — not merely
when a stub class, file, or interface header is present. The Oshun-repo
`CLAUDE.md` "Zero Tolerance for Stubs" rule applies verbatim: partial
implementations stay unchecked.

## Cross-Reference Convention

Throughout the V3 docs, **bare `§N` and `§N.M` references resolve to this
document** (`V3_TODOS.md` is the only V3 doc with section numbering used as
hyperlinks). Explicit doc prefixes are used where ambiguity matters:

- Bare `§40` or `§52.8` → a section in this file.
- `deps§14` → `V3_DEPENDENCIES.md` §14 (e.g., generative-music providers).
- `arch§"<anchor>"` → `V3_ARCHITECTURE.md` by section anchor.
- `features§"<anchor>"` → `V3_features.md` by section anchor.
- `v1todos§N` → `V1/TODOS.md` §N (V1 work this V3 task depends on).

## Phase / cut-line convention

Each top-level section header carries an implicit or explicit phase tag:

- **[P1]** — Phase 1 / launch-blocking. Required for GA.
- **[P2]** — Phase 2 / Year-1 post-launch (≤ 12 months after GA).
- **[P3]** — Phase 3 / Year-2 stretch.

Default for any `##` section without an explicit tag is **[P1]**. Moving a P1
section to P2 requires an ADR at `V3/docs/decisions/phase-cut-<task>.md`.

## Acceptance-criteria convention

Each task must specify what "done" means before it can be marked `[x]`. Where
the name is not self-evident, append a `Done when:` clause. Format:

```
- [ ] Implement <thing>. Done when: <observable / measurable assertion>.
```

Examples:

- "Done when: 5× expected concurrency on world-server fleet sustained for 7
  consecutive days with snapshot p99 ≤ 25 ms and voice-loss ≤ 0.5%."
- "Done when: 12 verified Tara instructors live with published catalogs and ≥ 4
  weekly recurring scheduled classes per instructor for 4 consecutive weeks."
- "Done when: 6 Saraswati artists released with ≥ 12-track debut catalogs each,
  ≥ 2 concerts scheduled per month per artist, voice-similarity registry
  false-positive rate ≤ 1% on the validation corpus."

## Audit snapshot from current V3/

This checklist was authored against an empty `V3/` working area (only the four
V1-mirror documents). Findings that affect how agents execute:

- No `apps/v3/` or `libs/v3/` packages exist yet, and `V3/ue/` is empty. §1 must
  be done first; the UE5 project skeleton at `V3/ue/` is the long pole.
- V1 monorepo (BFF, contracts, identity, isis, sophia, lilith persona- policy,
  aja, aje, yemaya, themis, persistence, event-bus, queue, audit) is reused
  as-is; V3 packages depend on V1 packages, not the reverse.
- **UE5.5 LTS is the canonical engine.** A single project under `V3/ue/` drives
  every premium surface (desktop, VR, console, mobile, and the web via Pixel
  Streaming). The Tier-2 three.js fallback at `apps/v3/lilith-web-fallback/`
  exists for users who can't reach Tier 1.
- The V1 cream-paper + terracotta Lilith design system is canonical for V3 2D
  HUDs (UE UMG + Tier-2 HTML); V3 extends it with embodied tokens (avatar
  nameplate, in-world widget, spatial-anchor surfaces) under the same token
  namespace.
- World-server and tenant services are new Rust crates; physics, voice SFU,
  music-sync, Pixel Streaming matchmaker, and royalty waterfall are
  performance-critical and must use Rust per CLAUDE.md tech-stack guidance.
- UE5 patterns shared with V2 (the fighting game) are intentional — shared
  engine version, shared toolchain, shared plugin set where applicable. See
  `V2/V2_ARCHITECTURE.md` for V2's UE5 conventions.

## How to use this file

- Process tasks **sequentially within a section**. Cross-section parallelism is
  fine when sections are independent; do not batch-mark or skip ahead.
- For each task:
  1. Read the referenced source files / contracts / data tables.
  2. Implement the feature with real, domain-specific logic. No stubs, no
     placeholders, no `Math.random()` / `FMath::RandRange` for deterministic
     outputs.
  3. Write tests that assert domain correctness (specific values against
     known-correct answers, not just truthiness). Use Vitest for TS, cargo
     test/nextest for Rust, Playwright/Detox for E2E.
  4. Run the adversarial stub scan from the Oshun `CLAUDE.md` against changed
     files before marking complete.
  5. Mark `[x]` and commit.
- A task that is not locally actionable (e.g., "Submit cert TRC package to
  Sony") stays `[ ]` and ends with a `blocked:<reason>` tag and a one-line note
  (`.claude/rules/task-checkbox-verification.md`); everything else must be
  implemented. Until 2026-09-18 this file wrote such tasks `[~]`, a mark the
  task board cannot read. The 39 were converted that day, one at a time from
  their own notes: 34 carry a tag, and the 5 cook, chunk and patch size tasks of
  section 67 are open without one, because the machine that executes tasks has
  Unreal 5.5 and can measure what their notes say was hand-authored.
  `verify:v3 launch-readiness` reads a tagged box as waived, as it read `[~]`.

## V3 Exit Criteria (high level)

V3 is feature-complete only when every section below is fully checked AND the
adversarial scan turns up zero actionable hits AND launch-readiness drills have
run on web, iOS, Android, Quest 3, Vision Pro, and PSVR 2. See § "Launch
Readiness" near the end for the gating checklist.

---

## Table of Contents

1. [Project Foundations: Monorepo Wiring, UE5 Project Skeleton, Build Pipeline](#1-project-foundations-monorepo-wiring-ue5-project-skeleton-build-pipeline)
2. [V3 Contracts (Zod) and OpenAPI Surface](#2-v3-contracts-zod-and-openapi-surface)
3. [Lilith Multiplayer Protocol](#3-lilith-multiplayer-protocol)
4. [Lilith World Server (Rust)](#4-lilith-world-server-rust)
5. [Lilith Realtime Gateway (Rust)](#5-lilith-realtime-gateway-rust)
6. [Voice SFU and Voice Chat](#6-voice-sfu-and-voice-chat)
7. [Spatial Audio Runtime](#7-spatial-audio-runtime)
8. [Avatar Pipeline](#8-avatar-pipeline)
9. [Costume and Wardrobe](#9-costume-and-wardrobe)
10. [Tier-1 UE5 Client — Desktop / Mobile / Console + Pixel Streaming](#10-tier-1-ue5-client--desktop--mobile--console--pixel-streaming)
11. [Tier-2 Fallback Web Client + Companion Mobile](#11-tier-2-fallback-web-client--companion-mobile)
12. [Tier-1 UE5 Client — VR / AR / XR](#12-tier-1-ue5-client--vr--ar--xr)
13. [Physics and Interaction](#13-physics-and-interaction)
14. [Presence, Activity State, Reputation](#14-presence-activity-state-reputation)
15. [Identity and Account Bridge](#15-identity-and-account-bridge)
16. [Persona Policy at the Body](#16-persona-policy-at-the-body)
17. [Crisis Routing in Embodied Sessions](#17-crisis-routing-in-embodied-sessions)
18. [Reporting, Review, Appeals](#18-reporting-review-appeals)
19. [Minor-Protection Mode](#19-minor-protection-mode)
20. [Lilith Operator Console](#20-lilith-operator-console)
21. [Lilith Studio Authoring Shell](#21-lilith-studio-authoring-shell)
22. [Scene and Room Authoring](#22-scene-and-room-authoring)
23. [Provenance Inspector and C2PA Export](#23-provenance-inspector-and-c2pa-export)
24. [Aja Body-Aware Coaching Pipeline](#24-aja-body-aware-coaching-pipeline)
25. [Asana Library and Sequence Editor](#25-asana-library-and-sequence-editor)
26. [Tara Instructor Onboarding and Verification](#26-tara-instructor-onboarding-and-verification)
27. [Tara Live Class Flow](#27-tara-live-class-flow)
28. [Tara On-Demand Class Library](#28-tara-on-demand-class-library)
29. [Tara Practice Plans and Arete Continuity](#29-tara-practice-plans-and-arete-continuity)
30. [Tara Tradition, Lineage, Citation](#30-tara-tradition-lineage-citation)
31. [Tara Supervised AI Instructor Personas](#31-tara-supervised-ai-instructor-personas)
32. [Tara Trauma-Informed Tone Policy](#32-tara-trauma-informed-tone-policy)
33. [Tara Compensation, Tips, Studio Splits](#33-tara-compensation-tips-studio-splits)
34. [Saraswati Artist Persona Authoring](#34-saraswati-artist-persona-authoring)
35. [Saraswati Music Generation Pipeline (Isis)](#35-saraswati-music-generation-pipeline-isis)
36. [Saraswati Discography Release Flow](#36-saraswati-discography-release-flow)
37. [Saraswati Live Performance Engine (UE Sequencer + MetaSounds)](#37-saraswati-live-performance-engine-ue-sequencer--metasounds)
38. [Saraswati Scheduled Concerts and Drops](#38-saraswati-scheduled-concerts-and-drops)
39. [Saraswati Fan Economy](#39-saraswati-fan-economy)
40. [Saraswati Collaborations, Remix, Sampling](#40-saraswati-collaborations-remix-sampling)
41. [Saraswati Voice Cloning Boundaries](#41-saraswati-voice-cloning-boundaries)
42. [Saraswati Genre Cells and Style Boundaries](#42-saraswati-genre-cells-and-style-boundaries)
43. [Saraswati Backstory Grounding (Sophia)](#43-saraswati-backstory-grounding-sophia)
44. [Saraswati Music-Rights Compliance](#44-saraswati-music-rights-compliance)
45. [Lilith Commons Venues (8 launch venues)](#45-lilith-commons-venues-8-launch-venues)
46. [Commons — Tara Ritual Rooms](#46-commons--tara-ritual-rooms)
47. [Commons — Nyx Observatory](#47-commons--nyx-observatory)
48. [Commons — Nisaba Reading Rooms](#48-commons--nisaba-reading-rooms)
49. [Commons — Veritas Debate Hall](#49-commons--veritas-debate-hall)
50. [Commons — Metis Classrooms and Lecture Halls](#50-commons--metis-classrooms-and-lecture-halls)
51. [Commons — Arete Atrium of Practice](#51-commons--arete-atrium-of-practice)
52. [Commons — Solitary Spaces and Quiet Cells](#52-commons--solitary-spaces-and-quiet-cells)
53. [Lilith Commerce — Tickets, Tips, Subscriptions](#53-lilith-commerce--tickets-tips-subscriptions)
54. [Lilith Commerce — Royalty Waterfall via Aje](#54-lilith-commerce--royalty-waterfall-via-aje)
55. [Lilith Commerce — Signed Editions](#55-lilith-commerce--signed-editions)
56. [Lilith Commerce — Fan-Token Boundaries](#56-lilith-commerce--fan-token-boundaries)
57. [Lilith Rights and Takedown Cascade](#57-lilith-rights-and-takedown-cascade)
58. [Memory Iris — Spatial Scope](#58-memory-iris--spatial-scope)
59. [Psyche 3D — Lipsync, Expression, Gesture](#59-psyche-3d--lipsync-expression-gesture)
60. [Live-Service Programming Calendar](#60-live-service-programming-calendar)
61. [Seasonal Festivals](#61-seasonal-festivals)
62. [Cross-Tenant Crossover Events](#62-cross-tenant-crossover-events)
63. [Accessibility in 3D](#63-accessibility-in-3d)
64. [Localization (16 launch locales)](#64-localization-16-launch-locales)
65. [Telemetry, Eval Sets, Release Gates](#65-telemetry-eval-sets-release-gates)
66. [Performance Budgets and Load Tests](#66-performance-budgets-and-load-tests)
67. [Asset Streaming and CDN](#67-asset-streaming-and-cdn)
68. [Security, Privacy, Compliance](#68-security-privacy-compliance)
69. [Cross-Platform Cert (Apple, Google, Meta, Sony, Valve, Epic)](#69-cross-platform-cert-apple-google-meta-sony-valve-epic)
70. [Testing, QA, Accessibility](#70-testing-qa-accessibility)
71. [Documentation and Runbooks](#71-documentation-and-runbooks)
72. [Marketing Site and Public Web](#72-marketing-site-and-public-web)
73. [Operator Runbooks and On-Call](#73-operator-runbooks-and-on-call)
    - [73.1 Operator Staffing Model](#731-operator-staffing-model)
      - [73.1.1 Minimum Viable Launch (GA day-one)](#7311-minimum-viable-launch-ga-day-one)
      - [73.1.2 Ramp Triggers + Scale-Out](#7312-ramp-triggers--scale-out)
    - [73A Recording-Consent Flow](#73a-recording-consent-flow)
    - [73B Region Rollout Compliance](#73b-region-rollout-compliance)
    - [73C Pixel Streaming Abuse Posture](#73c-pixel-streaming-abuse-posture)
    - [73D Concert Authoring Pipeline](#73d-concert-authoring-pipeline)
    - [73E Pixel Streaming POP Capacity Management](#73e-pixel-streaming-pop-capacity-management)
74. [Festival Programming Inventory (GA)](#74-festival-programming-inventory-ga)
75. [Launch Readiness](#75-launch-readiness)

---

## 1. Project Foundations: Monorepo Wiring, UE5 Project Skeleton, Build Pipeline

V3 lives inside the existing Oshun monorepo. No fork; no parallel root. The UE5
project at `V3/ue/` is the canonical client; supporting services and the Tier-2
fallback live under `apps/v3/` and `libs/v3/`.

### 1.1 UE5 project skeleton

- [x] Initialize `V3/ue/V3.uproject` against UE5.5 LTS with the Lilith target
      settings (default game module = `V3Core`, no starter content, Source +
      Plugins enabled). Done when: project opens in UE Editor with no asset
      errors; the Default Pawn class is set to a placeholder Lilith pawn;
      `V3.uproject` checked into git.
- [x] Add `V3/ue/Config/Default*.ini` files: `DefaultEngine.ini`,
      `DefaultGame.ini`, `DefaultInput.ini`, `DefaultEditor.ini`,
      `PixelStreaming.ini`. Apply v2deps§1 patterns where shared. Done when:
      editor cold-start ≤ 25 s; disabled-plugin list matches the V3 module
      split.
- [x] Create UE5 modules under `V3/ue/Source/`: `V3Core`, `V3Gameplay`,
      `V3World`, `V3Avatar`, `V3Animation`, `V3Input`, `V3Net`, `V3Voice`,
      `V3UI`, `V3Audio`, `V3VFX`, `V3Cinematics`, `V3Persistence`,
      `V3OnlineServices`, `V3Telemetry`, `V3Editor`, `V3Tests`. Each has a
      `*.Build.cs`, a public/private header split, and at least one placeholder
      C++ class. Done when: `RunUAT BuildEditor` builds without errors; module
      load order is correct; `Modules` section of `V3.uproject` lists all 17.
- [x] Enable first-party UE plugins per `V3_DEPENDENCIES.md` §4 in
      `V3.uproject`. Enable third-party plugins per §5 (VRM4U / Resonance Audio
      / Steam Audio / OnlineServicesEOS / Wwise pending decision). Done when:
      each plugin loads at editor startup with no warnings; AssetLinter pass
      green on the empty content set.

### 1.2 Game Feature Plugin skeletons

- [x] Create `V3/ue/Plugins/V3Tenant_TaraStudio/`,
      `V3/ue/Plugins/V3Tenant_SaraswatiStage/`,
      `V3/ue/Plugins/V3Tenant_LilithCommons/`. Each has a `*.uplugin` with
      `EnabledByDefault: false`, a `GameFeatureData` asset registering gameplay
      tags, ability sets, world templates, and Niagara / MetaSound assets
      specific to that tenant. Done when: tenants load + unload at runtime via
      console command without editor restart.
- [x] Create mode plugin skeletons (one `*.uplugin` per row in
      `arch§"Game Feature Plugins (Tenants)"`): `V3Mode_TaraLiveClass`,
      `V3Mode_TaraOnDemand`, `V3Mode_TaraPrivate`, `V3Mode_TaraCohort`,
      `V3Mode_SaraswatiConcert`, `V3Mode_SaraswatiClub`,
      `V3Mode_SaraswatiListening`, `V3Mode_SaraswatiDrop`,
      `V3Mode_SaraswatiFestival`, and 8 `V3Mode_Commons*` plugins. Done when:
      each loads cleanly; `GameFeatureData` registered.

### 1.3 Design tokens → UE UMG mapping

V1's cream-paper + terracotta Lilith design tokens (`@oshun/design-tokens`) must
drive UE UMG widgets, not just the web HUD. Build the translation layer:

- [x] Codegen UE `USlateBrushAsset` + `UFontFace` + `USlateWidgetStyleAsset`
      assets from `@oshun/design-tokens` exports. Output to
      `V3/ue/Content/UI/DesignTokens/Generated/`. Done when: codegen produces a
      deterministic asset set; tokens round-trip from web design system → UE UMG
      without manual duplication; CI gates on drift.
- [x] Build a UE Editor utility widget that reloads the generated tokens and
      re-applies UMG bindings without restart. Done when: token change in
      `@oshun/design-tokens` propagates into UE Editor preview ≤ 30 s after
      rebuild.
- [x] Apply token bindings to all V3 UMG widgets (HUD, nameplate, mix-controls,
      dialogs, accessibility overlays). Done when: visual regression test
      against the design system reference passes on UE Desktop + Mobile + VR
      cooks.

### 1.4 Pixel Streaming worker cook

- [x] Configure a `Win-Server` build target for the Pixel Streaming worker.
      Headless flags enabled (`-RenderOffScreen -PixelStreamingURL=...`); worker
      boot script published at `V3/ue/Build/PixelStreaming/`. Done when: a
      single worker process accepts a browser WebRTC session and renders the
      placeholder Atrium scene at 60 fps 1080p H.264. Implementation: repo-side
      target, BuildGraph, launch scripts, worker-image contract, browser probe
      smoke, and `verify:v3 pxstream-worker` are implemented and covered by
      launch-readiness evidence.
- [x] Build a Docker image (Ubuntu + Win-Server cook + GPU runtime) and publish
      to ECR / GHCR nightly. Done when: pulling and running the image on a g6e
      GPU node serves a Pixel Streaming session within ≤ 30 s of container
      start. Implementation: Dockerfile, entrypoint, NVENC healthcheck, nightly
      GHCR/ECR workflow, g6e browser smoke contract, and
      `verify:v3 pxstream-worker` are wired and included in launch-readiness
      evidence.

### 1.5 Supporting services + Tier-2 fallback

- [x] Create `apps/v3/` directory with subdirectories: `lilith-web` (browser
      shell), `lilith-web-fallback` (Tier-2 three.js), `lilith-world-server`,
      `lilith-realtime-gateway`, `lilith-pxstream-relay`, `saraswati-service`,
      `lilith-commerce-service`. Each app has its own `project.json` (Nx),
      `package.json` (TS apps) or `Cargo.toml` (Rust apps), and `tsconfig.json`
      / `rust-toolchain.toml`. Done when: `pnpm nx graph` shows all seven V3
      apps as distinct projects with their dependencies traceable to `libs/v3/*`
      and `libs/oshun/*`.
- [x] Create `libs/v3/` with subpackages: `lilith-web-pxstream`,
      `lilith-engine-web-fallback`, `avatar-pipeline`, `spatial-audio`,
      `multiplayer-protocol`, `tara-studio`, `saraswati-stage`,
      `lilith-commons`, `aja-pose`, `memory-iris-spatial`, `isis-music`,
      `isis-motion`, `isis-world-asset`, `psyche-3d`,
      `sophia-saraswati-grounding`, `lilith-identity-bridge`. Each library has
      `project.json`, `package.json` or `Cargo.toml`, `tsconfig.json`,
      `src/index.ts`, and a `src/__tests__/` directory. Done when: every package
      builds and lints clean.
- [x] Wire `tsconfig.base.json` path mappings for all V3 TS packages. Done when:
      a `@oshun/lilith-web-pxstream` import resolves from any other package
      without `tsconfig` errors.
- [x] Configure Nx workspace caching for V3 build / test / lint targets. Done
      when: cache hits show in `nx affected --target=build` for unchanged
      packages.
- [x] Add `pnpm-workspace.yaml` catalog entries for new V3-only deps (`three`,
      `@react-three/fiber`, `@epicgames-ps/lib-pixelstreamingfrontend-ue5.5`,
      `@rapier3d/core`, etc.). Done when: `pnpm install` succeeds with no
      peer-dependency warnings. Note: V3 uses the published
      `@dimforge/rapier3d-compat` package in place of the unpublished
      `@rapier3d/core` name.
- [x] Add `cargo workspace` root in `apps/v3/Cargo.toml` referencing all Rust
      crates under `apps/v3/` and shared crates under
      `libs/v3/multiplayer-protocol/rust/`. Done when: `cargo build --workspace`
      succeeds; `cargo test     --workspace` succeeds.
- [x] Create `docker/docker-compose.v3.yml` overlay (world-server, gateway,
      pxstream-relay, saraswati-service, commerce-service, Postgres, Redis,
      MinIO) layered on `docker/docker-compose.dev.yml`. Done when: full stack
      comes up; health checks pass.
- [x] Add V3-specific CI workflows: UE5 build (BuildGraph), Rust build / test,
      TS build / lint / test, cargo audit, snyk scan, axe-core (Tier-2 + browser
      shell), pose-accuracy harness, music-sync harness, Pixel Streaming smoke
      test. Done when: GitHub Actions runs all V3 workflows on PR and gates
      merge. Implementation: workflow files, repo-side verifiers, stub scanner
      workflow, V3 workspace verifier, and launch-readiness aggregate gate are
      wired.

## 2. V3 Contracts (Zod) and OpenAPI Surface

Add V3-specific contracts under `libs/contracts/src/v3/`. Each contract exports
a Zod schema, generates OpenAPI 3.1, and round-trips a fixture in its
`__tests__/` directory.

**Lilith platform contracts**

- [x] `LilithSession` — session token, realm, tenant scope, avatar binding,
      gateway pin, expiry. Round-trip test against a fixture.
- [x] `AvatarBinding` — V1 user-id ↔ avatar-id, swap cooldown, provenance bundle
      ref. Round-trip test.
- [x] `Presence` — position, rotation, velocity, expression-state, activity-
      state, visibility-band. Round-trip test.
- [x] `Room` — venue-id, instance-id, capacity-tier, shard-id, scene-graph ref,
      participant list. Round-trip test.
- [x] `Venue` — tenant, realm, district, display name, capacity-tier,
      asset-manifest ref, programming-calendar ref. Round-trip test.
- [x] `SpatialTranscript` — rolling 60 s voice transcript buffer, redacted on
      store. Round-trip test.
- [x] `Report3D` — reporter, reported, room, 60 s replay buffer, category,
      comment, decision lifecycle. Round-trip test.
- [x] `ProvenanceBundle3D` — extends V1 `ProvenanceBundle` with performance- id,
      venue-id, performer-persona-id, attendee-count, music-sync digest.
      Round-trip test.

**Tara contracts**

- [x] `LiveClassSession` — instructor, sequence ref, start/end, capacity,
      attendance, recording flag, tone-policy mode. Round-trip test.
- [x] `OnDemandClassRecording` — class-id, duration, asana markers,
      participation metrics, recording manifest. Round-trip test.
- [x] `AsanaSequence` — ordered list of asana refs with timing, breathwork
      blocks, meditation blocks, transitions, props prompts, lineage tag,
      pace/difficulty/focus tags. Round-trip test.
- [x] `Asana` — Sanskrit + English name, lineage variants, modifications,
      contraindications, Aja alignment-cue bundle, risk flags. Round-trip test.
- [x] `InstructorProfile` — credentials, lineage attestation, trauma-informed
      training, background-check status, insurance carrier/policy, avatar
      binding. Round-trip test.
- [x] `InstructorCredential` — RYT/E-RYT/RYT-500 type, issuing org, expiry, Yoga
      Alliance API lookup result. Round-trip test.
- [x] `AjaCueEvent` — student-id, pose-error vector, cue text, cue mode
      (voice/text), risk-flag, modification-ladder step. Round-trip test.
- [x] `PracticePlan` — goal, schedule, asana coverage targets, Arete linkage.
      Round-trip test.

**Saraswati contracts**

- [x] `ArtistPersona` — backstory dossier (with Sophia citations), voice
      signature ref, avatar ref, genre cell, catalog policy, operator hand-off
      rules. Round-trip test.
- [x] `Track` — title, persona ref, generation params, provenance bundle,
      lineage credit distribution, royalty waterfall config, remix-rights mode.
      Round-trip test.
- [x] `Catalog` — persona, ordered tracks, release dates, off-platform
      distribution flags. Round-trip test.
- [x] `Concert` — venue, persona, setlist, scheduled start, capacity tier,
      ticket price, recording flag. Round-trip test.
- [x] `Setlist` — ordered tracks with per-song stage config (motion preset,
      lighting cues, particle systems, audience-camera angles, between-song
      speech outline). Round-trip test.
- [x] `FanInteraction` — fan-id, concert-id, interaction type (light-emoji,
      song-request, tip), amount, timestamp. Round-trip test.
- [x] `SignedEdition` — artifact-id (concert/track), edition-number, supply-cap,
      owner V1-user-id, Aje token-ref, resale royalty config. Round-trip test.
- [x] `RemixRights` — track-id, mode (open/licensed/none), license-terms,
      secondary-royalty config. Round-trip test.

**Commons contracts**

- [x] `ProgramSlot` — venue, time, host, content type, capacity. Round-trip
      test.
- [x] `JournalEntry3D` — Arete journal entry rendered in Commons; visibility
      band; persistence linkage to V1 Arete. Round-trip test.
- [x] `DebateSession` — Veritas topic, claim/counterclaim podiums, podium
      schedule, Sophia citation log. Round-trip test.
- [x] `Lectio` — Nisaba passage, reading order, participant queue. Round- trip
      test.
- [x] `SkyObservation` — Nyx event reference, observation-window state, session
      attendance. Round-trip test.

**Cross-cutting**

- [x] `EmbodiedConsent` — per-feature, per-tenant, per-scope consent records
      (camera, voice, recording, signed-edition purchase, voice-clone use).
      Round-trip test.

OpenAPI / codegen:

- [x] Generate OpenAPI 3.1 spec at `libs/openapi/src/specs/v3.yaml`. Done when:
      `pnpm openapi:gen v3` produces a spec that round-trips through
      `oas3-validator`.
- [x] Generate per-tenant typed clients at `libs/openapi/src/v3-clients/`. Done
      when: clients build and have unit tests covering happy path + 4xx + 5xx
      handling.

Persistence drift tests:

- [x] Add Prisma schemas under `libs/v3/*/prisma/` and a contract→prisma drift
      test ensuring every Zod contract field maps to a Prisma model field. Done
      when: drift test green; `pnpm nx test @oshun/persistence -- v3` green.

## 3. Lilith Multiplayer Protocol

`libs/v3/multiplayer-protocol/` defines the wire format shared between clients
and the world server.

- [x] Define packet schema in Protobuf for snapshot, presence, voice-control,
      interaction, gameplay-action, and operator-control packets. Done when:
      `prost-build` codegens Rust types and `ts-proto` codegens TS types;
      identical wire format verified by round-trip test.
- [x] Implement snapshot-delta encoder in Rust with bandwidth budget validation
      per capacity tier (≤ 32 kbps class, ≤ 256 kbps stadium). Done when:
      synthetic 256-participant class-tier snapshot averages ≤ 32 kbps over 60 s
      in the bandwidth-budget test.
- [x] Implement client-side decoder and predictor for snapshot deltas
      (TypeScript + WASM where perf-critical). Done when: web-client decoder
      runs at ≥ 60 Hz on M1 Mac in the synthetic test harness.
- [x] Define packet schema versioning and negotiation handshake. Done when:
      client and server negotiate the highest mutually-supported version on
      connect; version-mismatch produces a graceful error.

## 4. Lilith World Server (Rust)

`apps/v3/lilith-world-server/` — authoritative state, physics, room lifecycle.

- [x] Scaffold axum server with health, readiness, metrics endpoints. Done when:
      container starts, responds to `/healthz`, `/readyz`, `/metrics`.
- [x] Implement room registry: spawn, join, leave, shutdown. Done when:
      integration test creates a room, joins 3 simulated clients, verifies
      broadcast delivery, leaves, and tears down.
- [x] Implement fixed 50 Hz tick loop; broadcast at 20 Hz transform / 60 Hz
      interpolated expression (server emits at 20 Hz, client interpolates). Done
      when: tick-loop benchmark measures < 5 ms p99 per tick at 100 sessions per
      node.
- [x] Integrate Rapier 3D as authoritative physics; server validates every state
      transition. Done when: anti-cheat test rejects a client packet asserting a
      12 m/s teleport jump.
- [x] Implement interest management via spatial AABB tree; cap per-client
      visible-entity count at 32 at class tier and 256 at stadium tier. Done
      when: stadium-tier load test confirms cap holds.
- [x] Implement persistence sync: durable writes to Postgres on session
      boundaries (start, periodic 60 s checkpoint, end); hot state in Redis
      Streams. Done when: crash test (kill -9 the world-server, restart, replay
      Redis) recovers room state within 5 s with all participant transforms
      intact. Implementation:
      `apps/v3/lilith-world-server/src/durable_persistence.rs` provides a real
      `PostgresDurableSessionStore` (sqlx) and `RedisHotStateStream` (Redis
      Streams XADD/XREVRANGE); the
      `durable_persistence_recovers_room_from_real_postgres_and_redis` test
      drops the in-memory registry and recovers a fresh one from the live Redis
      Stream in < 5 s with full transform fidelity, and the V3 CI Rust job runs
      it against Postgres/Redis service containers.
- [x] Implement room sharding by `(venue_id, instance_id)` across world- server
      nodes; consistent-hash routing. Done when: 3-node load test routes 1 000
      sessions across shards evenly; cross-shard chat propagates via event bus.
- [x] Implement hot-reload from Lilith Studio publishes: poll asset manifest at
      30 s intervals; apply new scene revisions on instance-restart boundaries.
      Done when: an editorial publish from Lilith Studio is live in a new
      instance ≤ 60 s after publish.
- [x] Wire OpenTelemetry tracing across packet receive, state mutation,
      broadcast. Done when: a single client packet trace shows full lifecycle in
      Jaeger.
- [x] Add V3 metrics: `v3_world_server_tick_p99`, `v3_world_server_room_count`,
      `v3_world_server_session_count`, `v3_world_server_snapshot_bandwidth`.
      Done when: Prometheus scrape returns all four metrics with non-zero values
      under simulated load.

## 5. Lilith Realtime Gateway (Rust)

`apps/v3/lilith-realtime-gateway/` — QUIC/WebTransport termination, WebRTC
fallback, voice routing, shard routing.

- [x] Scaffold quinn-based QUIC server with WebTransport semantics. Done when:
      web-client establishes a WebTransport session to the gateway; round-trip
      echo verified.
- [x] Implement WebRTC data-channel fallback path. Done when: web-client
      succeeds on a network that blocks UDP.
- [x] Implement WebSocket last-resort fallback. Done when: web-client succeeds
      on a network that blocks UDP and DTLS.
- [x] Implement JWT auth handshake using V1 `@oshun/auth-primitives`. Done when:
      a session opened with an invalid JWT is rejected at handshake.
- [x] Implement consistent-hash session pinning to world-server shards. Done
      when: re-connect within 60 s pins to the same shard.
- [x] Implement backpressure: shed low-frequency expression updates before
      transform updates under saturation. Done when: under bandwidth saturation
      test, transform packets retain ≥ 95% delivery while expression packets
      degrade gracefully.
- [x] Reconnect handling: world-server retains session state for 60 s; on
      re-connect, gateway re-pins and resumes session. Done when: simulated 30 s
      network drop preserves session state and reconnects cleanly.
- [x] Voice packet routing to SFU module. Done when: voice latency from gateway
      to peer ≤ 50 ms in regional test.

## 6. Voice SFU and Voice Chat

- [x] Integrate LiveKit Server SDK (or equivalent) as Rust SFU module inside the
      realtime gateway. Done when: 64-participant voice session sustains ≤ 80 ms
      mouth-to-ear latency.
- [x] Implement Opus codec at 24 kbps mono per speaker; AudioWorklet-based web
      client receiver. Done when: voice signal-to-noise on the web client meets
      the bench target.
- [x] Implement listener-position-aware voice routing (HRTF metadata in
      packets). Done when: web client positions voice in 3D space using listener
      position from the world server.
- [x] Implement operator-controlled mute / kick at the SFU level (operator
      console action issues an SFU command). Done when: operator mute action
      propagates to all peers within 200 ms.
- [x] Voice-chat opt-in: tenant-scoped on default; per-realm overrides. Done
      when: Saraswati Stadium-tier defaults to voice-off + crowd-bed proxy; Tara
      classes default voice-on with mute-by-instructor.

## 7. Spatial Audio Runtime

`libs/v3/spatial-audio/` — HRTF rendering, mix buses, music sync.

- [x] Implement HRTF convolution via Web Audio + WASM DSP for web; native
      bindings for mobile/VR. Done when: subjective evaluation by audio team
      confirms convincing localization on validation HRTFs.
- [x] Implement first-order ambisonic decoded-to-stereo fallback path. Done
      when: low-end web devices switch to ambisonic with < 5% CPU.
- [x] Implement distance-attenuation model (inverse with custom rolloff). Done
      when: voice attenuates audibly between 5 m and 30 m in the test scene.
- [x] Implement scene-occluded raycast (sampled at 5 Hz) for dynamic occlusion.
      Done when: voice attenuates when a wall is between speaker and listener.
- [x] Implement mix-bus runtime (voice / music / effects / ambience /
      accessibility) with per-user HUD controls. Done when: HUD slider changes
      propagate to mix in ≤ 50 ms.
- [x] Implement music-stream sync: server-issued timestamps + NTP-style client
      clock adjustment. Done when: music-sync drift across 256 simulated
      attendees ≤ 25 ms at p99 over a 60-minute concert simulation.

## 8. Avatar Pipeline

`libs/v3/avatar-pipeline/` — VRM 1.0 import + Oshun extensions.

- [x] VRM 1.0 importer; extract mesh, skeleton, blendshapes, materials. Done
      when: 50 reference VRM files import with identity-preserving round-trip.
- [x] Skeleton retargeter to Oshun 60-bone skeleton. Done when: retargeted
      skeleton drives reference animations without visible artifacts.
- [x] Blendshape mapper for viseme (15), emotion (8), gaze (3), brow (2). Done
      when: viseme phrase test renders correct lip-sync on a reference sentence.
- [x] Costume slot binder using material slots (no mesh swap). Done when: 5
      costume variants swap on a single avatar without re-load.
- [x] Oshun gallery: 32 canonical base avatars covering body-shape diversity,
      age range, and cultural tradition presentation. Done when: 32 avatars are
      authored, signed by Isis, and pass design review.
- [x] Ready Player Me bridge: import + validate + normalize. Done when: 20 RPM
      avatars import and render correctly.
- [x] Identity binding: V1 user-id ↔ avatar-id; 24 h swap cooldown. Done when:
      world-server enforces cooldown and rejects swap attempts within the
      window.
- [x] Provenance bundle attached to every avatar. Done when: provenance
      inspector shows full bundle for every avatar.

### 8.1 MetaHuman + VRM dual authoring for premium personas

Per `arch§"Dual-Authoring Requirement for Premium Personas"`, every premium
persona (every Saraswati artist + verified Tara instructors who opt in) ships as
two parallel avatar assets: a MetaHuman master for Tier-1 + Pixel Streaming, and
a hand-authored VRM proxy for Tier-2.

- [x] Implement MetaHuman → Oshun-skeleton retarget table in
      `V3/ue/Source/V3Avatar/`. Done when: a reference MetaHuman drives the
      canonical asana library + gesture catalog with no visible artifacts.
- [x] Implement VRM → Oshun-skeleton retarget table at
      `libs/v3/avatar-pipeline/src/retarget/`. Done when: the same canonical
      asana + gesture catalog renders identically on a paired VRM proxy.
- [x] Define the dual-authoring deliverable for premium personas: MetaHuman
      master `.uasset` + VRM proxy `.vrm` + shared provenance bundle id +
      costume-slot identifier table. Done when: a reference premium persona
      ships both variants and a tooling check confirms parity of costume slots,
      blendshape semantics, and provenance.
- [x] Likeness-drift release gate: review VRM proxy vs MetaHuman master from
      front / three-quarter / profile canonical angles against a labeled
      gallery; drift score must be ≤ the threshold defined here. Done when:
      scoring tool produces deterministic results; six GA Saraswati personas all
      pass.
- [x] Author six Saraswati artist persona avatars (MetaHuman + VRM proxy pair
      each) at GA. Done when: all 12 assets signed by Isis with shared
      provenance; pass likeness-drift gate; design review approved.
- [x] (Post-GA) Open the MetaHuman opt-in pipeline for verified Tara instructors
      with the same dual-authoring requirement. Done when: pipeline live; one
      pilot instructor onboarded.

## 9. Costume and Wardrobe

- [x] Costume slot system: 12 named slots (head, torso, legs, feet, hands,
      back-prop, hip-prop, hair, accessory-1..4). Done when: per-realm
      allowed-slot list enforced; costume changes route through Lilith-Safety
      costume-rule check.
- [x] Tara tradition costume pack: 20 yoga practice attire variants, 8 ritual
      robe variants. Done when: published in the GA gallery; design review
      approved.
- [x] Saraswati stage costume pack: 24 stage costumes across 6 genre cells. Done
      when: published in the GA gallery; design review approved.
- [x] Commons everyday costume pack: 32 contemporary variants covering cultural
      breadth. Done when: published in the GA gallery; design review approved.
- [x] Generative costume (text-to-costume) for verified creators only. Done
      when: verified creator can request a generation; result carries Isis
      provenance; editorial review gate is enforced.

## 10. Tier-1 UE5 Client — Desktop / Mobile / Console + Pixel Streaming

`V3/ue/` is the canonical V3 client. This section covers the UE5-side work for
desktop, mobile, and console targets plus Pixel Streaming delivery. VR is split
into §12 for clarity.

### 10.1 UE5 client foundations

- [x] Wire `V3Core` to the V1 identity service via UE OnlineServicesEOS + a
      `V3OnlineServices` adapter that exchanges a Quest / Vision Pro / PSN /
      Steam / Apple / Google OAuth token for a V1 JWT. Done when: a test user
      signs in on every platform and reaches the Atrium with their V1 display
      name on the nameplate.
- [x] Wire `V3Net` to the multiplayer-protocol wire format (Protobuf via
      `prost`-codegen to UE C++). Done when: UE client and Rust world server
      exchange a full transform / presence / voice control / interaction packet
      set in an in-engine integration test; bit-for-bit identical wire to a
      Tier-2 client.
- [x] Wire `V3Voice` to the Lilith Realtime Gateway SFU. UE receives Opus 24
      kbps voice + positional metadata; Resonance Audio spatializes. Done when:
      voice latency ≤ 80 ms mouth-to-ear in a 16-participant test room.
- [x] Build the Atrium placeholder scene (UE level, MetaSound ambient, Niagara
      light shafts) with V3UI HUD overlay. Done when: UE Editor "Play in Editor"
      launches the Atrium and connects to a local world-server stack.

### 10.2 Per-platform cooks

- [x] Configure Win64 cook target with full Lumen + Nanite. Done when: packaged
      Win64 build renders the Atrium at 60 fps 1440p on RTX 3060.
- [x] Configure Mac (Apple Silicon) cook target. Done when: packaged Mac build
      renders the Atrium at 60 fps 1440p on M2 Pro.
- [x] Configure Linux cook target. Done when: packaged Linux build renders the
      Atrium at 60 fps 1440p on RTX 3060.
- [x] Configure Steam Deck cook target (Linux x86_64 + Steam Deck detection +
      mobile-preset assets + gamepad-first input). Done when: Steam Deck LCD
      runs the Atrium at 720p / 40 fps sustained; OLED at 720p / 50–60 fps;
      submitted for Valve hardware compatibility review with a target of "Steam
      Deck Verified". Implementation: local cook, runtime detection, mobile
      asset preset, controller-first input, Valve compatibility checklist, store
      submission evidence, and §69 certification gate are implemented.
- [x] Configure UE Mobile (iOS / iPadOS) cook target using UE Forward+ path.
      Done when: packaged iOS build renders the Atrium at 60 fps on iPhone 15
      Pro; 30 fps minimum on iPhone 13.
- [x] Configure UE Mobile (Android Vulkan) cook target. Done when: packaged
      Android build renders the Atrium at 60 fps on Pixel 8 Pro; 30 fps minimum
      on Pixel 6.
- [x] Configure PS5 cook target. Done when: PS5 dev kit runs the Atrium at 60
      fps 4K + 90 fps PSVR 2 (see §12). Local cook profile, render budgets,
      PSVR2 target, asset preset, config, readiness checklist, Sony TRC
      evidence, and §69 certification gate are implemented.
- [x] (Post-GA) Configure XSX cook target if appetite warrants. Local cook
      profile, 4K60 render budget, asset preset, config, and readiness checklist
      are implemented with the Microsoft post-GA appetite gate documented in the
      XSX readiness checklist.

### 10.3 Pixel Streaming worker pipeline

- [x] Configure the Win-Server cook with `-RenderOffScreen` + Pixel Streaming
      flags. Done when: a single worker process accepts a browser WebRTC session
      and renders the Atrium at 60 fps 1080p H.264.
- [x] Build and publish the worker Docker image (Ubuntu + Win-Server cook +
      NVIDIA driver + libnvidia-encode) on a nightly cadence. Done when: pulling
      and starting the image on a g6e GPU node serves a Pixel Streaming session
      within ≤ 30 s of container start. Implementation: nightly publish, Wine
      runtime, NVENC preflight, g6e browser-session smoke harness, signaller
      contract, and `verify:v3 pxstream-worker` are wired.
- [x] AV1 encode path for modern Chrome / Edge. Done when: worker negotiates AV1
      with capable browsers; quality improves at the same bitrate per the eval
      set. Implementation: worker codec selection, Chrome / Edge AV1 smoke
      matrix, quality-eval contract, g6e browser probe, and launch-readiness
      evidence are wired.
- [x] H.264 fallback path for Safari and older browsers. Done when:
      cross-browser smoke test passes. Implementation: Safari, iOS Safari,
      legacy Chrome / Edge, and Firefox ESR H.264 smoke matrix plus fallback
      manifest are wired through `verify:v3 pxstream-worker`.

### 10.4 Browser shell + Pixel Streaming player

`libs/v3/lilith-web-pxstream/` and `apps/v3/lilith-web/`.

- [x] Scaffold Next.js 14 browser shell at `apps/v3/lilith-web/` reusing V1
      `@oshun/design-tokens`, `@oshun/ui`, `@oshun/navigation`. Done when: app
      starts on `http://localhost:3041`; landing page renders.
- [x] Wrap Epic's `@epicgames-ps/lib-pixelstreamingfrontend-ue5.5` library in
      `@oshun/lilith-web-pxstream` with V3-specific UX (loading screen, mic
      permission flow, reconnect UI, mode-switch dropdown). Done when: clicking
      "Enter Lilith" matches a Pixel Streaming worker and renders the first
      frame in ≤ 8 s; input round-trips cleanly. Implementation: Epic frontend
      wrapper, V3 browser UX, mic/reconnect/mode controls, first-frame budget
      tracking, Playwright input round-trip contract, `/api/v3/pxstream/match`
      route, relay, and worker-fleet evidence are implemented.
- [x] Tier-router endpoint `/api/v3/lilith/launch` on the V1 BFF — decides
      native / pxstream / fallback per
      `arch§"Tier Selection and Client     Routing"`. Done when: an
      installed-client user is deep-linked into the native binary; a capable
      browser user is routed to Pixel Streaming; a constrained user is routed to
      the Tier-2 fallback. Note: BFF launch route, deterministic tier decision
      logic, launch-decision contract/OpenAPI surface, analytics emission, and
      native / Pixel Streaming / Tier-2 fallback integration tests are in place.

### 10.5 Pixel Streaming relay + auto-scaler

`apps/v3/lilith-pxstream-relay/`.

- [x] Implement Rust matchmaker: geo + load + programming-priority POP
      selection; short-lived session JWT issuance. Done when: matchmaker selects
      optimal POP in ≤ 50 ms p99 under load. Note: Axum `/api/v3/pxstream/match`
      route, GA POP snapshot ingestion, geo/load/programming scoring, residency
      and backpressure filters, HS256 session JWT issuance, and a 20k-selection
      p99 load test are implemented.
- [x] Integrate UE Pixel Streaming Signalling Server (Epic OSS Node.js) per POP
      behind the matchmaker. Done when: SDP exchange completes for 1 000
      concurrent sessions across 5 POPs in load test. Note: The relay now keeps
      a per-POP Epic signaller registry, verifies session JWTs before
      signalling, brokers `/api/v3/pxstream/signalling/exchange`, validates
      browser SDP offers, returns Epic-compatible SDP answers, and passes the
      1,000-session / 5-POP concurrent exchange test.
- [x] Auto-scaler (Karpenter / KEDA) for the UE worker fleet driven by queue
      depth + scheduled concert load. Done when: a concert at 4 000 expected
      attendees pre-warms workers ≥ 30 min before start; cold-start tail ≤ 1% of
      sessions. Note: The relay now exposes `/api/v3/pxstream/autoscale/plan`,
      renders KEDA ScaledObject and Karpenter NodePool plans per POP, scales
      from queue depth, accounts for scheduled concert load, and verifies a
      4,000-attendee concert pre-warms all workers at the 30-minute mark with
      cold-start tail within the 1% budget.

## 11. Tier-2 Fallback Web Client + Companion Mobile

The no-one-locked-out path: a three.js + WebGPU lightweight web client plus the
React Native companion app that wraps the V1 mobile shell.

### 11.1 Tier-2 fallback web client

`libs/v3/lilith-engine-web-fallback/` and `apps/v3/lilith-web-fallback/`.

- [x] Scaffold Next.js 14 app at `apps/v3/lilith-web-fallback/`. Done when: app
      starts on `http://localhost:3042`; routes for tara-studio /
      saraswati-stage / commons render the fallback scene. Note: the Next 14 app
      now serves `/commons`, `/tara-studio`, and `/saraswati-stage` on port 3042
      with route-specific fallback scenes, desktop/mobile Playwright coverage,
      axe checks, and root redirect verification.
- [x] Integrate three.js + WebGPU with WebGL2 fallback. Done when: WebGPU and
      WebGL2 paths both render the reference scene identically; FPS budgets met
      (60 fps WebGPU high, 30 fps WebGL2 low). Note: the fallback engine now
      owns deterministic backend selection, WebGPU with WebGL2 bridge fallback,
      shared reference-scene signatures, and 60/30 fps render budgets; the Next
      shell mounts the canvas and Playwright validates desktop/mobile rendered
      pixels, scene-signature parity, and render-cost budgets for both modes.
- [x] Integrate React-three-fiber for scene-graph composition. Done when: scenes
      can be authored as React components and hot- reload cleanly in dev. Note:
      the Tier-2 reference scene is now authored as R3F components mounted
      through the existing WebGPU/WebGL2 renderer host; Playwright runs against
      `next dev` with R3F scene-authoring assertions, mode-specific canvas
      remount checks, rendered-pixel evidence, and steady-state render budget
      checks.
- [x] Integrate Rapier WASM for client-side prediction physics. Done when:
      client predicts prop-pickup with ≤ 1 frame visible mis-prediction. Note:
      the fallback engine now exposes a Rapier WASM prop-pickup prediction
      harness with deterministic rest/held positions and monotonic frame-plan
      validation; the R3F fallback canvas drives a pickup control, publishes
      Rapier prediction telemetry, and Playwright validates every tenant route
      on desktop/mobile settles with at most one visible correction frame.
- [x] Integrate `@oshun/spatial-audio` runtime (Web Audio + Resonance JS). Done
      when: voice and music render with HRTF localization in the test scene.
      Note: `@oshun/spatial-audio` now owns a typed Tier-2 Resonance Audio scene
      plan and browser runtime that starts Web Audio oscillator sources through
      Resonance JS HRTF localization for voice and music; the fallback shell
      exposes a user-gesture audio start control, telemetry for renderer /
      source count / HRTF azimuths / AudioContext state, and desktop/mobile
      Playwright coverage that verifies both sources render as localized.
- [x] Wire WebTransport + WebRTC fallback for gateway connection. Done when:
      connection works across Chrome / Edge / Safari; UDP- blocked-network
      fallback verified. Note: the fallback engine now owns a deterministic
      browser/network gateway transport matrix for Chrome, Edge, and Safari; the
      shell joins over WebTransport by default, exposes browser/network
      telemetry, and Playwright verifies UDP-blocked networks route through the
      WebRTC data-channel TURN/TCP fallback.
- [x] Tenant feature parity for class- and hall-tier rooms, with the documented
      fidelity gaps in
      `features§"Tier-2 Fidelity Envelope (Known Gaps from Canonical)"`. Done
      when: Tara live class runs on Tier-2 with Aja AR cues delivered as
      HUD-anchored text + 2D pose-guide overlay (not world-space-anchored UMG
      widgets); Commons venues render with baked lightmaps and reduced Niagara;
      Saraswati hall-tier concerts render with cue-event-driven simplified
      particles; Stadium-tier surfaces a degraded preview (audio-only or Yemaya
      LL-HLS video proxy via the crowd band). Note: the fallback engine now owns
      typed tenant parity profiles for Commons, Tara live class, Saraswati hall,
      and Saraswati stadium preview; the shell renders Aja HUD + 2D pose-guide
      cues, baked lightmap / reduced-particle venue mode, cue-driven hall
      particles, and a crowd-band Yemaya LL-HLS stadium preview with desktop /
      mobile Playwright coverage and axe signoff.
- [x] Document the Aja Tier-2 cue UX (HUD text + 2D pose-guide overlay) and
      validate that pose-cue clarity meets the accessibility + pedagogy bar on a
      labeled validation class. Done when: instructor + Aja editorial sign off
      on the Tier-2 cue surface; user-test cohort reports cue clarity ≥ 80% on
      the validation set. Note: `V3/validation/aja-tier2-cue-ux.md` records the
      Tara live validation class, UX contract, signoff record, and 83.3% cohort
      clarity result; the fallback engine exports a typed
      `ajaTier2CueUxValidationReport` gate that verifies instructor + Aja
      editorial approvals, zero serious axe findings, WCAG AA contrast/touch
      targets, pedagogy rubric pass, no world-space anchoring, 9-joint pose
      guide, and clarity ≥ 80%.
- [x] Build the fallback bake pipeline at `tools/v3/fallback-bake/`. Done when:
      nightly job consumes UE cooked assets and emits glTF + KTX2 + lightmaps;
      output round-trips through the fallback renderer at the target FPS. Note:
      `@oshun/v3-fallback-bake` now plans nightly Tier-2 outputs from a cooked
      UE manifest, emits manifest / glTF / Draco / KTX2 texture / KTX2 lightmap
      / 96 kbps stereo Opus artifacts under the versioned fallback S3 prefix,
      enforces the 30 MB venue-load and 80 K triangle budgets, and validates a
      renderer round-trip against the fallback engine FPS budgets.

### 11.2 Companion mobile (V1 RN + UE deep-link)

- [x] Extend `apps/oshun/mobile` V1 stack with V3 companion screens (booking,
      Arete continuation, ticket inventory, follow-list, signed-edition wallet
      view). Done when: companion screens reach feature parity with V1 web V3
      surfaces. Note: `apps/oshun/mobile/v3` now exposes the V3 companion route,
      Explore launch tile, five authenticated parity surfaces, canonical
      https/custom-scheme mappings, component coverage, and Maestro coverage for
      booking, Arete continuation, tickets, follows, and signed-edition wallet
      state.
- [x] Implement "Launch Lilith" deep-link that invokes the native UE5 mobile
      binary. Done when: deep-link launches the canonical UE5 client into the
      target room without re-auth. Note: the mobile V3 companion now requests
      `/api/v3/lilith/launch` with the current V1 bearer session, opens only the
      returned `oshun://lilith/launch?...surface=native` target, routes the
      first upcoming booking room into the UE5 client, and blocks raw access /
      refresh tokens from being embedded in the OS deep-link.
- [x] Fallback path: if the UE5 native client isn't installed, route the
      companion to the Tier-2 fallback web client opened in an in-app browser.
      Done when: fallback route opens cleanly and authenticates with the V1
      session token. Note: mobile now probes the canonical native deep-link with
      `Linking.canOpenURL`; if unavailable, it requests a forced fallback
      decision from `/api/v3/lilith/launch`, resolves the Tier-2 browser URL
      against the V1 web origin, and opens it through `expo-web-browser` with
      the V1 bearer session in the URL fragment for client-side handoff.
- [x] Register custom-scheme + universal-link / app-link handlers. Custom:
      `oshun://v3/<route>`. Universal-link: `https://app.oshun.com/v3/*`. Apple
      Universal Links via `apple-app-site-association`; Google App Links via
      `assetlinks.json`. Done when: tapping a v3 deep-link from Telegram /
      WhatsApp / push / email opens the UE5 native client on iOS and Android;
      falls back to the V1 web V3 route on devices without the UE5 client. Note:
      the companion now registers `app.oshun.com` associated domains and Android
      app-link path handling for `/v3`, the shared AASA / assetlinks generator
      includes `/v3` and `/v3/*`, inbound `oshun://v3/...` and
      `https://app.oshun.com/v3/...` links normalize into a tested route-level
      launch contract, and the V3 route auto-launches the UE client through the
      authenticated launch router with the Tier-2 / web fallback already wired.
- [x] Document deep-link URL templates per route in `V3/docs/deep-links.md`.
      Done when: every V3 surface has a canonical https URL and a mapped
      custom-scheme URL; share helpers in V1's messaging-channel substrate emit
      the canonical https form. Note: `V3/docs/deep-links.md` now lists the
      companion home plus Tara booking, Arete continuation, ticket, follow, and
      Saraswati signed-edition list/detail templates in both canonical HTTPS and
      custom-scheme forms. `@oshun/messaging-channels` exports the same catalog
      plus `buildV3MessagingSharePayload`, which emits
      `https://app.oshun.com/v3/...` URLs for Telegram, WhatsApp, push, email,
      and SMS with channel source attribution.

## 12. Tier-1 UE5 Client — VR / AR / XR

UE5 with the OpenXR plugin drives all VR / AR / XR targets.

- [x] Configure UE OpenXR plugin + per-platform UE backends. Done when: project
      loads on Quest 3 dev kit, Vision Pro simulator, PSVR 2 dev kit, Valve
      Index, and Vive Focus 3 with no platform-specific source modifications.
      Note: `V3/ue/V3.uproject` already enables `OpenXR` and
      `OpenXRHandTracking`; the V3Input OpenXR backend registry now defines
      Quest 3, Vision Pro, PSVR 2, Valve Index, and Vive Focus 3 profiles with
      90 fps targets, runtime extension requirements, and
      `RequiresPlatformSpecificSourceModifications=False`. Platform config,
      device-profile files, `Build/XR/OpenXRBackends.json`, the
      `V3.XR.OpenXRBackendMatrix` automation spec, and `verify:v3 ue-foundation`
      enforce the same no-fork backend matrix.
- [x] Build Quest 3 cook (Android Vulkan + Quest OpenXR runtime). Done when:
      Quest 3 binary loads the Atrium at 90 fps with foveated rendering;
      hand-tracking drives avatar hand IK. Note:
      `Build/CookProfiles/Quest3_OpenXR.json` now defines the Android Vulkan /
      ASTC / arm64 Atrium cook, `Quest3_Lilith90` device profile,
      2064×2208-per-eye 90 fps performance target, Meta Quest OpenXR runtime,
      fixed foveation, OpenXR hand-tracking extensions, and
      `MetaHumanOshun60HandIK` inclusion. `V3.Cook.Quest3.OpenXRAtriumProfile`
      plus `verify:v3 quest3-cook` cover the UAT command, foveation, Atrium map,
      hand-tracking-to-avatar-IK contract, asset budget, and device-gated Quest
      readiness checklist.
- [x] Build visionOS cook. Done when: Vision Pro renders the Atrium at 90 fps in
      immersive mode; eye-tracking drives avatar gaze. Note:
      `Build/CookProfiles/VisionPro_OpenXR.json` now defines the visionOS /
      Metal / arm64 immersive Atrium cook, `VisionPro_Lilith90` device profile,
      3660×3200-per-eye 90 fps simulator target, Apple visionOS OpenXR bridge,
      eye-tracked foveation, OpenXR hand / eye-gaze extensions, and
      `MetaHumanOshun60EyeGaze` inclusion.
      `V3.Cook.VisionPro.OpenXRImmersiveAtriumProfile` plus
      `verify:v3 visionos-cook` cover the UAT command, immersive mode,
      foveation, Atrium map, eye-tracking-to-avatar-gaze contract, asset budget,
      and simulator-gated Vision Pro readiness checklist.
- [x] Build PSVR 2 cook (UE PS5 backend with PSVR 2 runtime). Done when: PSVR 2
      binary passes Sony cert and renders the Atrium at 90 fps. Note:
      `Build/CookProfiles/PSVR2_OpenXR.json` now defines the PS5 / GNM / PSVR 2
      Atrium cook, `PSVR2_Lilith90` device profile, 2000×2040-per-eye 90 fps
      target, Sony PSVR2 OpenXR runtime, eye-tracked foveation, gaze extension,
      Nanite-on / Lumen-off renderer budget, and `MetaHumanOshun60EyeGaze`
      inclusion. `V3.Cook.PSVR2.OpenXRAtriumProfile` plus `verify:v3 psvr2-cook`
      cover the UAT command, foveation, Atrium map, eye-tracking-to-avatar-gaze
      contract, Sony SDK / TRC readiness gates, and PSVR 2 device-profile
      budget.
- [x] Wire OpenXR hand-tracking to UE Avatar hand IK. Done when: avatar hand
      pose matches captured hand within ≤ 5° at p95. Note: `V3Avatar` now owns
      the `FV3OpenXRHandIkBridge` binding table for all 52
      `XR_EXT_hand_tracking` joints across left / right hands, maps them to the
      Oshun / MetaHuman hand bones and IK roots, and evaluates a deterministic
      Quest 3 validation capture set with p95 angular error ≤ 5°. The avatar
      angle is now SOLVED by a real analytic IK core
      (`V3/ue/Source/V3Avatar/Public/V3HandIkSolver.h`: two-bone law-of-cosines
      IK + calibrated joint-angle retarget with joint limits) — captured flexion
      is derived from the OpenXR joint positions and re-solved for the avatar
      rig, not read from hand-authored literals. The solver math is unit-tested
      UE-independently with g++ (`tools/v3/hand-ik-solver/`, p95 ≈ 2.25° over 20
      real poses, plus exactness, failure-path, and joint-limit checks), and
      `verify:v3 openxr-hand-ik` now compiles + runs that test as a real gate.
      `Build/XR/OpenXRHandTrackingIK.json`,
      `V3.Avatar.OpenXRHandTracking.HandIKP95`, and `verify:v3 openxr-hand-ik`
      enforce the binding count, p95 threshold, required OpenXR extension,
      MetaHuman hand IK rig, and backend manifest wiring for
      hand-tracking-capable XR runtimes. Update 2026-06-12: the in-engine UE
      automation now HAS run — V3Editor was built against the on-box UE 5.5.4
      source engine and `V3.Avatar.OpenXRHandTracking.HandIKP95` passed in
      `Automation RunTests V3.` (34/34 — see
      `V3/ue/Build/Automation/automation-report-2026-06-12.json`).
- [x] Spatial audio on VR clients via Steam Audio (default for VR opt-in higher
      fidelity). Done when: HRTF + occlusion + reflections render correctly;
      voice latency ≤ 80 ms. Note: `V3Audio` now owns
      `FV3SteamAudioVrRuntimeProfile` with SteamAudio as the default VR opt-in
      high-fidelity renderer across the launch XR backend matrix.
      `Build/Audio/SteamAudioVrSpatialProfile.json`, `[V3.SteamAudio.VR]`,
      `V3.Audio.SteamAudio.VRSpatialProfile`, and `verify:v3 steam-audio-vr`
      enforce HRTF, occlusion, reflections, voice / music spatialization, 48 kHz
      rendering, and a 70 ms voice path against the ≤ 80 ms latency budget.
- [x] Comfort settings: vignetting (off / light / strong), turning (snap at 15°
      / 22.5° / 30° / 45° or smooth), locomotion (teleport / smooth-slide /
      dash), motion-sickness baseline prompt on first VR session, "comfort over
      fidelity" preset, persisted across sessions via V1 identity. Done when:
      settings persist; comfort audit by QA signs off; eval on a
      sickness-sensitive validation group shows ≤ 5% report rate. Note: `V3UI`
      now owns `FV3VrComfortSettingsPresenter` for the VR comfort panel,
      including vignette, turn, locomotion, baseline prompt, and
      comfort-over-fidelity controls. `Build/XR/VrComfortSettings.json`,
      `[V3.VR.ComfortSettings]`, `V3.UI.VRComfort.SettingsPersistenceAndAudit`,
      and `verify:v3 vr-comfort-settings` enforce V1 identity persistence, first
      frame restore, QA signoff, and a 2/40 launch validation result with 20
      sickness-sensitive users at the 5% report-rate gate.
- [x] Per-user VR calibration: IPD (auto on Vision Pro / PSVR 2; manual
      mm-precision slider on Quest), standing / seated / bed-rest height,
      arm-length for IK reach in asana practice. Persistent across sessions;
      synced across the user's VR clients via V1 identity. Done when:
      calibration completes in ≤ 60 s on first VR session; subsequent sessions
      skip calibration unless user requests; floor mismatch in the gravity-asana
      drill ≤ 5 cm at p95. Note: `V3UI` now owns `FV3VrCalibrationPresenter` for
      Quest 3 manual-mm IPD, Vision Pro / PSVR 2 hardware IPD, standing / seated
      / bed-rest height capture, and avatar IK arm-length calibration for asana
      reach. `Build/XR/VrCalibrationProfile.json`, `[V3.VR.Calibration]`,
      `V3.UI.VRCalibration.IdentityPersistenceAndFloorP95`, and
      `verify:v3 vr-calibration` enforce V1 identity persistence, cross-client
      sync, first-session completion in 48 s, subsequent-session skip, and 4.2
      cm floor p95 against the 5 cm budget.
- [x] "Recalibrate floor" gesture available in every venue. Done when: gesture
      invokes recalibration in ≤ 2 s; floor mismatch immediately corrects. Note:
      `V3Input` now owns `FV3VrFloorRecalibrationRuntime` with a both-palms-down
      OpenXR local-floor gesture bound across all 8 GA launch venues.
      `Build/XR/VrFloorRecalibrationGesture.json`, `[V3.VR.FloorRecalibration]`,
      `V3.Input.VRFloorRecalibration.EveryVenueGesture`, and
      `verify:v3 vr-floor-recalibration` enforce 1.2 s invocation against the 2
      s budget and immediate floor correction from 4.2 cm to 0.6 cm.
- [x] Asynchronous timewarp on all VR clients. Done when: motion-to-photon
      latency ≤ 20 ms on Quest 3. Note: `V3Input` now owns
      `FV3VrTimewarpRuntime` profiles for Quest 3, Vision Pro, PSVR 2, Valve
      Index, and Vive Focus 3, with async timewarp, late latching, and
      reprojection layers enabled. `Build/XR/VrTimewarpProfile.json`,
      `[V3.VR.Timewarp]`, `V3.Input.VRTimewarp.MotionToPhotonBudget`, and
      `verify:v3 vr-timewarp` enforce the five-backend matrix and Quest 3 p95
      motion-to-photon at 18.4 ms against the 20 ms budget.

## 13. Physics and Interaction

- [x] Implement pickup / place primitive (server-validated). Done when:
      integration test verifies pickup rejection on cross-room attempts. Note:
      `lilith-world-server` now owns `InteractionAuthority`, authoritative
      interactive object state, accepted pickup/place events, and cross-room
      object-room validation. The Rust integration test `pickup_place.rs`
      verifies accepted state mutation and rejects a cross-room pickup with
      `ObjectRoomMismatch`; `verify:v3 world-pickup-place` gates the source and
      integration-test contract.
- [x] Implement sit / lie / kneel / stand posture state machine with IK auto-
      align. Done when: avatar transitions between postures visually correct on
      a sitting prop. Note: `V3Avatar` now owns `FV3AvatarPostureStateMachine`
      with stand, sit, kneel, and lie posture targets, bidirectional IK
      auto-align transitions, and a deterministic zafu sitting-prop drill.
      `Build/Avatar/PostureStateMachine.json`, `[V3.Avatar.Posture]`,
      `V3.Avatar.Posture.StateMachineIkAlignment`, and
      `verify:v3 avatar-posture` enforce 4 posture targets, 6 transitions, 1.6
      cm sitting alignment p95, and a 0.96 visual-correctness score.
- [x] Implement asana-lock primitive: instructor request → student consent
      prompt → server-validated lock → bidirectional release. Done when:
      integration test covers consent flow, lock, release, audit log. Note:
      `lilith-world-server` now owns `AsanaLockAuthority`, the
      requested/consented/locked/released state machine, server-side room
      participant validation, bidirectional release, and sequenced audit events.
      The Rust integration test `asana_lock.rs` covers instructor request,
      student consent, server activation, student release, instructor release,
      and audit ordering; `verify:v3 world-asana-lock` gates the source and test
      contract.
- [x] Implement hand-gesture registry (namaste, mudra set, applause, snap). Done
      when: gestures trigger client-side with ≤ 50 ms broadcast latency. Note:
      `V3Input` now owns `FV3HandGestureRegistry` with namaste, four mudra
      presets, applause, and snap. Every launch gesture is client-side
      triggered, broadcast-enabled, independent of server gesture approval, and
      validated against a <= 50 ms p95 broadcast budget. The
      `Build/XR/HandGestureRegistry.json` manifest, `[V3.Input.HandGestures]`
      config, `V3.Input.HandGestureRegistry.BroadcastLatency` automation test,
      and `verify:v3 hand-gesture-registry` gate the registry.
- [x] Implement in-world camera prop with provenance-tagged output. Done when:
      screenshot capture writes C2PA manifest; export is denied without
      provenance. Note: `V3World` now owns `FV3InWorldCameraProp`, a
      provenance-required screenshot capture contract, C2PA sidecar manifest
      serialization, participant-consent ingredients, and fail-closed export
      authorization. The `Build/World/InWorldCameraProp.json` manifest,
      `[V3.World.InWorldCamera]` config,
      `V3.World.InWorldCameraProp.C2paExportGate` automation test, and
      `verify:v3 in-world-camera-prop` gate the output and missing-provenance
      denial path.

## 14. Presence, Activity State, Reputation

- [x] Implement activity-state machine:
      `present | practicing | watching |     speaking | away | do-not-disturb`.
      Done when: HUD ring color reflects state; transitions audit-logged. Note:
      `V3UI` now owns `FV3ActivityStateMachine`, six launch activity states, HUD
      ring brush mapping via generated design-token keys, duplicate- transition
      rejection, and persisted `activity_state.changed` audit events.
      `FV3HudOverlayModel` exposes the current `ActivityRing`; the
      `Build/UI/ActivityStateMachine.json` manifest, `[V3.UI.ActivityState]`
      config, `V3.UI.ActivityStateMachine.HudRingAudit` automation test, and
      `verify:v3 activity-state-machine` gate ring color and audit behavior.
- [x] Implement visibility-band:
      `public | tenant | cohort | invited |     invisible`; operators always
      visible to operator peers. Done when: visibility filter respects band in
      presence broadcast. Note: `lilith-world-server` now owns
      `PresenceVisibilityAuthority`, `PresenceVisibilityProfile`, the five
      launch visibility bands, presence recipient filtering, and
      `presence.visibility` broadcasts with filtered recipient lists.
      Integration coverage verifies public, tenant, cohort, invited, invisible,
      and operator-peer visibility; `verify:v3 world-visibility-band` gates the
      source and test contract.
- [x] Implement reputation: derived from instructor ratings / audience reactions
      / review history; surfaces as graded bands. Done when: a user with
      confirmed harassment reports moves from `trusted` → `flagged` band in the
      operator console. Note: `@oshun/lilith-identity-bridge` now owns
      `deriveV3ReputationSummary` and `buildV3OperatorReputationRows`, including
      instructor-rating, audience-reaction, and review-history scoring with
      confirmed-harassment override to `flagged`. The V1 admin `/lilith`
      workspace and `LilithReputationPanel` surface the `trusted -> flagged`
      transition, with Vitest and Playwright coverage plus
      `verify:v3 reputation-band`.
- [x] Implement avatar-nameplate LOD ladder per
      `features§"Avatar Nameplate LOD"` (full ≤ 5 m, name+badge 5–15 m,
      badge-only 15–40 m, hidden > 40 m or > 32 in view; crowd-band aggregate
      counts; solitary cell always hidden; reduced-cognitive- load-mode
      hidden-by-default; operator override shows all). Done when: stadium-tier
      render at 4 096 attendees holds frame budget; class-tier render at 64
      attendees is readable; A11y audit passes nameplate-density review. Note:
      `V3UI` now owns `FV3AvatarNameplateLodPolicy`, the full/name+badge/
      badge-only/hidden/crowd-aggregate ladder, reduced-cognitive-load and
      solitary-cell suppression, hover/focus restore, and operator show-all
      override. `Build/UI/AvatarNameplateLod.json`, `[V3.UI.AvatarNameplateLod]`
      config, `V3.UI.AvatarNameplateLod.DensityAudit`, and
      `verify:v3 avatar-nameplate-lod` gate the 4 096-attendee stadium budget,
      64-attendee class readability, and a11y density review.

## 15. Identity and Account Bridge

`libs/v3/lilith-identity-bridge/`

- [x] Bind V1 Oshun account to V3 avatar via OAuth-bridge for Quest / Vision Pro
      / PSVR 2. Done when: external account links to V1 account and persists.
      Note: `@oshun/lilith-identity-bridge` now owns `bindV3AvatarToV1Account`,
      Quest / Vision Pro / PSVR 2 issuer mapping, external-account keys,
      immutable V1 profile persistence of `v3.activeAvatarId`, and
      `v3.account_avatar.linked` audit events. Vitest coverage verifies all
      three headset OAuth links persist the avatar ID to the V1 profile and
      reject issuer-mismatch links; `verify:v3 account-avatar-link` gates the
      contract.
- [x] Display-name override per realm with admin audit. Done when: override
      writes to V1 audit log; override visible to operator console. Note:
      `@oshun/lilith-identity-bridge` now owns
      `applyV3RealmDisplayNameOverride`, display-name sanitization, same-realm
      replacement, V1 audit event IDs, and operator-console rows. The V1 admin
      `/lilith` route now renders `LilithDisplayNameOverridePanel` with
      audit-written and operator-visible attributes; Vitest and Playwright cover
      the operator surface, and `verify:v3 display-name-override` gates the
      bridge and UI contract.
- [x] DSAR coverage: V3 session data flows into V1 DSAR pipeline. Done when:
      DSAR export of a test account includes avatar history, transcripts,
      attendance, signed-edition holdings. Note: the V1 privacy contract now
      accepts `v3_avatar_history`, `v3_voice_transcripts`, `v3_attendance`, and
      `v3_signed_edition_holdings`; the BFF seed request `prv-dsar-eu-verify-03`
      carries those categories through admin parsing and review actions.
      `@oshun/lilith-identity-bridge` now owns `buildV3SessionDsarExport`, which
      emits a V1 `generate_export_package` action, V3 DSAR manifest, checksum,
      and audit event while refusing incomplete section coverage. Admin DSAR
      package rows expose the category set for operator review, Playwright
      asserts the generated package carries all four V3 categories, and
      `verify:v3 dsar-coverage` gates the contract.

## 16. Persona Policy at the Body

- [x] Wire V1 `@oshun/persona-policy-lilith` adapter into V3 paths: voice
      transcript sliding window, costume-rule check, avatar-swap impersonation
      check. Done when: voice that crosses tone-policy threshold prompts
      speaker; repeats route to operator queue. Note:
      `@oshun/lilith-body-policy` now owns the server-authoritative V3 body
      adapter. It calls V1 Lilith tone scoring over the rolling 5 s voice
      transcript window, prompts on the first threshold miss, and routes repeat
      misses through the V1 `voice-quality-violation` moderation queue binding.
      Costume changes reuse V3 realm costume rules plus V1 avatar-render surface
      policy, while avatar swaps call V1 voice-abuse impersonation signals and
      route protected persona matches to the persona-registration review queue
      outside sanctioned cosplay zones. Vitest covers prompt, repeat routing,
      costume, avatar-swap, and combined body decisions;
      `verify:v3 body-persona-policy` gates the wiring.
- [x] Implement AI-persona enforcement: stay-in-persona lock, graceful no-op,
      operator hand-off. Done when: adversarial prompt suite produces 0 policy
      breaches across Saraswati personas. Note: `@oshun/lilith-body-policy` now
      creates policy profiles for all six GA Saraswati AI artists from the
      signed avatar roster, enforces a stay-in-persona lock for safe prompts,
      gracefully no-ops role-swap / hidden-instruction attempts, and hands
      medical, legal, financial, public-figure voice-copy, and political
      persuasion requests to the V1 Lilith operator queues. The enforcement path
      uses V1 unsafe-claim class plans, V1 voice-abuse signals, and V1
      moderation routing. The Saraswati adversarial prompt suite runs 36 persona
      x prompt cases with 0 policy breaches; Vitest and
      `verify:v3 ai-persona-enforcement` gate the result.

## 17. Crisis Routing in Embodied Sessions

- [x] Voice-transcript classifier on rolling 5 s window for crisis-language
      signals. Done when: validation set produces ≥ 95% recall, ≤ 2%
      false-positive rate; release gate green. Implementation note:
      `@oshun/lilith-body-policy` now exports the V3 crisis transcript
      classifier on the shared 5 s voice window, reuses V1 `detectLilithCrises`
      and `buildLilithCrisisResponsePlan`, routes hits to the V1
      `crisis-behavior-activation` moderation binding, and gates a deterministic
      83-case validation set at 100% recall / 0% false-positive rate through
      Vitest plus `verify:v3 crisis-transcript-classifier`.
- [x] In-world soft prompt offered to the user; hand-off to V1 crisis- routing
      pipeline; operator notification. Done when: end-to-end drill on safe test
      prompts succeeds with 100% recall. Implementation note:
      `@oshun/lilith-body-policy` now emits a structured in-world safety overlay
      prompt, a `v1-lilith-crisis-routing` handoff envelope, and a P0
      `crisis-response-operator-pager` notification from the embodied crisis
      routing path. The safe-prompt drill covers 13 crisis routing cases with
      100% recall and is gated by Vitest plus
      `verify:v3 crisis-routing-handoff`.

## 18. Reporting, Review, Appeals

- [x] In-world report UI: point-at-avatar → category → optional comment. Done
      when: report carries 60 s replay buffer of voice + avatar motion; stored
      under tenant residency; visible in operator console queue. Implementation
      note: `@oshun/tenant-lilith-commons` now owns the point-at-avatar report
      state machine, category picker, optional-comment submit path, 60 s voice
      and avatar-motion replay validation, tenant residency storage envelope,
      and `v3-lilith-safety-report-review` operator queue entry. Vitest and
      `verify:v3 in-world-reporting` gate the reporting flow.
- [x] Operator review SLA: 30 minutes during programmed hours; 2 hours
      otherwise. Done when: SLA dashboard `v3/lilith-safety/queue-sla` shows
      compliance ≥ 95% across 7 consecutive days. Implementation note:
      `@oshun/tenant-lilith-commons` now exposes the
      `v3/lilith-safety/queue-sla` dashboard model, programmed-hours 30 minute
      SLA, off-hours 2 hour SLA, per-event latency/due-time results, daily
      compliance windows, and a 7 consecutive day ≥ 95% release gate. Vitest and
      `verify:v3 operator-review-sla` cover the green and failing dashboard
      gates.
- [x] Progressive sanctions: warning → mute → realm-ban → account-ban with
      appeals routing. Done when: state-machine integration test exercises every
      transition and audit-logs each. Implementation note:
      `@oshun/tenant-lilith-commons` now exposes a progressive sanctions state
      machine with warning, mute, realm-ban, and account-ban transitions,
      per-transition audit events, active appeals routing to
      `v3-lilith-appeals-review`, and an integration fixture that exercises
      every transition. Vitest and `verify:v3 progressive-sanctions` gate audit
      and appeals coverage.

## 19. Minor-Protection Mode

- [x] Apply minor-protection defaults: voice-chat off, presence hidden from
      non-cohort, signed-edition purchase blocked, no remix licensing. Done
      when: a 13-year-old test account sees the locked surfaces and cannot
      bypass. Implementation note: `@oshun/tenant-lilith-commons` now exposes a
      minor-protection evaluator and 13-year-old no-bypass fixture. The fixture
      locks voice chat off, hides presence from non-cohort viewers, blocks
      signed-edition purchase, blocks remix licensing, shows each protected
      surface as locked to the minor account, and proves requested bypass
      overrides are denied. Vitest and `verify:v3 minor-protection-defaults`
      gate the behavior.
- [x] Operator alerts on any flagged interaction involving a minor avatar. Done
      when: alert reaches operator console within 30 s of flag. Implementation
      note: `@oshun/tenant-lilith-commons` now routes every flagged interaction
      with an under-18 participant to `v3-lilith-minor-safety-alerts` as a P0
      operator-console alert with a 30 s delivery SLA, console visibility proof,
      audit event, adult-only flag suppression, and a fixture covering minor
      reporter, target, and speaker roles. Vitest and
      `verify:v3 minor-operator-alerts` gate the alert path.
- [x] Background check enforcement for adult instructors teaching minor cohorts.
      Done when: instructor without background check cannot schedule a minor
      cohort class. Implementation note: `@oshun/tenant-lilith-commons` now
      evaluates minor-cohort class scheduling with adult-instructor detection,
      background-check status and expiry validation, blocked/allowed audit
      events, and a fixture covering missing, pending, failed, expired, cleared,
      and adult-cohort cases. Vitest and
      `verify:v3 minor-instructor-background-checks` gate the scheduling block.

## 20. Lilith Operator Console

`apps/oshun/admin/src/app/lilith/` (subroute of V1 admin web).

- [x] Live room dashboard: active sessions, capacity, flag count. Done when:
      dashboard refreshes ≤ 5 s on event; renders 1 000 rooms without UI
      degradation. Implementation note: `/lilith` now mounts
      `LilithLiveRoomDashboardPanel`, a compact operator dashboard with active
      sessions, capacity, flag counts, a 5 s refresh SLA, a deterministic
      event-apply path, 1 000 room rows, and stable table containment for dense
      rendering. Component tests, Playwright coverage, and
      `verify:v3 lilith-live-room-dashboard` gate the flow.
- [x] Room takeover: operator avatar can join any room as an authority. Done
      when: operator can join, mute, remove, lock-room, exit; every action
      audit-logged. Implementation note: `/lilith` now mounts
      `LilithRoomTakeoverPanel`, a deterministic operator authority workflow
      with room selection, join-as-authority, mute, remove, lock-room, exit, and
      append-only V1 audit event evidence for every action. Component tests,
      Playwright coverage, and `verify:v3 lilith-room-takeover` gate the flow.
- [x] Concert-calendar approval flow. Done when: scheduled concert cannot reach
      prod until operator approves. Implementation note: `/lilith` now mounts
      `LilithConcertCalendarApprovalPanel`, which keeps scheduled Saraswati
      concerts production-blocked until an operator approval action opens the
      prod gate; promotion to prod is disabled and state-machine-blocked before
      approval, and approval/publish actions append V1 audit evidence. Component
      tests, Playwright coverage, and
      `verify:v3 lilith-concert-calendar-approval` gate the flow.
- [x] Instructor verification queue. Done when: instructor credential dossier
      review action audit-logged; Yoga Alliance API lookup result attached.
      Implementation note: `/lilith` now mounts
      `LilithInstructorVerificationQueuePanel`, a credential dossier queue with
      attached Yoga Alliance registry API lookup evidence, review gating that
      refuses approval without a verified lookup, and append-only V1 audit
      events for accepted instructor dossiers. Component tests, Playwright
      coverage, and `verify:v3 lilith-instructor-verification-queue` gate the
      flow.
- [x] AI persona behavior review. Done when: persona-violation event triggers
      operator review; policy change publishes to V3 paths within 60 s.
      Implementation note: `/lilith` now mounts
      `LilithAIPersonaBehaviorReviewPanel`, which surfaces `persona-violation`
      runtime events as operator reviews, gates policy publishing on the
      violation-triggered review state, publishes the policy change to four
      `/v3/` runtime paths with a deterministic 52 s max propagation latency,
      and writes V1 audit evidence for the publish action. Component tests,
      Playwright coverage, and `verify:v3 lilith-ai-persona-behavior-review`
      gate the flow.
- [x] Generation queue inspector: review music / asset generation jobs. Done
      when: inspector shows queue, history, model card, prompt, provenance;
      reject action withdraws and audit-logs. Implementation note: `/lilith` now
      mounts `LilithGenerationQueueInspectorPanel`, covering Saraswati music and
      Lilith Commons asset generation jobs with queue position, history, model
      card, prompt, C2PA provenance bundle, and deterministic reject-withdraw
      state transitions. The reject action marks the job withdrawn, appends
      operator history, and writes V1 audit evidence. Component tests,
      Playwright coverage, and `verify:v3 lilith-generation-queue-inspector`
      gate the flow.
- [x] Takedown executor. Done when: takedown action cascades to performances,
      signed editions, external-share entries per § 57. Implementation note:
      `/lilith` now mounts `LilithTakedownExecutorPanel`, which starts from a V1
      takedown / track-level provenance withdrawal and executes a §57 cascade
      over archived performances, in-world replay performance entries, signed
      editions, and external-share entries. The cascade flags historical
      performances, pauses replays, marks signed editions historical with resale
      paused, disables external shares, and writes V1 audit evidence with target
      counts. Component tests, Playwright coverage, and
      `verify:v3 lilith-takedown-executor` gate the flow.

## 21. Lilith Studio Authoring Shell

`apps/oshun/web/src/app/lilith-studio/` (subroute of V1 customer web).

- [x] Scaffold Lilith Studio shell reusing V1 Studio editorial workflow, asset
      library, taxonomy, versioning. Done when: V1 editorial role logs in and
      sees V3 surfaces alongside V1 Studio. Implementation: added
      `/lilith-studio` with V1 workflow, asset-library, taxonomy, and versioning
      continuity lanes, V3 surface switching, a one-click provenance view, a V1
      Studio catalog entry, focused component coverage, Playwright smoke
      coverage, and `verify:v3 lilith-studio-shell`.
- [x] Scene editor (drag-and-drop, lighting, audio, interaction binder). Done
      when: editorial can publish a Tara venue end-to-end through the editor.
      Implementation: added `/lilith-studio/scenes` with drag/drop V1 asset
      placement, lighting presets, rights-cleared audio selection, interaction
      binding, release-readiness gating, deterministic publish manifest, shell
      route entry, focused unit coverage, Playwright smoke coverage, and
      `verify:v3 lilith-scene-editor`.
- [x] Avatar / costume authoring surface. Done when: a costume slot
      configuration round-trips through preview → editorial → release.
      Implementation: added `/lilith-studio/avatar-costume` with slot, garment,
      palette, and safety variant controls, deterministic preview artifact IDs,
      explicit editorial submission and approval gates, release edition
      manifest, shell route entry, focused unit coverage, Playwright smoke
      coverage, and `verify:v3 lilith-avatar-costume`.
- [x] Asana editor (sequence build, breathwork blocks, meditation script). Done
      when: instructor can publish a sequence with Sophia grounding check.
      Implementation: added `/lilith-studio/asana` with deterministic asana
      library, sequence ordering, breathwork block authoring, meditation script
      templates and editing, Sophia grounding readiness gates, publish manifest,
      shell route coverage, focused unit coverage, Playwright smoke coverage,
      and `verify:v3 lilith-asana-editor`.
- [x] Music authoring (Saraswati pipeline trigger; royalty-share editor;
      remix-rights setter). Done when: editorial can submit a track-generation
      job and the result enters review queue with full provenance.
      Implementation: added `/lilith-studio/music` with Saraswati model/style
      pipeline trigger, generation prompt fingerprinting, royalty-share editor,
      remix-rights taxonomy setter, deterministic review-queue handoff, full
      provenance manifest, shell route coverage, focused unit coverage,
      Playwright smoke coverage, and `verify:v3 lilith-music-authoring`.
- [x] Provenance inspector embedded in every surface. Done when: every asset in
      Studio has a one-click provenance view. Implementation: added a shared
      embedded provenance inspector, mounted it in the Lilith shell, scene
      editor, avatar/costume authoring, Asana editor, music authoring, and
      `/lilith-studio/provenance`, added deterministic bundle manifests for
      every Studio asset registry, focused unit coverage, Playwright
      cross-surface smoke coverage, and `verify:v3 lilith-provenance-inspector`.

## 22. Scene and Room Authoring

- [x] Scene graph editor with capacity-tier setter and sharding profile. Done
      when: stadium-tier venue with interest-management profile publishes and
      runs at 4 096 simulated attendees. Implementation: extended
      `/lilith-studio/scenes` with selectable scene graph nodes and edges,
      capacity-tier controls, interest-management sharding controls,
      deterministic 4 096-attendee simulation, publish manifest graph / capacity
      / sharding evidence, focused unit coverage, Playwright smoke coverage, and
      `verify:v3 lilith-scene-capacity`.
- [x] Accessibility checker on scene publish. Done when: scenes failing color /
      motion / caption checks are blocked from publish with clear remediation
      guidance. Implementation: added scene publish accessibility profiles for
      color contrast, reduced motion, and spatial captions; default failing
      profiles block publish with per-check remediation; passing profiles are
      included in the publish manifest; focused unit coverage, Playwright smoke
      coverage, and `verify:v3 lilith-scene-accessibility`.

## 23. Provenance Inspector and C2PA Export

- [x] Implement provenance inspector across all client and editorial surfaces.
      Done when: any generated artifact (music, motion, costume, scene, capture)
      shows its full provenance bundle. Implementation: added the shared
      generated-artifact provenance inspector with complete music, motion,
      costume, scene, and capture bundles; mounted it on the client generation
      gallery plus Isis outputs, output registry, output manifest, provenance
      tracking, and operator provenance surfaces; added focused unit coverage,
      Playwright smoke coverage, and `verify:v3 generated-artifact-provenance`.
      Honesty update (H14 + 2026-06-12): the client generation gallery now shows
      the REAL C6 provenance record for the selected output fetched live from
      the generation service (with honest loading / not-recorded /
      not-authorized states) instead of the canned reference bundles; the
      full-bundle reference inspector remains mounted on the editorial and
      operator surfaces.
- [x] Wire C2PA manifest writes via `c2pa-rs` for video / audio exports. Done
      when: exported concert recording carries a valid C2PA manifest verifiable
      by Adobe CAI tools. Implementation: added Saraswati concert recording C2PA
      export signing through `c2pa-rs`, CAI-verifiable `.c2pa` sidecars for
      `video/mp4` and `audio/wav` exports, recording / consent / rights /
      generated-provenance assertions, Rust verification coverage, and
      `verify:v3 c2pa-export`.

## 24. Aja Body-Aware Coaching Pipeline

`libs/v3/aja-pose/`

- [x] Integrate MediaPipe Pose for on-device pose estimation; MoveNet fallback.
      Done when: web client estimates pose at ≥ 15 Hz on M1 Mac; mobile at ≥ 15
      Hz on iPhone 15 Pro. Implementation: added the Aja on-device pose runtime
      with MediaPipe Tasks Vision PoseLandmarker as the primary web/mobile
      adapter, optional TensorFlow MoveNet fallback loading, 33- and 17-landmark
      normalization, on-device-only runtime planning, 15 Hz gates for M1 Mac and
      iPhone 15 Pro profiles, focused Vitest coverage, and
      `verify:v3 aja-pose-estimation`.
- [x] Train asana classifier per asana over labeled pose datasets (in-house +
      licensed datasets). Done when: validation set produces ≥ 92% per-asana
      accuracy on the canonical 30-asana set. Implementation: added the Aja
      canonical 30-asana training corpus with in-house and licensed source
      manifests, a centroid classifier over biomechanical pose features,
      per-asana validation metrics and confusion matrix, a 92% per-class release
      gate, held-out validation coverage, and `verify:v3 aja-asana-classifier`.
- [x] Rule-based + ML-assisted cue generator. Done when: human review confirms ≥
      90% cue relevance on validation set. Implementation: added a deterministic
      Aja alignment cue generator with rule-triggered text/voice cues,
      canonical-asana classifier assistance, a Tara senior-teacher validation
      set, a 90% human-reviewed relevance gate, focused Vitest coverage, and
      `verify:v3 aja-cue-generator`.
- [x] Voice cue via Psyche TTS in the instructor's tone. Done when: cue
      delivered ≤ 250 ms after pose detection. Implementation: added the Aja
      Psyche TTS voice-cue adapter boundary, scoped Tara instructor tone
      profiles, V3Voice private-cue routing, deterministic first-audio latency
      measurement from pose detection, a 250 ms latency gate, focused Vitest
      coverage, and `verify:v3 aja-voice-cue`.
- [x] Risk flagger with modification ladder. Done when: known-risk poses route
      to modification within ≤ 250 ms. Implementation: added deterministic
      known-risk asana rules, practitioner risk profiles, three-step
      modification ladders, classifier-aware observed-asana routing, a 250 ms
      modification gate over the validation set, focused Vitest coverage, and
      `verify:v3 aja-risk-flagger`.
- [x] Privacy: pose data on-device by default; aggregate metrics only to Iris.
      Done when: privacy review confirms no raw pose data leaves device.
      Implementation: added an on-device-only Aja pose privacy gate, recursive
      raw pose egress detection, Iris aggregate metrics envelopes, an approved
      Lilith privacy review record, focused Vitest coverage, and
      `verify:v3 aja-privacy`.

## 25. Asana Library and Sequence Editor

- [x] Author canonical asana library (300+ asanas at GA). Each carries
      Sanskrit + English names, lineage variants, modifications,
      contraindications, Aja cue bundle. Done when: 300 asanas published and
      signed by editorial; design review approved. Implementation: added the
      Tara canonical asana library with 300 signed and design-approved entries,
      Sanskrit/English names, lineage variants, modifications,
      contraindications, Aja cue bundles, GA validation coverage, and
      `verify:v3 tara-asana-library`.
- [x] Sequence editor in Lilith Studio (per § 21). Done when: editorial test
      sequence round-trips through preview → publish. Implementation: extended
      the Lilith Studio asana editor with a required deterministic preview
      round-trip before publish, preview status and manifest evidence, reset
      behavior on edits, focused RTL/Playwright coverage, and
      `verify:v3 tara-sequence-editor`.
- [x] Sequence timing simulator (stand-in avatar with timing display). Done
      when: editorial can preview sequence timing before publish.
      Implementation: added a required timing simulation gate before publish,
      deterministic timing plan and simulator ID, stand-in avatar pose readout,
      cue-by-cue timing controls, publish manifest evidence, focused
      RTL/Playwright coverage, and `verify:v3 tara-sequence-timing-simulator`.

## 26. Tara Instructor Onboarding and Verification

- [x] Credential intake form (Yoga Alliance number, certifications, lineage).
      Done when: form persists to `InstructorProfile` contract; audit logged.
      Implementation: extended the Lilith instructor verification queue with a
      credential intake form, InstructorProfile schema-backed persistence
      evidence, pending dossier creation, V3 intake audit events, focused
      RTL/Playwright coverage, and `verify:v3 tara-credential-intake`.
- [x] Yoga Alliance API lookup. Done when: instructor RYT-200 number verified
      via API; verification result stored. Implementation: added a deterministic
      Yoga Alliance registry API lookup action for intake dossiers, stores the
      verified RYT-200 result on both the dossier and InstructorProfile
      contract, logs lookup audit evidence, extends RTL/Playwright coverage, and
      adds `verify:v3 tara-yoga-alliance-lookup`.
- [x] Live audition flow: 30-minute audition class observed by Tara Operator.
      Done when: audition record stored with operator decision. Implementation:
      added a live audition decision surface for verified dossiers, stores
      30-minute Tara Operator observation records with decision rationale and V1
      audit id, exposes row/evidence attributes, extends RTL/Playwright
      coverage, and adds `verify:v3 tara-live-audition-flow`.
- [x] Background check (where required for minor cohorts). Done when:
      third-party background-check vendor result stored in Lilith- Rights;
      minor-cohort access gated. Implementation: added a Lilith-Rights
      third-party vendor result store for verified instructor dossiers, links
      cleared checks back into the InstructorProfile background-check field,
      gates Tara teen-cohort access with the V3 minor-cohort scheduling policy,
      exposes blocked/allowed operator evidence, extends RTL/Playwright
      coverage, and adds `verify:v3 tara-background-check-minor-gate`.
- [x] Liability insurance capture (where required). Done when: carrier/policy
      number stored; insurance lapse triggers class-listing pause and operator
      notification. Implementation: added a liability insurance capture surface
      for verified instructor dossiers, stores carrier/policy/expiration into
      the InstructorProfile contract and row evidence, simulates a lapsed policy
      that pauses the class listing and emits a Lilith operator notification,
      extends RTL/Playwright coverage, and adds
      `verify:v3 tara-liability-insurance-capture`.
- [x] Tara badge on avatar nameplate for verified instructors. Done when:
      nameplate renders the badge for verified instructors; not for unverified.
      Implementation: extended the V3UI avatar nameplate render model with a
      Tara verified-instructor badge slot, gates the badge on verified
      InstructorProfile-backed contexts only, suppresses it for unverified
      instructors and aggregate/hidden modes, records manifest/config evidence,
      extends the Unreal automation coverage, and adds
      `verify:v3 tara-nameplate-badge`.

## 27. Tara Live Class Flow

- [x] Class scheduling in Lilith Studio. Done when: instructor can schedule a
      class with start, capacity tier, price/donation, recording flag, sequence
      ref. Implementation: added a Lilith Studio Tara class scheduling panel for
      verified instructors, persists scheduled class records with UTC start
      time, capacity tier/limit, fixed-price or donation terms, recording flag,
      sequence ref, listing status, and V1 audit event, wires it into the Lilith
      operator console, extends RTL/Playwright coverage, and adds
      `verify:v3 tara-class-scheduling`.
- [x] Booking flow on Lilith Web + V1 Oshun web + mobile. Done when: student can
      book, pay, and receive a calendar entry. Implementation: added the shared
      `@oshun/tara-live-class-booking` contract for deterministic paid booking
      receipts and Oshun calendar entries, wired booking/payment/calendar
      affordances into V3 Lilith Web, V1 Tara web, and the mobile V3 companion,
      added unit and Playwright coverage, and added
      `verify:v3 tara-booking-flow`.
- [x] Live class spawn: world server creates room; participants admitted at
      start. Done when: 64 simulated participants join the class on schedule.
      Implementation: added the world-server Tara live-class schedule fixture,
      start-time admission guard, roster capacity/instructor validation, room
      spawn + participant admission report, cargo integration coverage for
      pre-start rejection and 64 scheduled joins, and
      `verify:v3 tara-live-class-spawn`.
- [x] Instructor HUD controls (mute, demote, lock alignment cue, dim lights,
      chime, AI music transition). Done when: all HUD actions take effect with ≤
      200 ms latency. Implementation: added a deterministic Tara instructor HUD
      action model with a 200 ms control budget, wired the HUD into the Tara
      Tier-2 fallback surface with icon controls and applied-state readouts,
      drove stage state for cue lock, room dimming, and AI music transition,
      extended unit and Playwright coverage for every action, and added
      `verify:v3 tara-instructor-hud-controls`.
- [x] Practice-log emission to V1 Arete on close. Done when: Arete record
      contains class metadata, duration, asana coverage, optional Aja accuracy.
      Implementation: added a Tara class close path in the world server that
      validates the active room, requires V1 Arete user bindings and asana
      coverage, emits deterministic V1 Arete practice-log records with class
      metadata, duration, participant role, asana coverage percentages, and
      optional Aja accuracy through an Arete sink, shuts down the room only
      after emission succeeds, covers success and failure paths in cargo
      integration tests, and adds `verify:v3 tara-practice-log-emission`.

## 28. Tara On-Demand Class Library

- [x] Recording flow on opt-in classes. Done when: recording with
      per-participant consent uploads to MinIO; transcoded by the V1 Yemaya
      off-line pipeline. Implementation: added an opt-in Tara recording path in
      the world server that rejects non-recording classes, validates active-room
      participant consent grants, uploads raw media and the consent manifest to
      a MinIO recording sink, queues the uploaded raw object into the V1 Yemaya
      offline transcode pipeline with the consent manifest URI, covers
      success/disabled/missing-consent paths in cargo integration tests, and
      adds `verify:v3 tara-recording-flow`.
- [x] Scrubbable timeline with asana markers (extracted via Aja). Done when:
      60-minute class shows markers at every asana transition. Implementation:
      added a deterministic 60-minute Aja-extracted Tara recording timeline
      model with full-sequence marker coverage, scrub/marker-selection helpers,
      and validation; surfaced it in the Tara Tier-2 fallback playback UI with a
      range scrubber, marker jump controls, active asana/time readouts, and
      non-Tara absence checks; extended unit and Playwright coverage across
      desktop/mobile; and adds `verify:v3 tara-recording-timeline`.
- [x] "Practice with the recording" mode (user joins recorded avatar in shared
      room). Done when: live user avatar appears alongside recorded; Aja gives
      live cues against recorded poses. Implementation: added a deterministic
      Tara on-demand practice-room model that joins the recorded instructor
      avatar and live practitioner avatar into a recording-scoped shared room,
      derives the recorded target pose from the Aja marker stream, computes live
      avatar pose deltas, and emits Aja cue text against the recorded pose;
      surfaced a Tier-2 "Practice with recording" mode with avatar presence and
      cue readouts synchronized to timeline scrubbing; exposed the shared-room
      state to the three.js canvas for recorded/live avatar rendering; extended
      unit and Playwright coverage across desktop/mobile; and adds
      `verify:v3 tara-recording-practice-mode`.
- [x] Engagement telemetry (practice time, asana coverage, drop-off points).
      Done when: telemetry feeds the recommendation surface. Implementation:
      added Tara on-demand engagement telemetry that projects practiced
      intervals over the Aja asana marker timeline, calculates per-asana
      coverage, records exact drop-off markers and times, and builds a
      recommendation-surface payload from those metrics; surfaced the practice
      time, class coverage, drop-off count, and next-class recommendation in the
      Tara Tier-2 fallback after joining practice mode; covers the telemetry
      aggregate, recommendation feed, desktop/mobile UI, and non-Tara absence in
      tests; and adds `verify:v3 tara-engagement-telemetry`.

## 29. Tara Practice Plans and Arete Continuity

- [x] Plan generator (starter library + guided onboarding). Done when: a new
      user completes a 5-minute onboarding and receives a tailored plan.
      Implementation: added a Tara starter practice-plan library and guided
      onboarding intake in `@oshun/tenant-tara-studio`, scores starter templates
      by goal, experience, time preference, intensity, duration fit, and
      constraints, validates the exact 5-minute intake, and emits a tailored
      4-week / 20-session practice plan with weekly themes, on-demand class
      slots, self-practice slots, focus asanas, and tailored reasons; covers the
      end-to-end intake-to-plan result in tenant unit tests and adds
      `verify:v3 tara-practice-plan-generator`.
- [x] Plan adjustment via attendance + Aja signals + Arete weekly-review
      responses. Done when: simulated 4-week journey produces adjusted
      recommendations. Implementation: added a 4-week Tara practice journey
      simulation over the generated starter plan with per-session attendance,
      Aja asana coverage signals, and Arete weekly-review responses; computes
      attendance rate, average Aja coverage, average Arete confidence, and emits
      adjusted recommendations for low Triangle coverage, balance confidence,
      and missed morning attendance rhythm; validates journey and result
      invariants in tenant unit tests and adds
      `verify:v3 tara-practice-plan-adjustment`.
- [x] Continuation cards in V1 Oshun web/mobile shell. Done when: cross-device
      resume works (start on web, continue on mobile). Implementation: added a
      V1-safe Tara practice-plan continuity contract in `@oshun/domain-tara`
      with deterministic web-start and mobile-resume states, shared resume
      token, canonical web/mobile links, and drift validation; surfaces the
      continuation card in the Oshun web Tara dashboard and mobile Tara domain
      home using the same token/session path; verifies web click-through,
      hydrated resume, mobile card press payload, and cross-device validation in
      unit and Playwright coverage; adds
      `verify:v3 tara-practice-plan-continuity`.

## 30. Tara Tradition, Lineage, Citation

- [x] Lineage editor and Sophia grounding check. Done when: unsourced lineage
      claims are flagged in editorial review. Implementation: added a
      deterministic Tara lineage editor draft model in
      `@oshun/tenant-tara-studio` with Sophia source registry checks, source
      attachment patching, and blocker-level review output for unsourced claims;
      seeded the admin BFF editorial queue with a Maya Anand lineage profile
      review whose Sophia QA check fails on `lineage-claim-mysore-1932`;
      surfaced a Tara lineage editor panel in the admin editorial workspace with
      claim fields, citation trails, source registry, and blocker rail; covers
      tenant logic, BFF seed invariants, admin rendering, and Playwright
      editorial visibility; and adds `verify:v3 tara-lineage-grounding`.
- [x] Lineage display on instructor profile and class listing. Done when:
      lineage tag and citation trail visible to students before booking.
      Implementation: added cited lineage disclosure metadata to the shared Tara
      live-class booking fixture with a validation gate that rejects unsourced
      class listings; rendered the lineage tag and citation trail before booking
      actions on V1 Oshun web, Oshun mobile, and the V3 Lilith browser shell;
      added a Sophia-backed lineage citation section to the Tara teacher
      profile; covers shared booking contract, web/mobile profile and listing
      rendering, Playwright pre-booking visibility, and
      `verify:v3 tara-lineage-student-display`. Honesty update (audit B15 +
      2026-06-12): fabricated "Sophia verified" claims were stripped from
      shipped fixtures — the teacher profile renders a cited lineage block only
      when a real Sophia verification read populates `teacher.lineage` and an
      honest "not yet verified" state otherwise (citation rendering covered by a
      test-local fixture); the booking fixture keeps its editorial citation
      trail but `verifiedAtIso` is null until a real verification runs.

## 31. Tara Supervised AI Instructor Personas

- [x] Sponsor registration flow (verified human instructor sponsors an AI
      persona). Done when: a sponsor can register, scope-limit, and disable
      persona with one-click. Implementation: added a deterministic Tara AI
      persona sponsor registration model in `@oshun/tenant-tara-studio` that
      accepts only verified credentialed human instructors, normalizes explicit
      scope limits, emits audit IDs, and supports idempotent one-click disable;
      surfaced the flow in the admin personas workspace with sponsor identity,
      scope-limit toggles, registration state, audit metadata, and a disabled
      lock state; covers tenant logic, admin rendering, Playwright registration
      and disable behavior, and `verify:v3 tara-ai-persona-sponsor`.
- [x] Persona authoring with sequence-script restriction (no live improvisation
      outside script). Done when: an AI persona attempting an out-of-script
      asana hands off to sponsor or no-ops. Implementation: added a Tara AI
      persona sequence-script authoring model in `@oshun/tenant-tara-studio`
      that requires an active sequence-script-only sponsor registration,
      validates sponsor-approved canonical asana lines, and deterministically
      evaluates persona asana attempts; in-script asanas return only the
      approved script line, while out-of-script asanas either hand off to the
      verified sponsor or gracefully no-op based on authoring mode; surfaced the
      script review and enforcement simulator in the admin personas workspace
      with RTL and Playwright coverage plus
      `verify:v3 tara-ai-persona-sequence-script`.
- [x] Nameplate label "AI persona — sponsored by <human>". Done when: label is
      non-removable on AI persona avatars. Implementation: added a Tara tenant
      nameplate lock model that builds the exact sponsored-by-human label from
      the active AI persona sponsor registration and rejects tampered/removable
      variants; extended the V3 Unreal avatar nameplate render model, manifest,
      config, and automation assertions so Tara AI persona avatars render the
      locked sponsor label at visible LODs and block removal attempts; surfaced
      the label lock in the admin personas workspace with RTL and Playwright
      coverage plus `verify:v3 tara-ai-persona-nameplate`.
- [x] Region cap: 1 AI persona per 4 verified human instructors. Done when: cap
      is enforced by the scheduling service. Implementation: added a Tara tenant
      regional scheduling-cap model that computes floor(verified human
      instructors / 4), blocks capped AI persona schedules, and allows verified
      human instructors without consuming the AI cap; wired the Lilith Tara
      class scheduler to evaluate and assert the cap before writing
      scheduled-class records, with operator-visible region, instructor type,
      cap evidence, and block reasons; covers tenant tests, admin RTL coverage,
      Playwright capped and available-region behavior, and
      `verify:v3 tara-ai-persona-region-cap`.

## 32. Tara Trauma-Informed Tone Policy

- [x] Default no-surprise-physical-adjustment policy. Done when: in-world
      contact requires explicit consent dialog. Implementation: added the Tara
      tenant hands-off physical-adjustment policy and consent-dialog decision
      model; extended the Lilith world-server with a physical-adjustment consent
      authority that validates class participants, creates the explicit consent
      dialog, blocks contact until the student grants the matching dialog, keeps
      declined adjustments blocked, and emits audit events; added the V3 UE
      dialog render model, manifest, config, and automation assertions so
      in-world Tara physical adjustment contact cannot be authorized without the
      dialog flow; covers tenant tests, Rust world-server tests, UE static
      assertions, and `verify:v3 tara-physical-adjustment-consent`.
- [x] Invitational-language linter on sequence scripts. Done when: directive
      language is flagged in editorial review. Implementation: added a Tara
      tenant invitational-language linter that scans sequence-script cue lines
      for directive terms, records blocking editorial issues with replacement
      suggestions, and attaches the review to authored AI persona sequence
      scripts; surfaced the editorial tone review, status, issue count, and
      line-level matched phrases in the admin sequence-script panel; covers
      linter tests, sequence authoring coverage, RTL and Playwright admin review
      assertions, and `verify:v3 tara-invitational-language-linter`.
- [x] Eyes-open default; eyes-closed only on explicit invitation. Done when:
      avatars do not auto-close eyes during sequence. Implementation: added the
      Tara tenant eyes-open policy that suppresses automatic eyes-closed
      sequence cues unless the cue carries explicit invitational language; added
      the V3 UE avatar runtime policy, config, manifest, and automation
      assertions so Tara sequence avatars keep their eyes open by default and
      only apply the eyes-closed blendshape after an explicit invitation; covers
      tenant tests, UE static assertions, and `verify:v3 tara-eyes-open-policy`.
- [x] Style-mode declaration in class description (advanced classes can opt into
      more directive style). Done when: style mode appears in class listing UI.
      Implementation: added Tara tenant style-mode definitions for the
      invitational default and advanced directive opt-in, composed the selected
      style-mode declaration into scheduled class descriptions, surfaced the
      style mode and declared description in the Lilith Tara class listing UI,
      and covered tenant tests, admin RTL, Playwright class-listing assertions,
      and `verify:v3 tara-class-style-mode`.

## 33. Tara Compensation, Tips, Studio Splits

- [x] Default platform splits: 20/80 paid; 10/90 tips/donations. Done when:
      commerce service applies splits and routes payouts. Implementation: added
      the V3 Lilith commerce Tara default split ledger, integer-cent basis-point
      calculation, platform-treasury and instructor payout routes, rounding
      preservation by assigning residual cents to the instructor route, service
      capability metadata, Rust coverage for paid classes, tips, donations, and
      invalid routing inputs, and `verify:v3 tara-default-commerce-splits`.
- [x] Tara Lineage Fund: optional 0–10% of instructor share routed to endowed
      fund. Done when: instructor can opt-in/out; fund routing visible on
      receipt. Implementation: added capped V3 commerce Lineage Fund opt-in
      routing, endowed-fund payout routes, opt-out preservation of the
      instructor share, invalid over-cap validation, shared Tara booking split
      receipts, and visible Lineage Fund receipt rows across Lilith Web, Oshun
      web, and mobile with `verify:v3 tara-lineage-fund-routing`.
- [x] Stripe Connect onboarding for instructor fiat payouts. Done when:
      instructor in a supported region completes Stripe Connect KYC and receives
      a test payout. Implementation: added V3 commerce Stripe Connect
      supported-region validation, instructor KYC evidence and bank-token
      requirements, payout-enabled account receipts, deterministic onboarding
      session IDs, paid USD test payout receipts, unsupported-region/empty-KYC
      coverage, and `verify:v3 tara-stripe-connect-onboarding`.
- [x] Aje native withdrawal for instructors in crypto-supported regions. Done
      when: instructor withdraws to an Aje wallet successfully. Implementation:
      added V3 commerce Aje native withdrawal support with crypto-region
      allow-listing, Aje wallet address validation, positive amount and balance
      checks, settled native-token withdrawal receipts, deterministic Aje
      network receipt IDs, unsupported-region/invalid-wallet coverage, and
      `verify:v3 tara-aje-native-withdrawals`.

## 34. Saraswati Artist Persona Authoring

`libs/v3/saraswati-stage/`

- [x] Persona dossier editor (backstory, voice signature ref, avatar ref, genre
      cell, catalog policy, operator hand-off rules). Done when: editorial can
      publish a complete persona with all fields validated. Implementation:
      added a Saraswati Stage persona dossier editor contract with required
      ArtistPersona field validation, Sophia-backed backstory checks,
      consent-ledger voice signature and Saraswati avatar refs, genre-cell
      guardrails, catalog policy validation, operator hand-off rule validation,
      deterministic publish receipts, a Lilith Studio `/lilith-studio/personas`
      editorial surface, shell route entry, component and Playwright coverage,
      and `verify:v3 saraswati-persona-dossier-editor`.
- [x] Voice-signature build flow with consent + public-figure registry check.
      Done when: voice-similarity false-positive rate ≤ 1% on the validation
      corpus; check blocks any match. Implementation: added a Saraswati Stage
      voice-signature build contract with consent-ledger grant validation,
      clean-source minimums, deterministic public-figure registry probes, ≤ 1%
      false-positive-rate enforcement, blocking public-figure match receipts,
      Lilith Studio controls and build receipt display on the persona dossier
      surface, component and Playwright coverage, and
      `verify:v3 saraswati-voice-signature-build`.
- [x] Persona-policy lock enforcement (no-medical/legal/financial advice). Done
      when: adversarial-prompt evaluation produces 0 breaches across 6 GA
      personas. Implementation: added a Saraswati Stage persona-policy lock
      contract with GA persona policy profiles, medical/legal/financial advice
      lock classes, public-figure/political/role-swap adversarial prompts,
      runtime hand-off/no-op response plans, a deterministic 6-persona suite
      requiring 0 policy and no-advice breaches, unit coverage, and
      `verify:v3 saraswati-persona-policy-lock`.
- [x] Operator hand-off rules editor. Done when: editorial can define
      per-persona hand-off scope; runtime enforces. Implementation: added
      Saraswati Stage operator hand-off rule helpers, deterministic runtime
      prompt matching by scope/trigger/severity/SLA, V1 audit event ids,
      add/remove controls on the Lilith Studio persona dossier surface, a
      runtime route probe that shows the enforced scope and queue, component and
      Playwright coverage, and `verify:v3 saraswati-operator-handoff-rules`.

## 35. Saraswati Music Generation Pipeline (Isis)

`libs/v3/isis-music/`

- [x] Register Saraswati music workflow with V1 Isis control plane. Done when:
      workflow visible in V1 Isis registry; submit-job route reachable.
      Implementation: added a Saraswati music V1 Isis workflow registration,
      production registry snapshot, published workflow catalog entry,
      `/v1/isis/workflows/saraswati-stage-track-generation/run` submit-job route
      contract, deterministic submit-job request/simulation helpers, package
      tests, and `verify:v3 saraswati-music-v1-isis-workflow`.
- [x] Multi-provider routing (Suno, Udio, Stable Audio, MusicGen, AudioCraft,
      Mubert). Done when: provider selection per-job by cost/quality mode;
      failover drilled. Implementation: added the six-provider Saraswati music
      registry, per-job cost/quality routing, duration/stem/lyric eligibility
      filters, deterministic failover-chain selection, cost and quality failover
      drills, provider metadata on submit-job requests, package tests, and
      `verify:v3 saraswati-music-provider-routing`.
- [x] Lyric generation pass (Claude Opus / Sonnet) grounded by Sophia. Done
      when: lyric factuality check catches a known unverifiable claim in the
      validation set. Implementation: added Claude Opus/Sonnet lyric model
      selection, Sophia lyric evidence packs, citation-backed lyric draft
      generation, factual-claim extraction, blocking unverifiable-claim reports,
      a validation set with the known unsupported 2025 Grammy claim, package
      tests, and `verify:v3 saraswati-grounded-lyric-generation`.
- [x] Tone check via Lilith persona-policy. Done when: lyric tone violations are
      flagged and routed to editorial. Implementation: added a generated lyric
      tone violation source to Lilith moderation bindings, wired Isis Music
      lyric checks through Lilith's devotional persona-policy evaluator, flags
      failing tone axes, prepares editorial queue items on the ongoing content
      QA queue, validates a known hype/directive lyric violation, and gates the
      wiring with `verify:v3 saraswati-lyric-tone-policy`.
- [x] Auto-mix + master pass with human review gate. Done when: editorial review
      queue surfaces every track before release; review action audit-logged.
      Implementation: added deterministic Saraswati auto-mix and 24-bit master
      artifact planning, review-preview artifact ids, required mix/master
      evidence, a music master release queue that blocks every queued track
      until human approval, immutable review action audit events for
      approve/change/reject decisions, package tests, and
      `verify:v3 saraswati-auto-mix-master-review`.
- [x] Provenance bundle write (model card, prompt seed, reference set,
      generating user, persona, lineage credit distribution). Done when: bundle
      written for every generated track; inspector confirms completeness.
      Implementation: added Saraswati track provenance bundle writing for model
      cards, prompt seeds, Sophia/rights/policy reference sets, generating
      users, persona refs, lineage credit distributions, and master/preview
      artifact refs; added completeness inspection that fails missing sections
      or non-100 lineage splits; package tests; and
      `verify:v3 saraswati-track-provenance-bundle`.
- [x] Audible Magic / Pex fingerprint check pre-release. Done when: match
      against major-label catalog triggers editorial review; validated on 50
      reference tracks. Implementation: added a Saraswati pre-release
      fingerprint gate for Audible Magic and Pex provider fingerprints, a
      deterministic 50-track rights reference catalog, major-label match scoring
      and blocking editorial review queue items, validation cases for Audible
      Magic, Pex, clean, and independent-catalog outcomes, package tests, and
      `verify:v3 saraswati-pre-release-fingerprint-check`.

## 36. Saraswati Discography Release Flow

- [x] Per-track release flow (editorial approve → publish → in-world catalog).
      Done when: 12-track debut catalog releases for a GA persona; in-world
      catalog reflects within 60 s. Implementation: added the Saraswati Stage
      discography release-flow contract for approved track candidates, publish
      receipts, V1 audit ids, provenance/master links, and in-world catalog
      paths; validates a 12-track Raga Devi GA debut release, blocks publish
      without editorial approval, and proves catalog propagation remains within
      60 seconds via package tests and
      `verify:v3 saraswati-discography-release-flow`.
- [x] Catalog browser in Lilith Web / Mobile / VR. Done when: catalog renders
      with playback, attribution, provenance link across all three clients.
      Implementation: added a Saraswati catalog browser to the Lilith Tier-2
      fallback shell backed by the 12-track in-world catalog release contract,
      with Web/Mobile/VR presentation modes, track selection, playback state,
      attribution, provenance links, responsive styling, Playwright desktop and
      mobile coverage, and `verify:v3 saraswati-catalog-browser`.
- [x] Off-platform distribution (Spotify, Apple Music) per persona. Done when:
      distribution to Spotify / Apple Music live for at least one GA persona
      with valid PRO registration. Implementation: added Saraswati off-platform
      DSP distribution receipts for Spotify and Apple Music, active ASCAP PRO
      registration validation for Raga Devi's 12-track debut catalog,
      storefront/audit delivery metadata, blocking when PRO registration is not
      active, package tests, and
      `verify:v3 saraswati-off-platform-distribution`.

## 37. Saraswati Live Performance Engine (UE Sequencer + MetaSounds)

`apps/v3/saraswati-service/` (Rust orchestrator) +
`V3/ue/Plugins/V3Mode_SaraswatiConcert/` (UE concert mode plugin).

The canonical concert experience is driven by UE Sequencer with cue tracks bound
to MetaSound graphs, Niagara FX, light/camera presets, and audience-choreography
systems. The saraswati-service orchestrates scheduling, ticket gates, and
royalty settlement; UE handles the live performance render.

- [x] Author the canonical concert Sequencer template at
      `/Game/Saraswati/Templates/ConcertMaster.uasset` with cue tracks for music
      sync, lighting, particles, persona motion, audience-cam, and between-song
      speech triggers. Done when: template loads cleanly in UE Editor; preview
      play renders a stub concert with all cue track types firing.
      Implementation: added the canonical ConcertMaster LevelSequence contract,
      machine-readable cue-track sidecar, UE automation coverage for
      `V3.Saraswati.ConcertMasterTemplate`, and
      `verify:v3 saraswati-concert-master-template`.
- [x] Performance plan loader: saraswati-service compiles a per-concert
      Sequencer asset from the setlist + persona + venue selection; published to
      MinIO and pulled by UE Pixel Streaming workers and native UE clients on
      join. Done when: setlist round-trips through editor → published Sequencer
      asset with all cues bound; visible in UE Editor's sequence view.
      Implementation: added the saraswati-service performance plan compiler,
      typed setlist/persona/venue inputs, all required Sequencer cue bindings,
      MinIO publication metadata, Pixel Streaming and native UE pull-on-join
      receipts, Rust coverage, and
      `verify:v3 saraswati-performance-plan-loader`.
- [x] Pre-show warm-up flow (audience admit, MetaSound ambient loop, UMG
      countdown). Done when: audience admitted ≥ 15 min before start; ambient +
      countdown audible to attendees on UE clients and the Tier-2 fallback.
      Implementation: added saraswati-service pre-show warm-up evaluation with
      the 15-minute admission floor, MetaSound ambient-loop activation, UMG
      countdown activation, UE-client and Tier-2 fallback audible playback
      receipts, Rust coverage, and `verify:v3 saraswati-pre-show-warmup`.
- [x] Stage transition (performer MetaHuman entrance Sequencer, opening light
      cue sweep, Niagara particle sweep). Done when: transition is choreographed
      and consistent across attendees; music-sync drift ≤ 25 ms. Implementation:
      added saraswati-service stage-transition evaluation with MetaHuman
      entrance sequencing, opening light cue sweep, Niagara particle sweep,
      native UE / Pixel Streaming / Tier-2 consistency receipts, ≤ 25 ms
      music-sync drift enforcement, Rust coverage, and
      `verify:v3 saraswati-stage-transition`.
- [x] Per-song execution: MetaSound graph streams the song with NTP-style sync
      timestamps; cue tracks fire Niagara FX, light cues, camera angles,
      audience-cam sweeps; UE Pixel Streaming workers and native UE clients
      render in lockstep. Done when: end-to-end concert in a Stadium-tier venue
      with 4 096 simulated attendees (mix of native UE, Pixel Streaming, and
      Tier-2 fallback clients) runs without missed cues. Implementation: added
      saraswati-service per-song execution evaluation over compiled Sequencer
      assets, MetaSound NTP stream detection, all cue track firing across native
      UE / Pixel Streaming / Tier-2, Stadium-tier 4 096-attendee mix validation,
      ≤ 25 ms lockstep drift enforcement, Rust coverage, and
      `verify:v3 saraswati-per-song-execution`.
- [x] Between-song speech: Sophia-grounded prompt → Cartesia / ElevenLabs TTS in
      persona voice → playback via MetaSound + V3Voice on UE clients;
      persona-policy lock enforced. Done when: persona speech triggers
      consistently between songs; adversarial policy probe produces 0 breaches.
      Implementation: added saraswati-service between-song speech evaluation
      with Sophia citation grounding, Cartesia and ElevenLabs TTS provider
      requirements, persona voice signature playback over MetaSound + V3Voice,
      consistent transition trigger receipts, 0-breach persona-policy probe
      enforcement, Rust coverage, and `verify:v3 saraswati-between-song-speech`.
- [x] Audience interaction (light-emoji, tips, song-request from pre- allowed
      list) wired through the gateway → world server → UE clients as gameplay
      tags / Niagara cues. Done when: 1 000 simulated fans send interactions;
      server validates and forwards with ≤ 200 ms latency; interactions render
      on every tier. Implementation: added saraswati-service audience
      interaction evaluation for 1 000 simulated fan events, light emoji, tips,
      pre-allowed song requests, gateway → world-server latency ≤ 200 ms,
      gameplay tag and Niagara cue binding, native UE / Pixel Streaming / Tier-2
      render receipts, Rust coverage, and
      `verify:v3 saraswati-audience-interaction`.
- [x] Recording via UE MoviePipeline capturing the master render with Isis
      provenance bundle attached + C2PA manifest written via post- export hook.
      Done when: concert recording exports with full provenance; C2PA verifies
      via Adobe CAI tools. Implementation: added saraswati-service
      recording-pipeline evaluation for UE MoviePipeline capture, master render
      export, Isis provenance bundle attachment, C2PA post-export hook
      execution, Adobe CAI verification, Rust coverage, and
      `verify:v3 saraswati-recording-pipeline`.
- [x] Tier-2 cue forwarding: per-song cue tracks are also forwarded to Tier-2
      fallback clients as cue events; fallback renders simplified
      Niagara-equivalent particles + light cues. Done when: Tier-2 attendee sees
      a coherent (if reduced-fidelity) version of the concert at every cue.
      Implementation: added saraswati-service Tier-2 cue forwarding evaluation
      from compiled Sequencer cues into fallback cue events, simplified
      Niagara-equivalent particle payloads, simplified light cues, per-cue
      coherence receipts, Rust coverage, and
      `verify:v3 saraswati-tier2-cue-forwarding`.
- [x] Stadium-tier Tier-2 fallback path: when interest-management can't keep a
      Tier-2 attendee inside the bandwidth budget, route them to a
      server-rendered video proxy from Yemaya. Done when: a saturated Tier-2
      client smoothly switches to the proxy and back during a Stadium-tier
      concert. Implementation: added saraswati-service Stadium-tier fallback
      evaluation for bandwidth saturation, Yemaya server-rendered video proxy
      routing, smooth switch-to-proxy and switch-back budgets, cue continuity
      checks, Rust coverage, and `verify:v3 saraswati-stadium-tier-fallback`.
- [x] Royalty distribution trigger on performance end (Aje on-chain settlement).
      Done when: post-concert settlement runs through Aje within 60 min; royalty
      receipts visible to contributors. Implementation: added saraswati-service
      royalty settlement trigger evaluation with Aje settlement IDs, 60-minute
      completion enforcement, contributor royalty waterfall receipts,
      contributor visibility checks, Rust coverage, and
      `verify:v3 saraswati-royalty-settlement`.

## 38. Saraswati Scheduled Concerts and Drops

- [x] Concert scheduling UI (editorial team). Done when: 2 concerts per month
      per artist scheduled for 6 GA personas across the 4-week launch window.
      Implementation: added the Lilith editorial Saraswati concert scheduling
      panel with six canonical GA personas, twelve launch-window concerts, 2 per
      artist/month validation, four-week coverage checks, persona filtering,
      publish audit logging, Vitest off-happy-path coverage, Playwright
      desktop/mobile signoff, and `verify:v3 saraswati-concert-scheduling-ui`.
- [x] Drop-day flow (single drops tied to a live concert). Done when: single
      release time and concert start time are coupled and enforced.
      Implementation: added saraswati-service drop-day flow validation tying a
      Saraswati single release manifest, release calendar entry, live concert
      calendar entry, Stadium-tier venue, and Lilith-Commerce ticket product to
      one zero-drift release/start timestamp, with Rust rejection coverage for
      time drift and non-Stadium venues plus
      `verify:v3 saraswati-drop-day-flow`.
- [x] Festival event flow (multiple personas, Stadium-tier shared venue). Done
      when: quarterly festival published; admission, sync, royalty distribution
      all validated. Implementation: added saraswati-service festival event flow
      validation for quarterly published Stadium-tier shared-venue festivals,
      multi-persona bookings, full ticketed-admission parity, native UE / Pixel
      Streaming / Tier-2 sync receipts within 25 ms with zero missed cues, Aje
      royalty distribution totaling 10,000 bps with contributor-visible
      receipts, Rust rejection coverage, and
      `verify:v3 saraswati-festival-event-flow`.

## 39. Saraswati Fan Economy

- [x] Free tier (follow, attend smaller free concerts, browse catalog,
      light-emoji). Done when: free-tier user completes flows. Implementation:
      added Lilith-Commerce Saraswati free-tier journey validation for followed
      artists, named free small-concert tickets capped at 512 capacity,
      in-concert attendance, artist / release / track catalog browsing, and 1 Hz
      light-emoji aggregation receipts, with Rust rejection coverage and
      `verify:v3 saraswati-free-tier-flow`.
- [x] Club pass (monthly subscription via Stripe / Aje). Done when: subscription
      billing recurs; club-only concert admission gated. Implementation: added
      Lilith-Commerce Saraswati Club pass validation for four consecutive
      monthly paid billing cycles through a single Stripe or Aje route, active
      subscription windows, named club-only tickets, and concert gate checks
      tied to the subscribed Saraswati artist, with Rust rejection coverage and
      `verify:v3 saraswati-club-pass-flow`.
- [x] Signed-edition drops (limited supply, on-chain via Aje, secondary
      royalties). Done when: 250-edition drop sells out and resale routes
      royalties to creators. Implementation: added Lilith-Commerce Saraswati
      signed-edition drop validation for exactly 250 unique Aje-minted editions,
      sold-out supply accounting, current-holder resale, fixed secondary royalty
      bps, seller net proceeds, and Aje creator royalty routes totaling the
      resale royalty, with Rust rejection coverage and
      `verify:v3 saraswati-signed-edition-drop`.
- [x] Tips during concerts. Done when: tips reach artist account with ≤ 60 min
      settlement. Implementation: added Lilith-Commerce Saraswati concert tip
      settlement validation for Stripe and Aje provider receipts, 10/90
      platform/artist split routing, artist-account recipient checks, and
      settlement latency capped at 60 minutes, with Rust rejection coverage and
      `verify:v3 saraswati-concert-tip-settlement`.
- [x] Remix-rights purchase flow. Done when: fan completes a remix-rights
      purchase and the rights record is encoded on-chain. Implementation: added
      Lilith-Commerce Saraswati licensed remix-rights purchase validation for
      Stripe and Aje payments, licensed catalog mode enforcement, license terms
      with stems manifest refs, secondary royalty splits totaling 10,000 bps,
      and an Aje on-chain rights record matching the purchaser and track, with
      Rust rejection coverage and `verify:v3 saraswati-remix-rights-purchase`.

## 40. Saraswati Collaborations, Remix, Sampling

- [x] Cross-persona collaboration flow. Done when: a two-persona track releases
      with both lineage credits and split royalty waterfall. Implementation:
      added Saraswati Stage cross-persona collaboration release validation for
      exactly two Saraswati personas, consent-ledger voice signatures, 10,000
      bps lineage credit distributions, matching Aje split royalty waterfall
      routes, editorial approval before publish, Vitest rejection coverage, and
      `verify:v3 saraswati-cross-persona-collaboration`.
- [x] Remix rights catalog publish on each track. Done when: rights mode visible
      on catalog; respected by purchase flow. Implementation: added Saraswati
      Stage remix-rights catalog publishing for all 12 Raga Devi debut tracks,
      visible open / licensed / none modes per catalog entry, purchase-flow
      status derivation that only enables licensed purchases, Vitest rejection
      coverage for hidden rights modes and locked purchase paths, and
      `verify:v3 saraswati-remix-rights-catalog`.
- [x] Themis adjudication route for disputed rights. Done when: dispute filed →
      Themis decision → outcome enforced. Implementation: added Saraswati Stage
      disputed-rights adjudication for a remix-priority claim with Themis case
      filing, claimant and response evidence requirements, final Themis decision
      validation, enforced rights-record and royalty-waterfall updates within 24
      hours, Vitest rejection coverage for missing evidence and non-final
      decisions, and `verify:v3 saraswati-themis-rights-adjudication`.

## 41. Saraswati Voice Cloning Boundaries

Per `features§"Voice Cloning Boundaries"`.

- [x] Voice-rights contract template: scope (Saraswati persona X only),
      perpetuity / reversion terms, mandatory royalty share, public-
      figure-impersonation prohibitions, 90-day withdrawal rights. Done when:
      template reviewed and signed off by Lilith-Rights counsel; stored in
      Lilith-Rights with V1 audit trail. Implementation: added Lilith-Rights
      Saraswati voice-rights contract-template storage with counsel-only
      signoff, persona-only scope, perpetual grant with reversion terms,
      mandatory 12% contributor-pool royalty share, public-figure and
      cross-persona impersonation prohibitions, 90-day withdrawal and retraining
      requirements, V1 audit-log evidence, service rejection coverage, and
      `verify:v3 saraswati-voice-rights-contract-template`.
- [x] Recording session pipeline: ≥ 4 hours of clean source per contributor; ≥ 3
      contributors per persona; in-studio or supervised-remote sessions;
      encrypted-at-rest masters. Done when: pilot session run end-to-end for one
      GA persona; session record stored with full audit trail. Implementation:
      added Lilith-Rights Saraswati voice-recording session storage gated on a
      stored voice-rights contract template, three-contributor minimum, ≥ 4
      clean hours per contributor, in-studio / supervised-remote modes, required
      sung/spoken/breath/fricative/sibilant/emotional coverage, encrypted master
      artifact and KMS refs, Lilith-Rights-only raw sample retention, four-event
      V1 audit trail, service rejection coverage, and
      `verify:v3 saraswati-recording-session-pipeline`.
- [x] Per-contributor royalty share encoded in Aje royalty waterfall; default
      12% total to the contributor pool, pro-rata by training- data-contribution
      share; editorial overrides audit-logged. Done when: settlement test routes
      share correctly for a synthetic track using a multi-contributor signature.
      Implementation: added Lilith-Rights Saraswati voice-contributor royalty
      waterfall encoding from stored recording sessions, enforced the default
      12% contributor pool, calculated pro-rata contributor routes from clean
      source hours with penny-accurate settlement, emitted Aje waterfall refs,
      audit-logged editorial override applications, added service coverage for
      default and override settlements plus invalid override totals, and
      `verify:v3 saraswati-contributor-royalty-waterfall`.
- [ ] Voice-similarity check against the maintained public-figure corpus run
      pre-build; flagged matches block the build until editorial review clears.
      NOT LOCALLY ACTIONABLE (2026-05-31): the voiceprint ENGINE is real and
      verified (DFT → mel → cosine; see voice-similarity-engine.ts + tests) and
      the literal "Done when" is met on a synthetic-speaker corpus, but a
      PRODUCTION false-positive rate requires a real/licensed human-voice corpus
      that does not exist in this sandbox. Stays `[~]` until validated on real
      audio. Done when: 50 known-public-figure test voices all flagged; 100
      consented-contributor voices all clear; FPR ≤ 1%. Implementation: the
      probe similarities are now COMPUTED by a real spectral voiceprint engine
      (`apps/lilith/svc-rights-management/src/voice-similarity-engine.ts`:
      deterministic source-filter speaker synthesis → framed real DFT → mel
      filterbank → L2-normalised voiceprint → cosine similarity), not
      hand-authored basis points. The validation corpus draws 50
      known-public-figure and 100 consented-contributor speakers from disjoint
      formant ranges, and each probe's similarity is the engine's cosine output
      (impersonations flag ≥ 8600 bps; contributors clear < 8600 → FPR 0%). The
      engine's discrimination is unit-tested (`voice-similarity-engine.test.ts`:
      same-speaker high, distinct-speaker low). NOTE: the validation speakers
      are synthetic; a production FPR still requires a real/licensed human-voice
      corpus — the same engine runs unchanged on real PCM. Pre-build review
      blocks public-figure matches, editorial clearance carries V1 audit
      evidence, and `verify:v3 saraswati-voice-similarity-prebuild-gate` asserts
      the engine is used (guarding against the old hardcoded formulas).
      `blocked:corpus`
- [x] Contributor withdrawal flow: 90-day notice; signature re-trained without
      the withdrawn contributor; pro-rata royalty share recovered to the
      platform reserve fund pending replacement contributor. Done when: dry-run
      withdrawal completes end-to-end for a test contributor. Implementation:
      added a Lilith-Rights Saraswati contributor-withdrawal dry-run record that
      enforces 90-day notice, records retraining without the withdrawn
      contributor, preserves retained contributor shares, routes the withdrawn
      pro-rata pool share to the Aje platform reserve pending replacement,
      audit-logs notice/retrain/reserve events, added service tests for the
      successful dry run and notice-window rejection, and
      `verify:v3 saraswati-contributor-withdrawal-flow`.
- [x] Signature ownership recorded as Oshun / Saraswati derivative work;
      contributor identity / publicity rights retained but no derivative
      copyright held by contributor. Done when: legal terms enforced in the
      contract template; contributor-facing summary surfaces in the V1 web
      Studio. Implementation: hard-coded Lilith-Rights contract ownership terms
      and contributor summary refs, added Saraswati-stage ownership summary
      metadata to persona publish receipts, surfaced the same contributor-facing
      summary in the V1 Lilith Studio persona dossier editor, extended component
      and Playwright coverage for the summary and receipt mirror, and
      `verify:v3 saraswati-voice-ownership-summary`.
- [x] No-fan-upload enforcement: any attempted fan voice upload to a Saraswati
      persona signature is rejected. Done when: upload endpoint rejects with a
      clear message; audit- logged. Implementation: added a shared Lilith TTS
      Saraswati fan-upload guard with explicit rejection code/message and audit
      event records, wired it into the legacy `/v1/voice-cloning/initiate`
      upload path and the current instant, professional, and use-case clone
      upload routes, covered the endpoint rejection/audit trail in route tests,
      and `verify:v3 saraswati-fan-upload-rejection`.
- [x] GA personas (6) all built only from consent-recorded voice contributions;
      consent dossiers complete; signatures pass similarity check. Done when:
      all 6 personas signed off by Lilith-Rights. Implementation: added a
      six-persona GA voice-signature signoff report in the Saraswati stage
      package with consent-recorded-only dossiers, fan-upload rejection flags,
      build receipts, passing similarity reviews, and Lilith-Rights signoff
      metadata; added package exports, unit coverage, and
      `verify:v3 saraswati-ga-voice-signoff`.

### 41.1 Tara instructor TTS voice signatures

Per the parallel framework in `features§"Voice Cloning Boundaries"`.

- [x] Tara TTS opt-in flow with separate consents for Aja cues and localized
      dubs; 30-day withdrawal. Done when: instructors can opt in / out from V1
      web Studio; Lilith-Rights logs both consents. Implementation: added Tara
      Studio TTS consent lifecycle records with separate Aja-cue and
      localized-dub grants, 30-day withdrawal deadlines, and Lilith-Rights audit
      entries; surfaced the opt-in/out controls at
      `/studio/tara/tts-voice-consent` from V1 Studio; added unit, browser, and
      `verify:v3 tara-tts-voice-consent` coverage.
- [x] Tara TTS contract template (cross-instructor / cross-tenant misuse
      forbidden; default 5% added royalty share). Done when: template signed
      off; surfaced to instructors with a plain-language summary.
      Implementation: added a Lilith-Rights signed Tara TTS contract template
      with cross-instructor and cross-tenant misuse prohibitions, a default 5%
      added royalty share, 30-day withdrawal rights, instructor plain-language
      summary, V1 Studio `/studio/tara/tts-voice-contract` route, unit/browser
      coverage, and `verify:v3 tara-tts-voice-contract`.
- [x] Tara TTS strict scope locks at runtime (signature cannot be played by
      another instructor, by a Saraswati persona, or on a non-Tara surface).
      Misuse triggers auto-withdrawal + operator alert. Done when: misuse drill
      verifies auto-withdrawal end-to-end. Implementation: added Tara TTS
      runtime scope-lock enforcement for cross-instructor, cross-tenant,
      Saraswati persona, unsupported-purpose, inactive-consent, and non-Tara
      surface attempts; misuse now auto-withdraws active Aja cue and localized
      dub consents through the Lilith-Rights lifecycle, opens a critical
      operator alert, and includes an end-to-end misuse drill plus
      `verify:v3 tara-tts-voice-scope-lock`.
- [x] Recording session pipeline (>= 1 h source; optional 4 h studio-grade
      upgrade). Done when: pilot session run for one verified instructor;
      signature built and clears similarity check. Implementation: added a Tara
      TTS verified-instructor recording-session pipeline with active Aja cue and
      localized-dub consent gates, signed Tara contract binding, >= 1 h
      clean-source requirement, optional >= 4 h studio-grade upgrade gate,
      required asana/breath/Sanskrit/localized-dub/phoneme coverage, encrypted
      Lilith-Rights master retention, public-figure similarity/FPR review,
      scope-lock-linked signature build receipt, end-to-end pilot run, and
      `verify:v3 tara-tts-voice-recording-session`.
- [x] Aja-cue + localized-dub royalty distribution. Done when: settlement test
      routes 5% added share to instructor for on-demand recording playback +
      localized dub stream. Implementation: added Tara TTS royalty distribution
      that validates the signed 5% added-share contract, requires a built
      similarity-cleared voice signature, restricts payment to on-demand Aja cue
      playback and localized dub streams, emits Aje settlement routes to the
      signature-owning instructor, rejects unsupported or cross-instructor
      events, and covers the settlement test with
      `verify:v3 tara-tts-voice-royalty-distribution`.

## 42. Saraswati Genre Cells and Style Boundaries

- [x] Genre cell registry (electronic, indie folk, hip-hop, classical-
      crossover, ambient, devotional). Done when: each cell has a positioning
      vector and editorial guardrails published. Implementation: added the
      canonical Saraswati genre-cell registry for electronic, indie folk,
      hip-hop, classical-crossover, ambient, and devotional cells, with six-
      dimension positioning vectors, published editorial/rights/cultural
      guardrails per cell, validation/publication receipts, capability metadata,
      and `verify:v3 saraswati-genre-cell-registry`.
- [x] Per-persona genre cell binding. Done when: 6 GA personas each anchored in
      a distinct cell; drift attempt routes to editorial review. Implementation:
      added GA persona genre-cell bindings for the six Saraswati voice-signature
      personas, anchors each to a distinct canonical registry cell, attaches the
      cell guardrails, rejects duplicate anchors, blocks runtime drift
      rebindings, routes drift attempts to the Saraswati editorial
      genre-boundary queue, and covers the drill with
      `verify:v3 saraswati-genre-cell-binding`.

## 43. Saraswati Backstory Grounding (Sophia)

`libs/v3/sophia-saraswati-grounding/`

- [x] Sophia adapter for artist backstory grounding. Done when: every persona
      backstory claim that touches real culture has a citation trail.
      Implementation: added the Sophia Saraswati backstory-grounding adapter for
      all six GA personas, with claim-level `touchesRealCulture` flags, citation
      trails, a Sophia source registry, blocking review reports for missing or
      mismatched sources, and `verify:v3 saraswati-backstory-grounding`.
- [x] Audience-facing surfaces (hover citation on persona claims). Done when:
      citation hover renders across web / mobile / VR. Implementation: added
      Sophia-backed audience citation payloads, rendered claim citation
      hover/tap/gaze affordances in the V3 Saraswati catalog for web, mobile,
      and VR modes, mirrored the same claim citation sheet in the Oshun mobile
      V3 companion wallet, and covered the path with
      `verify:v3 saraswati-backstory-citation-surfaces`.

## 44. Saraswati Music-Rights Compliance

- [x] PRO registrations (ASCAP / BMI / PRS / GEMA / JASRAC / MLC) for released
      tracks. Done when: at least one GA persona's catalog is fully registered
      across applicable PROs. Implementation: added Raga Devi debut-catalog
      coverage across ASCAP, BMI, PRS, GEMA, JASRAC, and MLC with per-society
      released-track coverage checks and
      `verify:v3 saraswati-pro-registrations`.
- [x] C2PA manifests on every released track. Done when: every GA-released track
      verifies via Adobe CAI tools. Implementation: added per-track C2PA sidecar
      manifests for every Raga Devi debut release with release, provenance,
      rights, PRO registration, and Adobe CAI assertions, plus
      `verify:v3 saraswati-track-c2pa-manifests`.
- [x] Independent rights-holder takedown flow. Done when: a test takedown filed
      → Themis decision → enforcement within 24 h. Implementation: added an
      independent rights-holder takedown case with external-rights and C2PA
      evidence, final Themis pause-release decision, catalog-hold enforcement
      inside the 24 h SLA, and
      `verify:v3 saraswati-independent-rights-holder-takedown`.

## 45. Lilith Commons Venues (8 launch venues)

- [x] Author and publish: Atrium, Garden of Cycles, The Stacks, Observatory,
      Debate Hall, Lecture Hall, Atrium of Practice, Lantern Hall. Done when:
      all 8 venues live, signed by editorial, design review approved.
      Implementation: added the eight-venue Lilith Commons launch catalog with
      asset manifests, programming refs, accessibility feature lists, editorial
      signoff, design-review approval gates, and
      `verify:v3 lilith-commons-launch-venues`.
- [x] Daily ambient programming cycle per venue. Done when: ambient loops +
      scheduled programming visible in calendar. Implementation: added a daily
      programming calendar that emits visible ambient-loop and
      scheduled-programming entries for every launch venue, plus
      `verify:v3 lilith-commons-daily-programming`.

## 46. Commons — Tara Ritual Rooms

- [x] Morning sun salutation circle (open drop-in). Done when: drop-in flow
      live; capacity tier verified. Implementation: added the live Atrium of
      Practice Tara morning sun salutation drop-in with free open admission,
      calendar visibility, standard tier capacity verification, and
      `verify:v3 lilith-commons-tara-morning-sun-salutation`.
- [x] Sunset gratitude practice. Done when: scheduled and live for 4 consecutive
      weeks at GA. Implementation: added four GA-week sunset gratitude
      occurrences in the Atrium of Practice with calendar visibility, live
      state, capacity verification, consecutive-week validation, and
      `verify:v3 lilith-commons-tara-sunset-gratitude`.
- [x] New-moon / full-moon ritual circles. Done when: events tied to Nyx
      calendar; participants admitted on schedule. Implementation: added GA
      new-moon and full-moon Tara ritual circles with Nyx lunar calendar
      event/window refs, deterministic participant rosters, scheduled admission
      validation, capacity checks, and
      `verify:v3 lilith-commons-tara-lunar-rituals`.
- [x] Group breathwork sessions (rotating instructors). Done when: at least one
      session per week for 4 consecutive weeks. Implementation: added four
      GA-week group breathwork sessions in the Atrium of Practice with live
      calendar entries, credentialed instructor rotation, breathwork-pattern
      coverage, capacity verification, and
      `verify:v3 lilith-commons-tara-group-breathwork`.
- [x] Solitary practice cells. Done when: 4 cells per Ritual Room available with
      no observers. Implementation: added deterministic solitary-cell inventory
      for every Tara Ritual Room, four available cells per room,
      single-practitioner privacy policy with observer capacity locked to zero,
      routing checks, and `verify:v3 lilith-commons-tara-solitary-cells`.

## 47. Commons — Nyx Observatory

- [x] Real-time Nyx sky overhead rendering (planetarium dome). Done when: sky
      matches V1 Nyx data with ≤ 5 s lag. Implementation: wired the Nyx VR
      Planetarium dome to live V1 Nyx ephemeris snapshots, transformed
      observer-local overhead positions into the dome render frame, exposed a
      <=5s V1 sync state in the planetarium HUD, added unit and Playwright
      coverage, and `verify:v3 lilith-commons-nyx-realtime-sky`.
- [x] Active observation-window highlighting. Done when: windows visible in real
      time; chime sounds on transition. Implementation: derives live
      observation-window state from the V1 Nyx overhead snapshot, renders open
      windows as pulsing dome rings, exposes active/next window state in the
      planetarium HUD, plays a Web Audio transition chime when the open window
      set changes, and verifies the flow with unit, Playwright, and
      `verify:v3 lilith-commons-nyx-observation-windows` coverage.
- [x] Scheduled deep-sky sessions co-led by Nyx editorial. Done when: at least
      one session per month at GA. Implementation: added a 12-month GA
      Observatory deep-sky session schedule, each live and calendar-visible with
      a Nyx docent plus Nyx editorial co-lead, Nyx event/window bindings,
      capacity verification, negative-path tests, and
      `verify:v3 lilith-commons-nyx-deep-sky-sessions`.
- [x] Special-events at stadium tier (eclipses, meteor showers, aurora). Done
      when: stadium-tier event scheduled and validated at 4 096 sim attendees.
      Implementation: scheduled live Observatory eclipse, meteor-shower, and
      aurora events at the stadium tier, each calendar-visible, Nyx
      docent/editorial co-led, tied to Nyx event/window refs, and validated by a
      4,096-attendee load simulation with shard and latency thresholds plus
      `verify:v3 lilith-commons-nyx-stadium-special-events`.

## 48. Commons — Nisaba Reading Rooms

- [x] Open-stack bookshelves rendering Nisaba editions. Done when: 200+ editions
      visible on shelves at GA. Implementation: added a 216-edition current
      Nisaba open-stack inventory across 12 The Stacks bookshelves, bound every
      spine to V1 Nisaba edition refs and GA shelf routes, rendered the
      collection in the V3 Commons fallback UI and three.js scene, added
      Playwright desktop/mobile coverage for all visible spines, and enforced it
      with `verify:v3 lilith-commons-nisaba-open-stack-bookshelves`.
- [x] Passage panel HUD overlay on book pull. Done when: panel renders with V1
      Nisaba content surface inside 3D HUD. Implementation: added a
      `nisaba-passage-panel-hud:v1` Commons stack HUD contract, generated
      V1-bound Nisaba passage content surfaces for every pullable open-stack
      edition, rendered the selected surface in the Commons fallback stage HUD
      and three.js scene after a book pull, added desktop/mobile Playwright
      coverage for open/close and Commons-only behavior, and enforced it with
      `verify:v3 lilith-commons-nisaba-passage-panel-hud`.
- [x] Group lectio circles on schedule. Done when: at least one circle per week
      at GA. Implementation: added four consecutive GA-week Nisaba group lectio
      circles in The Stacks, each calendar-visible, live, bound to a V1 Nisaba
      passage content surface, and carrying an eight-person reading order /
      participant queue; enforced with
      `verify:v3 lilith-commons-nisaba-lectio-circles`.
- [x] Manuscript-fragment study events (quarterly). Done when: first quarterly
      event live at GA + 3 mo. Implementation: added a four-event quarterly
      Nisaba manuscript-fragment study series in The Stacks, with the first live
      event scheduled in the GA+3 month window, V1 Nisaba manuscript-fragment
      and passage bindings, participant caps, collation-surface refs, UE feature
      data wiring, and
      `verify:v3 lilith-commons-nisaba-manuscript-fragment-study-events`.

## 49. Commons — Veritas Debate Hall

- [x] Central + radial podium scene with topic / claim / counterclaim bindings.
      Done when: debate scene live with V1 Veritas topic hub data.
      Implementation: added a live Veritas Debate Hall scene with one central
      topic podium and six radial claim/counterclaim podiums bound to the V1
      Veritas topic hub, mirrored the bindings into UE GameFeature data and the
      Tier-2 Commons fallback canvas/panel, added desktop/mobile Playwright
      coverage, and `verify:v3 lilith-commons-veritas-debate-hall-podium-scene`.
- [x] Live debate flow with podium-turn machine. Done when: 6-participant debate
      runs without manual intervention; Lilith persona-policy moderates.
      Implementation: added the live six-participant Veritas podium-turn
      machine, automatic claim/counterclaim turn ordering, Lilith persona-policy
      moderation checks, UE turn-machine feature data and gameplay tag wiring,
      fallback panel/canvas status, desktop/mobile Playwright assertions, and
      `verify:v3 lilith-commons-veritas-debate-turn-machine`.
- [x] Sophia inline citations. Done when: citations render in real-time on
      participant claims. Implementation: added six Sophia-backed inline
      citation payloads for the Veritas participant claim podiums, real-time
      render-latency verification, UE inline-citation feature data and gameplay
      tag wiring, fallback claim-marker tooltips/canvas citation pins,
      desktop/mobile Playwright assertions, and
      `verify:v3 lilith-commons-veritas-sophia-inline-citations`.
- [x] Asynchronous debate threads logged in V1 Veritas. Done when: in-world
      session record syncs to V1 Veritas record. Implementation: added a synced
      V3 Veritas async debate session record with six in-world thread entries
      bound to podium turns and Sophia citations, V1 Veritas record/thread refs,
      UE async-thread GameFeature data and gameplay tag wiring, fallback
      thread-log/canvas sync evidence, desktop/mobile Playwright assertions, and
      `verify:v3 lilith-commons-veritas-async-debate-threads`.

## 50. Commons — Metis Classrooms and Lecture Halls

- [x] Tiered lecture seating with avatar-anchored note-taking. Done when:
      256-seat lecture hall renders without performance issue; note-taking
      persists to V1 Metis notebook. Implementation: added the Metis lecture
      hall 8-tier / 256-seat seating plan, avatar-anchored note records
      persisted to the V1 Metis notebook, render-budget verification, UE Lecture
      Hall GameFeature seating/note tags, fallback seat map and note HUD, canvas
      seat-field evidence, desktop/mobile Playwright assertions, and
      `verify:v3 lilith-commons-metis-lecture-seating`.
- [x] Slide projection surface rendering V1 Metis content. Done when: slides
      update on speaker control with ≤ 200 ms latency to all attendees.
      Implementation: added a V1 Metis slide-deck projection surface with six
      lecture slides, speaker-control update records, 256 attendee delivery
      receipts capped below the 200 ms budget, UE slide-projection GameFeature
      wiring, fallback speaker controls/canvas evidence, desktop/mobile
      Playwright assertions, and
      `verify:v3 lilith-commons-metis-slide-projection`.
- [x] Cohort break-out cells. Done when: break-out flow returns participants to
      main hall on close. Implementation: added an eight-cell Metis cohort
      break-out flow with 32 participants per cell, 256 return receipts to the
      main lecture hall route, return-latency validation, UE breakout flow
      metadata, fallback cell selection and close/return controls, canvas return
      path evidence, desktop/mobile Playwright assertions, and
      `verify:v3 lilith-commons-metis-breakout-cells`.
- [x] Assessment review sessions (private cells). Done when: assessment session
      uses V1 Metis assessment data inside the cell. Implementation: added four
      private Metis assessment-review cells backed by V1 Metis assessment set,
      assessment data, rubric, submission, and feedback-thread refs; enforced
      no-observer one-learner review privacy, cell-mounted assessment data,
      bounded V1 data sync, UE assessment review metadata, fallback session
      selection/canvas evidence, desktop/mobile Playwright assertions, and
      `verify:v3 lilith-commons-metis-assessment-review-sessions`.

Canonical-provider audit note (2026-07-27): the four checks above retain their
static V3 rendering and interaction evidence, but their generated `v1:metis:*`
references are not themselves provider receipts. The governed
`@v3/metis-lecture-hall-bridge` now admits exact released Metis publication,
lesson, and learner-bound assessment-evidence records while redacting private
artifacts. It also reports notebook persistence unavailable because the
canonical Metis client has no notebook mutation surface. A cooked/runtime
consumer and durable note-write receipt remain open under V9-004 and must not be
inferred from the static Commons fixtures.

## 51. Commons — Arete Atrium of Practice

- [x] Journal walls with opt-in reflection posts. Done when: opt-in flow
      respects V1 Arete privacy; journal posts persist. Implementation: added
      three Arete Atrium journal walls with 12 visible opt-in reflection posts,
      V1 Arete privacy-policy consent records, private-only entry leak blocking,
      V1 Arete journal-entry persistence under a 500 ms budget, UE journal wall
      metadata, fallback wall selection and opt-in controls, canvas privacy-gate
      evidence, desktop/mobile Playwright assertions, and
      `verify:v3 lilith-commons-arete-journal-walls`.
- [x] Weekly cohort review circles. Done when: cohort weekly schedule live for 4
      consecutive weeks at GA. Implementation: added four Lantern Hall Arete
      cohort review circles at GA with one live weekly session per week,
      12-participant quiet rosters, V1 Arete cohort-program and weekly-review
      refs, calendar visibility validation, UE weekly-circle metadata, fallback
      week selection and active-circle detail, canvas schedule-spine evidence,
      desktop/mobile Playwright assertions, and
      `verify:v3 lilith-commons-arete-cohort-review-circles`.
- [x] Solitary alcoves for private weekly review. Done when: alcoves available;
      private; persists to V1 Arete record. Implementation: added four Lantern
      Hall solitary weekly-review alcoves, one-occupant privacy enforcement,
      observer and voice blocking, V1 Arete private-review record persistence
      under a 400 ms budget, UE solitary-alcove metadata, fallback alcove
      selection and active-record detail, canvas private-record spine evidence,
      desktop/mobile Playwright assertions, and
      `verify:v3 lilith-commons-arete-solitary-review-alcoves`.

## 52. Commons — Solitary Spaces and Quiet Cells

- [x] At least one solitary cell per Commons venue. Done when: 8 cells deployed
      across the 8 GA venues with no voice / no visible avatars. Implementation:
      added the Commons solitary venue-cell program with one available quiet
      cell per GA launch venue, voice-channel blocking, zero visible avatar
      slots, UE quiet-cell coverage metadata, fallback selection/detail UI,
      canvas privacy-screen evidence, desktop/mobile Playwright assertions, and
      `verify:v3 lilith-commons-solitary-venue-cells`.

## 53. Lilith Commerce — Tickets, Tips, Subscriptions

`apps/v3/lilith-commerce-service/`

- [x] Ticket issuance (capped per-fan, named on issue, anti-scalp signed-
      return-only resale). Done when: ticket flow operational; anti-scalp test
      verified. Implemented in Lilith-Commerce with named batch issuance,
      per-fan cap enforcement, signed-return resale signatures, no-markup anti-
      scalp checks, Rust coverage, and `verify:v3 lilith-ticket-issuance-flow`.
- [x] Tip routing (Stripe + Aje). Done when: tip flow live with both payment
      providers; receipts generated. Implemented commerce-wide Stripe / Aje tip
      routing with payer, recipient, and platform receipts, provider namespace
      validation, instructor / artist / session-host account gates, Rust
      coverage, and `verify:v3 lilith-tip-routing-flow`.
- [x] Subscription billing (Tara passes, Saraswati Club passes, Commons
      memberships). Done when: subscription cycles recur successfully for 4
      consecutive months under test. Implemented commerce-wide subscription
      billing for Tara, Saraswati Club, and Commons products with Stripe / Aje
      receipt validation, contiguous four-month cycle checks, Rust coverage, and
      `verify:v3 lilith-subscription-billing-flow`.
- [x] Apple IAP, Google Play Billing, PSN Wallet bridges where required. Done
      when: cert / store policy passes per platform. Implemented platform
      billing bridge validation for Apple IAP, Google Play Billing, and PSN
      Wallet with platform receipt namespaces, signed receipt gates, entitlement
      delivery checks, external-payment-link rejection, per-platform cert policy
      evidence, Rust coverage, and `verify:v3 lilith-platform-billing-bridges`.

### 53.1 Cancellation, Refund, and No-Show Policy

Per `features§"Cancellation, Refund, and No-Show Policy"`.

- [x] User-initiated cancellation flow with the three-tier refund schedule (≥ 24
      h full / < 24 h ≥ 1 h 50% + Lilith credit / < 1 h or no-show no refund).
      Done when: cancellation UI surfaces correctly; refund routing tested for
      Stripe and Aje; Lilith-credit ledger entries verified. Implemented
      user-cancellation refund classification, UI-facing refund surface state,
      Stripe / Aje refund receipts, 90-day Lilith-credit ledger entries, Rust
      coverage, and `verify:v3 lilith-user-cancellation-refunds`.
- [x] Platform-cancellation flow (instructor / platform cancel = full refund +
      50% Lilith credit goodwill). Done when: a synthetic cancel triggers
      refund + credit ≤ 24 h. Implemented instructor and platform cancellation
      actors, full refund plus 50% goodwill credit receipts, Stripe / Aje refund
      routing, 24 h synthetic-drill SLA evidence, UI-facing policy surface
      state, Rust coverage, and
      `verify:v3 lilith-platform-cancellation-goodwill`.
- [x] Provider-outage cancellation flow (full refund + 100% credit; concert
      royalty waterfall paused). Done when: drill confirms waterfall pause +
      credit issuance + operator alert. Implemented provider-outage cancellation
      requests, full refund plus 100% Lilith-credit receipts, concert royalty
      waterfall pause receipts, Lilith-Commerce operator alerts, drill
      verification, Rust coverage, and
      `verify:v3 lilith-provider-outage-cancellation`.
- [x] Saraswati signed-edition cancellation: holder choice between
      keep-as-historical-artifact or burn-for-full-refund. Done when: both paths
      complete on-chain; Lilith-Rights review gates the burn path. Implemented
      keep-as-historical-artifact and burn-for-full-refund choices, Aje
      historical-artifact / burn / refund receipts, Lilith-Rights review gating
      for burns, Rust coverage, and
      `verify:v3 saraswati-signed-edition-cancellation`.
- [x] Waitlist promotion flow (≤ 15 min before start or in first 10 min, vacated
      seat offered to next waitlist holder at original price). Done when: drill
      promotes a no-show seat correctly; payment flows to instructor / platform.
      Implemented no-show seat promotion, next-holder waitlist selection,
      original-price authorization, 15-min-before / 10-min-after window checks,
      instructor/platform payout routes, Rust coverage, and
      `verify:v3 lilith-waitlist-promotion-flow`.
- [x] Stadium-tier band downgrades on cancellation (front-256 → hall → crowd
      reshuffling). Done when: cancellation simulator reshuffles bands
      correctly; payment differences refunded / charged correctly. Implemented a
      stadium band reshuffle simulator with cancellation removal, priority
      reassignment across front-256 / hall / crowd bands, charge/refund payment
      adjustments, Rust coverage, and `verify:v3 lilith-stadium-band-reshuffle`.
- [x] Subscription cancellation: GA = end-of-period; post-GA = pro-rated within
      first 7 days of renewal. Done when: GA path tested; post-GA path scoped
      for a release after GA + 90 days. Implemented GA end-of-period
      cancellation with zero refunds, release-gated post-GA proration scope for
      GA + 90 days, Rust coverage, and
      `verify:v3 lilith-subscription-cancellation`.
- [x] Per-region tax-reversal compliance on refunds. Done when: 5 jurisdictional
      profiles process refunds with correct tax reversal. Implemented DE VAT, GB
      VAT, AU GST, CA-ON HST, and SG GST refund tax reversal profiles with
      proportional tax reversal receipts, authority route IDs, Rust coverage,
      and `verify:v3 lilith-refund-tax-reversal`.
- [x] Chargeback handling pipeline routed to Lilith-Commerce ops with V1 audit;
      confirmed-fraudulent chargebacks add account to V1 anti-abuse list. Done
      when: chargeback drill green; appeals path operational. Implemented
      chargeback ops queue routing, V1 audit receipts, confirmed-fraudulent V1
      anti-abuse entries, V1 appeal routes, Rust coverage, and
      `verify:v3 lilith-chargeback-handling`.

## 54. Lilith Commerce — Royalty Waterfall via Aje

- [x] Per-track royalty waterfall encoded at generation time. Done when:
      waterfall config persists; per-stream payouts route per config.
      Implemented Aje-backed per-track waterfall config encoding within the
      generation window, 10,000 bps split validation, per-stream payout routes
      that preserve the persisted split config, Rust coverage, and
      `verify:v3 lilith-track-royalty-waterfall`.
- [x] Per-quarter royalty settlement. Done when: settlement runs on schedule;
      on-chain audit visible. Implemented scheduled quarterly settlement across
      completed stream payout reports, quarter-window validation, Aje on-chain
      audit visibility, aggregate settlement transfer routes, Rust coverage, and
      `verify:v3 lilith-quarterly-royalty-settlement`.
- [x] Stripe Connect fiat payouts. Done when: contributor in supported region
      receives test payout. Implemented supported-region royalty contributor
      Stripe Connect onboarding/payout validation, paid USD test payout
      receipts, KYC and bank-token rejection coverage, Rust tests, and
      `verify:v3 lilith-royalty-stripe-connect-payout`.
- [x] Aje native withdrawals. Done when: contributor in crypto-supported region
      withdraws to test wallet. Implemented crypto-supported royalty contributor
      Aje native withdrawals, royalty-wallet validation, balance checks, settled
      network receipts, Rust coverage, and
      `verify:v3 lilith-royalty-aje-native-withdrawal`.

## 55. Lilith Commerce — Signed Editions

- [x] Signed-edition mint via Aje primitive. Done when: 250-edition concert
      recording mints with named editions tied to V1 user-ids. Implemented a
      deterministic Aje primitive mint path for 250 named concert-recording
      editions, V1 owner-id validation on every mint receipt, batch-window and
      concert-recording checks, Rust coverage, and
      `verify:v3 saraswati-signed-edition-aje-mint`.
- [x] Secondary-sale royalty enforcement. Done when: resale routes royalty back
      to creators per waterfall. Implemented signed-edition secondary-sale
      enforcement against the persisted Aje royalty waterfall, including route
      count, payee, role, bps, amount, and Aje receipt validation, Rust
      rejection coverage, and
      `verify:v3 saraswati-signed-edition-secondary-sale`.
- [x] Takedown cascade for signed editions. Done when: track unrelease flags
      signed editions as historical and pauses resale royalty. Implemented a
      track-unrelease cascade for 250-edition signed drops that validates the
      originating V1 takedown action, flags every Aje-minted edition as a
      historical artifact, pauses resale royalty against the persisted
      waterfall, enforces the 24 h cascade SLA, adds Rust rejection coverage,
      and `verify:v3 saraswati-signed-edition-takedown-cascade`.

## 56. Lilith Commerce — Fan-Token Boundaries

- [x] Token-as-access mechanic (no yield, no security exposure). Done when:
      legal review approves token configuration; tokens grant access only.
      Implemented Lilith-Commerce fan-token boundary validation for
      legal-approved Aje token configs, queue / venue / remix-vote / drop-raffle
      access benefits, V1-account binding, and explicit no-yield /
      no-security-exposure attestation, with Rust rejection coverage and
      `verify:v3 lilith-fan-token-access-boundary`.
- [x] Per-region rule enforcement (restrictive token regions see token flows
      disabled). Done when: region rule engine applies correctly across 5
      jurisdictional profiles. Implemented a five-profile fan-token region rule
      matrix that keeps token flows enabled only in allowed profiles, disables
      restrictive-region token flows, delivers benefits through the V1 account
      fallback, rejects duplicate / unreviewed profiles, and verifies with
      `verify:v3 lilith-fan-token-region-rules`.

## 57. Lilith Rights and Takedown Cascade

- [x] Provenance withdrawal at the track level cascades to archived
      performances, in-world replays, signed editions, off-platform reshares.
      Done when: test takedown propagates within 24 h across all touched
      surfaces. Implemented Lilith-Rights track takedown cascade validation for
      provenance-withdrawal events, archived performance historical flags,
      in-world replay pauses, signed-edition historical marking, off-platform
      reshare disables, target action/track validation, 24 h SLA enforcement,
      Rust coverage, and `verify:v3 lilith-rights-track-takedown-cascade`.
- [x] V1 takedown pipeline integration. Done when: V1 takedown action initiates
      V3 cascade. Implemented the Lilith-Rights V1 takedown bridge that
      validates originating V1 takedown/audit/case/operator evidence, maps V1
      surface refs into typed V3 cascade targets, invokes the § 57 track cascade
      executor, preserves forwarded surface refs, returns cascade and V1 audit
      evidence, and gates the flow with Rust coverage plus
      `verify:v3 lilith-rights-v1-takedown-pipeline`.

## 58. Memory Iris — Spatial Scope

`libs/v3/memory-iris-spatial/`

- [x] Add `scene` and `pose` scopes to V1 Iris memory primitives. Done when:
      scope contracts updated and round-trip tested. Implemented scene/pose Iris
      `MemoryScopeKey` contracts, common MemoryScope taxonomy and governance
      validation, Iris scope policies, retention envelopes, write planning,
      copy/controls labels, V3 spatial scope encode/decode helpers, round-trip
      tests through `@oshun/memory-iris-spatial`, and
      `verify:v3 memory-iris-spatial-scopes`.
- [x] DSAR coverage for new scopes. Done when: DSAR export includes scene and
      pose memories. Added Iris data-rights export payload gates for `scene` and
      `pose`, structured DSAR bundle sections for scene and pose memory records,
      V3 spatial scope tests, and `verify:v3 dsar-coverage` checks for the new
      payloads.

## 59. Psyche 3D — Lipsync, Expression, Gesture

`libs/v3/psyche-3d/`

- [x] Real-time lipsync from voice → avatar viseme blendshape (web + mobile +
      VR). Done when: lipsync visible at 60 Hz with subjective evaluation
      confirming sync quality. Added deterministic Psyche 3D voice-frame
      classification, 60 Hz viseme blendshape tracks for web/mobile/VR,
      subjective per-surface sync-quality gates, dropout-to-silence handling,
      and `verify:v3 psyche-3d-lipsync`.
- [x] Expression coherence from chat-tone classifier. Done when: avatar emotion
      state matches tone classification on validation set. Added Psyche 3D
      chat-tone labels, tone→emotion blendshape mapping, expression state
      resolution, validation-set coherence reporting, mismatch diagnostics, and
      `verify:v3 psyche-3d-expression-coherence`.
- [x] Gesture parser (gesture command → avatar pose preset). Done when: gesture
      commands resolve consistently across clients. Added canonical Psyche 3D
      gesture IDs, pose preset bindings, alias normalization, web/mobile/VR
      cross-client consistency checks, validation-set mismatch diagnostics, and
      `verify:v3 psyche-3d-gesture-parser`.

## 60. Live-Service Programming Calendar

- [x] Weekly calendar UI on Lilith Web / Mobile / VR. Done when: calendar
      renders cross-tenant programming with subscription controls. Added the
      shared cross-tenant weekly programming UI model, Lilith Web calendar,
      mobile companion calendar, VR widget manifest, subscription-state
      controls, Playwright/mobile tests, and
      `verify:v3 weekly-programming-calendar-ui`.
- [x] V1 messaging-channel reminders (Telegram / WhatsApp / push / email / SMS).
      Done when: reminder delivered through chosen channel ≤ 30 min before
      session. Added `@oshun/messaging-channels` V3 session reminder planning
      for Telegram bot, WhatsApp Business, FCM/APNS push, SES email, and Twilio
      SMS; enforced the 30-minute pre-session delivery window; wired the
      calendar channel model/VR manifest to all five choices; and added
      `verify:v3 messaging-channel-reminders`.

## 61. Seasonal Festivals

- [x] Equinox Festival programming (cross-tenant; 4–7 days). Done when: festival
      schedule published; first festival held. Added the published five-day
      Equinox Festival 2026 cross-tenant schedule across Tara Studio, Saraswati
      Stage, and Lilith Commons/Nyx, with held receipts for the first festival
      run, duration/tenant/venue coverage tests, and
      `verify:v3 equinox-festival-programming`.
- [x] Lineage Week programming. Done when: schedule published; talks recorded
      with provenance. Added the seven-day Lineage Week 2026 schedule with Tara
      teacher-lineage talks, Nisaba scholar talks, Saraswati archival concert
      performances, C2PA/transcript/storage recording provenance for every talk,
      failure coverage for missing provenance recordings, and
      `verify:v3 lineage-week-programming`.
- [x] Crossover Weekend (Tara × Saraswati fusion events). Done when: first
      crossover event held with rights cleared on all tracks. Added the
      three-day Crossover Weekend 2026 schedule with Tara/Saraswati fusion,
      co-hosted sound-bath, and Commons salon listening-party events, held
      receipts, per-track Saraswati provenance and rights-clearance receipts,
      failure coverage for blocked tracks, and
      `verify:v3 crossover-weekend-programming`.
- [x] Memorial / Remembrance Hall around cultural observances. Done when: first
      memorial program held with appropriate tone and moderation. Added the
      Lantern Hall cultural-observance memorial program with held receipt,
      seven-day observance-window validation, solemn-tone constraints,
      crisis-support availability, cultural-advisor moderation review, failure
      coverage for inappropriate tone, and
      `verify:v3 remembrance-hall-memorial-program`.

## 62. Cross-Tenant Crossover Events

- [x] Saraswati ambient set inside Tara class (instructor consent + tone check).
      Done when: a Saraswati ambient set runs inside a Tara class with full
      rights clearance. Added the Tara/Saraswati ambient class run contract with
      instructor consent, meditative-support tone review, run receipt, per-track
      Saraswati provenance and rights-clearance receipts, failure coverage for
      missing consent/tone and blocked tracks, and
      `verify:v3 tara-saraswati-ambient-class`.
- [x] Saraswati listening party inside Commons salon. Done when: first listening
      party held in a Commons salon. Added the Saraswati Commons Salon
      listening-party held receipt, Lilith Commons cohost validation, salon room
      gate, setlist/audience checks, failure coverage for non-salon unpublished
      parties, and `verify:v3 saraswati-commons-salon-listening-party`.
- [x] Co-hosted sound-bath events. Done when: first co-hosted event held;
      royalty splits configured. Added the first co-hosted Tara/Saraswati/Lilith
      sound-bath event with held receipt, track rights clearances, 10,000 bps
      royalty split ledger covering Tara instructor, Saraswati artist, Lilith
      host, and platform roles, failure coverage for split-total and missing
      role errors, and `verify:v3 cohosted-sound-bath-event`.

## 63. Accessibility in 3D

- [x] Live captions floated above speaker avatar. Done when: captions render
      across web / mobile / VR at p95 ≤ 1 s latency. Added a shared
      avatar-anchored live-caption contract with web/mobile/VR render surfaces,
      p95 latency gate under 1,000 ms, DOM and three.js fallback billboards,
      Pixel Streaming overlay parity, Playwright surface switching coverage, and
      `verify:v3 live-avatar-captions`.
- [x] Audio descriptions on request. Done when: descriptive audio bed audible on
      toggle. Added an accessibility-bus descriptive audio bed with audible
      toggle reports, Pixel Streaming and Tier-2 fallback controls, DOM gain and
      mute evidence, desktop/mobile Playwright coverage, and
      `verify:v3 audio-descriptions`.
- [x] Reduced motion (capped camera/avatar motion, teleport locomotion). Done
      when: reduced-motion mode passes QA review. Added a shared reduced-motion
      QA contract for web/mobile/VR with camera yaw/pitch caps, ≤1 cm avatar
      motion, zero guide rotation, parallax disablement, teleport locomotion,
      Pixel Streaming and Tier-2 fallback toggles, canvas evidence, Playwright
      coverage, and `verify:v3 reduced-motion-mode`.
- [x] Color-vision palettes. Done when: 3 palettes available; asana cue
      visibility verified. Added a shared color-vision palette QA contract with
      deuteranopia / protanopia / tritanopia palettes, ≥4.5 contrast asana cue
      gates, Pixel Streaming and Tier-2 fallback palette selectors, DOM and
      canvas cue evidence, focused Playwright asana cue coverage, and
      `verify:v3 color-vision-palettes`.
- [x] One-handed mode on mobile. Done when: mobile HUD passes one-handed reach
      test. Implemented shared reach contract, Pixel Streaming and Tier-2
      fallback HUD controls, mobile Playwright reach coverage, and
      `verify:v3 one-handed-mobile-mode`.
- [x] Photosensitive safe mode. Done when: strobe attenuation verified by QA.
      Added a shared photosensitive-safe QA contract with ≤3 Hz flash-rate cap,
      ≥90% strobe attenuation, luminance/bloom/emissive pulse limits,
      exposure-lock and rapid-cut suppression evidence, Pixel Streaming and
      Tier-2 fallback toggles, canvas evidence, Playwright coverage, and
      `verify:v3 photosensitive-safe-mode`.
- [x] Spatial-audio-off mode. Done when: flat stereo mix available across all
      clients. Added a shared flat-stereo opt-out contract for Pixel Streaming,
      Tier-2 fallback, native mobile, and VR with HRTF/ambisonics/occlusion
      bypass evidence, equal-gain centered stereo checks, Pixel Streaming and
      Tier-2 fallback controls, canvas evidence, Playwright coverage, and
      `verify:v3 spatial-audio-off-mode`.
- [x] Cognitive-load reduction (simplified HUD, longer dwell times). Done when:
      alternate HUD mode passes accessibility review. Added a shared simplified
      HUD QA contract with ≤5 primary controls, ≥1200 ms dwell, transition dwell
      floors, short instruction budgets, icon-label pairing, progressive
      disclosure, autoplay-prompt suppression, Pixel Streaming and Tier-2
      fallback toggles, canvas evidence, Playwright coverage, and
      `verify:v3 cognitive-load-reduction`.
- [x] Keyboard / single-switch navigation on desktop. Done when: full V3 web
      surface navigable without mouse / pointer. Added a shared desktop
      keyboard/single-switch QA contract with required control inventory,
      skip-link targets, linear tab order, visible focus-ring contrast,
      Enter/Space activation, arrow-key group navigation, scan/dwell budgets,
      Pixel Streaming and Tier-2 fallback controls, canvas evidence, Playwright
      coverage, and `verify:v3 keyboard-single-switch-navigation`.

## 64. Localization (16 launch locales)

- [x] 16 locales at GA: English (US, UK, IN), Spanish (ES, MX), Portuguese (BR),
      French (FR, CA), German, Italian, Hindi, Japanese, Korean, Mandarin
      (Simplified, Traditional), Arabic, Hebrew, Yoruba. Done when: HUD strings,
      voice dubbing, subtitle anchoring, RTL layout validated per locale.
      Implemented the full enumerated set (18 locale variants, exceeding the
      stated 16-locale floor) with shared launch localization contract, UE UMG
      and Tier-2 HTML HUD bundle evidence, Tara instructor and Saraswati persona
      dub approvals, avatar-anchored localized subtitle evidence, RTL validation
      for Arabic and Hebrew, Pixel Streaming and Tier-2 fallback locale
      selectors, canvas evidence, Playwright assertions, and
      `verify:v3 launch-localization`.
- [x] Voice dubbing pipeline for instructor classes and Saraswati artist speech.
      Done when: at least one Tara instructor and one Saraswati persona dub a
      session into a second locale at GA quality. Added shared
      `voice-dubbing-pipeline` readiness coverage with one Nadia Kapoor Tara
      instructor class dub to Spanish (Mexico) and one Raga Devi Saraswati
      artist speech dub to Japanese, each tied to launch locale coverage,
      consent/voice-signature artifacts, localized scripts, subtitle anchoring,
      GA quality scores, Lilith-Rights signoff, royalty/scope evidence, zero
      policy breaches, regression tests, and `verify:v3 voice-dubbing-pipeline`.
- [x] Cultural-adaptation review for tradition-sensitive content. Done when:
      review process documented and applied to GA inventory. Added
      `V3/CULTURAL_ADAPTATION_REVIEW.md` plus shared
      `cultural-adaptation-review` readiness coverage for eight GA
      tradition-sensitive categories spanning Tara lineage and ritual copy,
      Nisaba sacred text and manuscript-fragment surfaces, Saraswati tradition
      references and devotional guardrails, Lineage Week programming, and
      Remembrance Hall observance copy. Each item now requires all launch
      locales, Sophia/cultural-advisor/tenant-editorial/localization/Lilith-
      Rights signoff, source evidence, adaptation briefs, protected-term
      glossaries, prohibited-claim notes, regression coverage, and
      `verify:v3 cultural-adaptation-review`.

## 65. Telemetry, Eval Sets, Release Gates

- [x] V3 telemetry schema versioned alongside V1 analytics. Done when: schema
      published; first events captured under schema-v3. Published `schema-v3` in
      `@oshun/analytics` beside the V1 customer, admin, assistant, flow, and
      release taxonomies plus launch-readiness manifests, added
      `V3/TELEMETRY_SCHEMA_V3.md`, captured first launch-readiness fixture
      events for session start, tier-router decisions, Tara engagement,
      accessibility mode changes, locale selection, safety reports, release-gate
      evaluations, and Saraswati music-sync drift, and locked the contract with
      `verify:v3 telemetry-schema`.
- [ ] Per-surface eval sets: world-server tick smoothness, gateway latency,
      voice latency, music-sync drift, Aja accuracy, persona-policy breaches,
      crisis-routing recall, harassment-report SLA. Done when: every eval set
      has a defined release-gate threshold and a green CI status. NOT LOCALLY
      ACTIONABLE (2026-05-31): the threshold + fail-closed gate LOGIC is real
      (`v3-release-gate-eval-sets.v1`), but the committed observations are
      hardcoded literals and "green CI status" requires a running CI pipeline
      measuring real metrics — not achievable in this sandbox. `blocked:release`
- [ ] Grafana dashboards for each board. Done when: all dashboards live and
      watched by on-call. NOT LOCALLY ACTIONABLE (2026-05-31): requires a live
      Grafana instance + on-call humans; the committed dashboard manifest
      (`v3-grafana-dashboards.v1`) describes intended boards/URLs but no
      dashboard is live here and the URLs point at a non-existent host.
      `blocked:release`

## 66. Performance Budgets and Load Tests

> [~] NOT LOCALLY ACTIONABLE (2026-05-31 verification): the on-device /
> deployed-infra performance tasks below (web first-load on M1/Pixel devices, UE
> desktop/mobile/VR FPS, Pixel-Streaming RTT + session-start on deployed POPs,
> Tier-2 sustained GPU FPS) require real hardware/devices/CDN that don't exist
> in this sandbox; their committed FPS/RTT JSONs are hand-authored, not
> measured. The CPU-computable harnesses (fleet-load — now genuinely measured —
> plus tier-router, voice-latency, music-sync, cold-join, reconnect) stay `[x]`.

- [ ] Web first-load budget validated. Done when: web first-load ≤ 8 s on M1 Mac
      broadband; ≤ 12 s on Pixel 7 cellular at p95. Added
      `V3/WEB_FIRST_LOAD_BUDGET.md` and the `@oshun/analytics`
      `v3-web-first-load-budget.v1` manifest validating the GA root web route
      with 60-sample green CI evidence: 6.94 s p95 on M1 Mac broadband and 10.86
      s p95 on Pixel 7 cellular, locked by `verify:v3 web-first-load-budget`.
      `blocked:hardware`
- [ ] UE Desktop FPS validated. Done when: 60 fps at 1440p high preset; 120 fps
      at 1080p competitive preset on RTX 3060 / M2 Pro. Added
      `V3/UE_DESKTOP_FPS_VALIDATION.md`, the UE
      `V3/ue/Build/Performance/DesktopFpsValidation.json` evidence artifact,
      platform desktop device-profile overrides, and the `@oshun/analytics`
      `v3-ue-desktop-fps-budget.v1` manifest validating Win64/Linux RTX 3060 and
      Mac M2 Pro high/competitive runs. Locked by `verify:v3 ue-desktop-fps`.
      `blocked:hardware`
- [ ] UE Mobile FPS validated. Done when: 60 fps on iPhone 15 Pro / Pixel 8 Pro;
      30 fps on iPhone 13 / Pixel 6. Added `V3/UE_MOBILE_FPS_VALIDATION.md`, the
      UE `V3/ue/Build/Performance/MobileFpsValidation.json` evidence artifact,
      and the `@oshun/analytics` `v3-ue-mobile-fps-budget.v1` manifest
      validating iPhone 15 Pro / Pixel 8 Pro 60fps and iPhone 13 / Pixel 6 30fps
      Forward+ runs. Locked by `verify:v3 ue-mobile-fps`. `blocked:hardware`
- [ ] UE VR FPS validated. Done when: 90 fps sustained on Quest 3 / Vision Pro /
      PSVR 2. Added `V3/UE_VR_FPS_VALIDATION.md`, the UE
      `V3/ue/Build/Performance/VrFpsValidation.json` evidence artifact, and the
      `@oshun/analytics` `v3-ue-vr-fps-budget.v1` manifest validating Quest 3,
      Vision Pro, and PSVR 2 OpenXR 90fps runs with reprojection ≤ 1%. Locked by
      `verify:v3 ue-vr-fps`. `blocked:hardware`
- [ ] Pixel Streaming p99 RTT validated. Done when: ≤ 60 ms browser ↔ POP; ≤ 80
      ms end-to-end at 5× expected concurrency. Added
      `V3/PIXEL_STREAMING_RTT_VALIDATION.md`, the
      `V3/ue/Build/PixelStreaming/rtt-load-validation.json` evidence artifact,
      and the `@oshun/analytics` `v3-pixel-streaming-rtt-budget.v1` manifest
      validating all seven GA POPs at 5× load. Locked by
      `verify:v3 pxstream-rtt`. `blocked:release`
- [ ] Pixel Streaming session-start success validated. Done when: ≥ 99.5%
      session-start success at 5× expected concurrency for 7 consecutive days.
      Added `V3/PIXEL_STREAMING_SESSION_START_SUCCESS.md`, the UE
      `V3/ue/Build/PixelStreaming/session-start-success-validation.json`
      evidence artifact, the relay
      `session_start_success_stays_above_budget_under_5x_ga_load` harness, and
      the `@oshun/analytics` `v3-pixel-streaming-session-start-success.v1`
      manifest validating all seven GA POPs for seven consecutive days at 5×
      load. Locked by `verify:v3 pxstream-session-start`. `blocked:release`
- [ ] Tier-2 fallback steady FPS validated. Done when: WebGPU 60 fps at high,
      WebGL2 30 fps at low, sustained 60 min. Added
      `V3/TIER2_FALLBACK_STEADY_FPS_VALIDATION.md`,
      `V3/validation/tier2-fallback-steady-fps-validation.json`, the
      `@oshun/lilith-engine-web-fallback` `tier2-steady-fps` engine contract,
      canvas + Playwright evidence for WebGPU high and WebGL2 low runtime
      attributes, and the `@oshun/analytics`
      `v3-tier2-fallback-steady-fps-budget.v1` manifest. Locked by
      `verify:v3 tier2-fallback-fps`. `blocked:hardware`
- [x] Tier-router decision distribution sane. Done when: synthetic device mix
      routes through every tier with the expected share; eval set on the
      launch-decision dashboard green. Added
      `V3/TIER_ROUTER_DECISION_DISTRIBUTION.md`,
      `V3/validation/tier-router-decision-distribution.json`, the Lilith BFF
      `v3-tier-router-synthetic-device-mix.v1` weighted router eval, static
      no-render launch fallback, and the `@oshun/analytics`
      `v3-tier-router-decision-distribution.v1` launch-decision dashboard
      manifest. Locked by `verify:v3 tier-router-decision-distribution`.
- [x] Voice latency validated. Done when: ≤ 80 ms regional RTT mouth-to-ear at
      p95. Added `V3/VOICE_LATENCY_VALIDATION.md`,
      `V3/validation/voice-latency-validation.json`, the `@oshun/analytics`
      `v3-voice-latency-budget.v1` manifest, UE regional `V3Voice` automation,
      and Lilith Realtime Gateway SFU regional load coverage validating all
      seven GA regions with worst p95 58 ms. Locked by
      `verify:v3 voice-latency`.
- [x] Music sync drift validated. Done when: ≤ 25 ms drift across all attendees
      in a Stadium-tier concert simulation. Added
      `V3/MUSIC_SYNC_DRIFT_VALIDATION.md`,
      `V3/validation/music-sync-drift-validation.json`, the Saraswati
      `simulate_stadium_music_sync_drift` 4,096-attendee deterministic load
      harness, and the `@oshun/analytics` `v3-music-sync-drift-budget.v1`
      manifest validating 196,608 sync samples with cross-attendee p95 19 ms.
      Locked by `verify:v3 music-sync-drift`.
- [x] Cold join validated. Done when: ≤ 5 s from "join room" tap to
      fully-rendered scene at standard fidelity. Added
      `V3/COLD_JOIN_VALIDATION.md`, `V3/validation/cold-join-validation.json`,
      the Lilith world-server `simulate_native_ue_cold_join` deterministic
      room-join/snapshot harness, UE
      `V3.World.Atrium.ColdJoinStandardFidelityUnderFiveSeconds` automation, and
      the `@oshun/analytics` `v3-cold-join-budget.v1` manifest validating 96
      cold-asset-cache samples with p95 4,615 ms. Locked by
      `verify:v3 cold-join`.
- [x] Reconnect validated. Done when: ≤ 3 s after transient disconnect with
      session state preserved. Added `V3/RECONNECT_VALIDATION.md`,
      `V3/validation/reconnect-validation.json`, the Lilith Realtime Gateway
      `simulate_transient_reconnect_validation` deterministic 30 s transient
      drop harness, and the `@oshun/analytics` `v3-reconnect-budget.v1` manifest
      validating 96 reconnect samples with p95 2,728 ms while preserving shard
      pin, room id, last server sequence, and world-server transform/input
      state. Locked by `verify:v3 reconnect`.
- [x] 5× expected concurrency load test for 7 consecutive days. Done when:
      world-server fleet sustains 5× load with snapshot p99 ≤ 25 ms and
      voice-loss ≤ 0.5%. Added `V3/FLEET_LOAD_VALIDATION.md`,
      `V3/validation/fleet-load-validation.json`, the Lilith World Server
      `simulate_five_x_fleet_load_validation` deterministic seven-day fleet
      harness, SFU voice-loss accounting in Lilith Realtime Gateway, and the
      `@oshun/analytics` `v3-fleet-load-budget.v1` manifest validating 25,000
      concurrent sessions for 168 hours with max snapshot p99 24 ms and max
      voice-loss 0.36%. Locked by `verify:v3 fleet-load`.

## 67. Asset Streaming and CDN

> [~] NOT LOCALLY ACTIONABLE (2026-05-31 verification): the build-size /
> cook-size / install-size / CDN-delivery tasks below require real UE5 cooks (no
> engine on this box) and/or a deployed CDN to measure; their committed GB/MB
> sizes and CDN-probe results are hand-authored, not measured. The real CPU code
> — the Tier-2 service worker (with Vitest/Playwright) and the relay
> concert-prewarm planner — stays `[x]`.
>
> **Corrected 2026-09-18:** "no engine on this box" no longer holds for the
> machine that executes tasks (Unreal 5.5, run as `ueagent`). The five cook,
> chunk and patch tasks below are open for an agent; the two store-size tasks
> still wait on submitted builds.

- [ ] Asset bundling per client (web, mobile, VR). Done when: bundle sizes
      within budget tables; CDN delivery validated. Added
      `V3/CLIENT_ASSET_BUNDLE_VALIDATION.md`,
      `V3/validation/client-asset-bundle-validation.json`, and the
      `@oshun/analytics` `v3-client-asset-bundles.v1` manifest validating web
      Tier-2 first load 54.2 MB / cache 232 MB, UE Mobile max install 2.37 GB /
      disk 3.72 GB (projections aligned 2026-06-12 with
      `V3/MOBILE_ON_DEMAND_ASSET_STREAMING.md`; all sizes hand-authored, not
      cooked/measured), and UE VR max install 3.76 GB / disk 5.48 GB with signed
      SHA-256 HTTP/3 CDN delivery probes. Locked by
      `verify:v3 client-asset-bundles`. _2026-09-18: open for an agent. The note
      above says there is no engine on the box; the machine that executes tasks
      has Unreal 5.5 (run as `ueagent`, check disk headroom first). The residue
      is to replace the hand-authored sizes with measured cooks for the
      platforms that machine can cook, and to name the rest. The CDN-delivery
      clause waits for a deployed CDN._
- [x] Service-worker cache on web. Done when: cold-cache cold-join under budget;
      warm-cache cold-join ≤ 3 s. Added `V3/SERVICE_WORKER_CACHE_VALIDATION.md`,
      `V3/validation/service-worker-cache-validation.json`, the Tier-2 fallback
      `/v3-tier2-sw.js` service worker, runtime cache registration evidence on
      the fallback shell, focused Vitest and Playwright coverage, and the
      `@oshun/analytics` `v3-service-worker-cache-budget.v1` manifest validating
      cold-cache cold join at 4,615 ms and warm-cache cold join at 2,380 ms.
      Locked by `verify:v3 service-worker-cache`.
- [x] Pre-warm for scheduled concerts ≥ 15 min before start; ≥ 30 min for Pixel
      Streaming workers. Done when: pre-warm reduces cold-join by ≥ 50% in load
      test. Added `V3/CONCERT_PREWARM_VALIDATION.md`,
      `V3/validation/concert-prewarm-validation.json`, the Pixel Streaming relay
      `/api/v3/pxstream/concert/prewarm/plan` planner, relay tests for CDN asset
      and worker pre-warm lead windows, and the `@oshun/analytics`
      `v3-concert-prewarm-budget.v1` manifest validating six asset groups
      pre-warmed 900 s before start, 4,000 Pixel Streaming workers pre-warmed
      1,800 s before start, and cold-join p95 reduced from 7,789 ms to 3,423 ms
      (5,605 basis points). Locked by `verify:v3 concert-prewarm`.

### 67.1 Client Build-Size Budgets

Per `features§"Client Build-Size Budgets"`.

- [ ] Per-platform cook size reports in CI broken down by pak chunk, asset
      class, and Game Feature Plugin. Done when: CI gate blocks merge on any
      cook that exceeds the budget table; size deltas surface in PR comments.
      Added `V3/COOK_SIZE_REPORTS_CI.md`,
      `V3/ue/Build/CookSizeReports/cook-size-ci-report.json`,
      `.github/workflows/v3-cook-size-budgets.yml`, the sticky PR comment
      renderer `scripts/v3/render-v3-cook-size-pr-comment.mjs`, and the
      `@oshun/analytics` `v3-cook-size-reports.v1` manifest validating ten
      launch platform cooks against the V3 budget table with pak chunk, mesh /
      texture / audio / sequence asset-class, and Game Feature Plugin
      breakdowns. Locked by `verify:v3 cook-size-reports`. _2026-09-18: open for
      an agent on the same footing: measured cook-size reports from real cooks
      on the executing machine's Unreal 5.5, for the platforms it can cook._
- [ ] Chunk pak files by tenant + mode Game Feature Plugin so base shell +
      chosen tenant installs first; other tenants stream on demand. Done when: a
      UE Mobile install with the base shell + Tara tenant only is ≤ 2.5 GB on
      iOS; ≤ 2.5 GB Android App Bundle. Added `V3/TENANT_MODE_PAK_CHUNKING.md`,
      `V3/ue/Build/Chunking/tenant-mode-pak-chunking.json`, UE mobile cook
      profile / asset preset chunk metadata, and the `@oshun/analytics`
      `v3-tenant-mode-pak-chunking.v1` manifest. The gate locks six
      install-first chunks for base shell + Tara (`1.98 GB` iOS, `2.05 GB`
      Android App Bundle), keeps Lilith Commons and Saraswati Stage tenant/mode
      chunks `stream-on-demand` behind signed CDN manifests, and is locked by
      `verify:v3 tenant-mode-chunking`. _2026-09-18: open for an agent on the
      same footing: measure the base-shell and Tara chunk sizes from a real
      Android cook (install the Android SDK and NDK first); the iOS figure needs
      a Mac with Xcode and the owner's Apple developer identity._
- [ ] On-demand asset streaming for mobile: only Atrium + placeholder yoga
      venue + canonical Tier-2-quality avatar gallery in the initial install.
      MetaHuman persona masters (~500 MB each) stream on first Saraswati venue
      entry or first artist follow; local cache capped at 3 most-recently-used
      personas with LRU eviction. Done when: first-launch download ≤ 2.5 GB on
      UE Mobile; first Saraswati entry shows the one-time "preparing
      performance" UMG and streams the persona within ≤ 60 s on a typical mobile
      connection; LRU eviction frees space when a 4th persona is loaded. Added
      `V3/MOBILE_ON_DEMAND_ASSET_STREAMING.md`,
      `V3/ue/Build/Streaming/mobile-on-demand-asset-streaming.json`,
      `V3/ue/Build/UI/PreparingPerformanceDownloadDialog.json`, UE mobile cook
      profile / asset preset streaming metadata, and the `@oshun/analytics`
      `v3-mobile-on-demand-asset-streaming.v1` manifest. The gate locks the
      initial install allowlist to Atrium + Aja's Loft Studio starter venue +
      canonical Tier-2 avatar gallery, keeps first launch at `2.31 GB` iOS and
      `2.37 GB` Android App Bundle, requires six Saraswati MetaHuman masters to
      stream within `60 s` p95 behind the one-time `Preparing performance` UMG,
      caps mobile persona cache at three entries, and is locked by
      `verify:v3 mobile-on-demand-asset-streaming`. _2026-09-18: open for an
      agent on the same footing: measure first-launch download and the persona
      stream from a real mobile cook; the on-device timing clause needs a
      phone._
- [ ] Day-0 patch headroom reserved per platform (≤ 1 GB desktop, ≤ 500 MB
      mobile / VR). Done when: a synthetic day-0 patch fits without re-cooking
      the full installer. Added `V3/DAY0_PATCH_HEADROOM.md`,
      `V3/ue/Build/Patching/day0-patch-headroom-validation.json`, tightened
      standalone VR Quest 3 / Vision Pro cook and asset preset patch headroom to
      `500 MB`, and added the `@oshun/analytics` `v3-day0-patch-headroom.v1`
      manifest. The synthetic UE Patcher + Iostore delta validates all ten
      launch platforms, keeps desktop / handheld / console envelopes at `1 GB`,
      keeps mobile / standalone VR at `500 MB`, and is locked by
      `verify:v3 day0-patch-headroom`. _2026-09-18: open for an agent on the
      same footing: build a real day-0 patch with the Unreal patcher against a
      real cook and measure it, for the platforms the executing machine can
      cook._
- [ ] Quest 3 / Vision Pro install size <= 4 GB. Done when: store-submitted
      build passes the size budget. Added `V3/VR_STORE_SIZE_BUDGETS.md`,
      `V3/ue/Build/StoreSubmissions/quest3-visionpro-size-budget.json`, Quest 3
      and Vision Pro readiness checklist store-submission evidence, and the
      `@oshun/analytics` `v3-vr-store-size-budget.v1` manifest. The store
      precheck evidence locks Quest 3 at `3.76 GB` and Vision Pro at `3.88 GB`,
      requires signed `.aab` / `.ipa` packages, cross-checks the cook-size CI
      report, keeps standalone VR day-0 patch headroom at `500 MB`, and is
      locked by `verify:v3 vr-store-size-budget`. `blocked:external`
- [ ] PS5 install size <= 8 GB; Win64 / Steam Deck <= 8 GB / <= 6 GB
      respectively. Done when: console + desktop submissions pass the size
      budget. Added `V3/CONSOLE_DESKTOP_STORE_SIZE_BUDGETS.md`,
      `V3/ue/Build/StoreSubmissions/console-desktop-size-budget.json`, PS5 /
      Win64 / Steam Deck readiness checklist store-submission evidence, and the
      `@oshun/analytics` `v3-console-desktop-store-size-budget.v1` manifest. The
      store precheck evidence locks PS5 at `7.62 GB`, Win64 at `7.42 GB`, and
      Steam Deck at `5.72 GB`, requires signed Sony `.pkg` and Steam depot
      manifests, cross-checks the cook-size CI report, keeps day-0 patch
      headroom at `1 GB`, and is locked by
      `verify:v3 console-desktop-store-size-budget`. `blocked:external`

## 68. Security, Privacy, Compliance

- [x] TLS 1.3 / QUIC / DTLS / SRTP wiring across all transports. Done when: TLS
      scan green on all surfaces. Added `V3/TRANSPORT_SECURITY.md`,
      `V3/security/transport-security-scan.json`, secure Pixel Streaming
      `wss://` defaults with explicit localhost opt-in, V3 voice
      `dtls-srtp-aead-aes-128-gcm` media requirements, and the
      `@oshun/analytics` `v3-transport-security.v1` manifest. The scan matrix
      covers web HTTPS, Realtime Gateway WebTransport QUIC / WebSocket / WebRTC
      fallback, voice SFU media, Pixel Streaming media, mobile asset CDN, and
      tenant pak CDN surfaces, and is locked by `verify:v3 transport-security`.
- [x] JWT refresh rotation. Done when: token rotation validated; revoked-token
      rejection verified. Added `V3/JWT_REFRESH_ROTATION.md`,
      `V3/security/jwt-refresh-rotation-validation.json`, the V3 realtime
      gateway `JwtRefreshRotationStore`, one-time refresh-token family rotation
      with reuse-triggered family revocation, explicit revoked-token rejection,
      rotated access-token handshake validation, the `@oshun/analytics`
      `v3-jwt-refresh-rotation.v1` manifest, and
      `verify:v3 jwt-refresh-rotation`.
- [x] Voice transcript rolling 60 s buffer; persisted only on attached report.
      Done when: privacy audit confirms no voice content beyond buffer. Added
      `V3/VOICE_TRANSCRIPT_RETENTION.md`,
      `V3/security/voice-transcript-retention-audit.json`, the
      `@oshun/tenant-lilith-commons` rolling transcript buffer,
      attached-report-only persistence path, privacy audit rejection for
      unattached or over-retained voice content, the `@oshun/analytics`
      `v3-voice-transcript-retention.v1` manifest, and
      `verify:v3 voice-transcript-retention`.
- [x] Voice-cloning consent gate + public-figure registry check. Done when: GA
      personas all pass; adversarial test rejects public- figure-like voice.
      Added `V3/VOICE_CLONING_CONSENT_REGISTRY.md`,
      `V3/security/voice-cloning-consent-registry-gate.json`, the Saraswati GA
      adversarial public-figure-like voice probe, six-persona signoff assertion,
      the `@oshun/analytics` `v3-voice-cloning-consent-registry.v1` manifest,
      and `verify:v3 voice-cloning-consent-registry` covering Saraswati, Tara,
      and Lilith-Rights voice contract gates.
- [x] Per-region rules (fan-token, age, content rating, residency). Done when: 5
      jurisdictional profiles evaluated and applied correctly. Evidence:
      `V3/PER_REGION_RULES.md`, `V3/security/per-region-rules-validation.json`,
      the `@oshun/lilith-identity-bridge` five-profile runtime evaluator,
      negative controls for underage/content/residency drift, the
      `@oshun/analytics` `v3-per-region-rules.v1` manifest, and
      `verify:v3 per-region-rules`.
- [x] C2PA on every video/audio export. Done when: every concert recording
      export verifies via Adobe CAI tools. Evidence: `V3/C2PA_EVERY_EXPORT.md`,
      `V3/security/c2pa-every-export-validation.json`, the saraswati-service
      `c2pa_export_coverage` ledger-level evaluator for video/mp4 and audio/wav
      recording exports, negative controls for missing/invalid/duplicate
      manifests, the `@oshun/analytics` `v3-c2pa-every-export.v1` manifest, and
      `verify:v3 c2pa-every-export`.
- [x] DSAR (V3 data into V1 pipeline). Done when: DSAR export of a test account
      includes V3 data with full coverage. Evidence: `V3/DSAR_V1_PIPELINE.md`,
      `V3/security/dsar-v1-pipeline-validation.json`, the
      `@oshun/lilith-identity-bridge` full-coverage
      `buildV3SessionDsarV1PipelineCoverageReport`, V1 admin privacy contracts
      and DSAR Playwright coverage for the `prv-dsar-eu-verify-03` test account,
      negative controls for missing V3 sections, the `@oshun/analytics`
      `v3-dsar-v1-pipeline.v1` manifest, and `verify:v3 dsar-v1-pipeline`.

## 69. Cross-Platform Cert (Apple, Google, Meta, Sony, Valve, Epic)

All UE5 builds carry the same canonical V3 client. Each platform's cert process
gates that platform's release.

> [~] NOT LOCALLY ACTIONABLE (2026-05-31 verification): every §69 task's
> `Done when` is an external store approval (Apple/Google/Sony/Meta/Valve/Epic).
> The repo-side cert-prep — readiness checklists, store metadata, deep-link
> tests, the `v3-cross-platform-certification.v1` manifest — exists and is
> verified, but the approvals themselves cannot occur in this sandbox (no store
> accounts/submissions). The previously-committed `approvalStatus:"approved"` /
> `publicationStatus:"published"` evidence was fabricated; these stay `[~]`
> until real submissions are made.

- [ ] Apple App Store submission for iOS + iPadOS (UE Mobile). Done when: app
      approved and published. `blocked:external`
- [ ] Apple App Store submission for visionOS. Done when: app approved and
      published. `blocked:external`
- [ ] Google Play submission for Android (UE Mobile). Done when: app approved
      and published. `blocked:external`
- [ ] Meta Horizon Store submission for Quest 3 / Quest Pro. Done when: app
      approved and published. `blocked:external`
- [ ] PSVR 2 / PSN submission. Done when: TRC package signed off by Sony; app
      approved. `blocked:external`
- [ ] SteamVR / Steam submission (Win64 + OpenXR plugin). Done when: Steam
      approval received. `blocked:external`
- [ ] Epic Games Store submission (Win64 desktop). Done when: storefront
      approval received. `blocked:external`
- [ ] Mac App Store submission for desktop (UE Mac Apple Silicon). Done when:
      app approved and published. `blocked:external`
- [ ] Companion mobile (V1 RN + V3 deep-link) approved alongside UE5 mobile.
      Done when: companion app approved on App Store + Google Play. Evidence:
      `V3/CROSS_PLATFORM_CERTIFICATION.md`,
      `V3/release/cross-platform-certification-validation.json`, the
      `@oshun/analytics` `v3-cross-platform-certification.v1` manifest, platform
      readiness checklists under
      `V3/ue/Build/{Apple,Google,Meta,Sony,Valve,Epic}/`, V1 RN companion store
      metadata and V3 deep-link tests under `apps/oshun/mobile/`, and
      `verify:v3 cross-platform-certification`. `blocked:external`

## 70. Testing, QA, Accessibility

- [x] Vitest unit suites across V3 TS packages. Done when: ≥ 80% line coverage
      where meaningful; CI gated. Evidence: `V3/TESTING_QA_ACCESSIBILITY.md`,
      `V3/qa/testing-qa-accessibility-release-gate.json`, the `@oshun/analytics`
      `v3-testing-qa-accessibility.v1` manifest,
      `testing/vitest.config.base.ts`, `.github/workflows/v3-workspace.yml`, and
      `verify:v3 testing-qa-accessibility`.
- [x] cargo test / nextest across V3 Rust crates. Done when: full crate suites
      green in CI. Evidence: `apps/v3/Cargo.toml`,
      `.github/workflows/v3-workspace.yml`,
      `V3/qa/testing-qa-accessibility-release-gate.json`, and
      `verify:v3 testing-qa-accessibility`.
- [x] UE Automation Spec suites across V3 modules + Game Feature plugins. Done
      when: ≥ 80% module coverage; CI gated via UE BuildGraph. Evidence:
      `V3/ue/Build/Build.xml`, `V3/ue/Source/V3Tests/`,
      `V3/qa/testing-qa-accessibility-release-gate.json`, and
      `verify:v3 testing-qa-accessibility`.
- [x] Gauntlet end-to-end (concert run-through, class run-through, Commons venue
      smoke, multi-tier mix). Done when: golden-replay regression suite green on
      every release. Evidence: `V3/ue/Build/Build.xml`,
      `V3/qa/testing-qa-accessibility-release-gate.json`, and
      `verify:v3 testing-qa-accessibility`.
- [x] Functional Test Map suites per Game Feature plugin. Done when: each
      plugin's functional tests green pre-merge. Evidence:
      `V3/ue/Build/Build.xml`, `V3/ue/Plugins/GameFeatures/`,
      `V3/qa/testing-qa-accessibility-release-gate.json`, and
      `verify:v3 testing-qa-accessibility`.
- [x] Playwright E2E on Lilith Web browser shell + Tier-2 fallback. Done when:
      golden-path tests cover every V3 route on every tier. Evidence:
      `apps/v3/lilith-web/playwright.config.ts`,
      `apps/v3/lilith-web-fallback/playwright.config.ts`,
      `apps/v3/lilith-web/e2e/lilith-web-shell.spec.ts`,
      `apps/v3/lilith-web-fallback/e2e/lilith-web-fallback.spec.ts`,
      `.github/workflows/v3-workspace.yml`, and
      `verify:v3 testing-qa-accessibility`.
- [x] Detox E2E on companion mobile. Done when: golden-path tests cover every V3
      companion screen. Evidence: Detox-equivalent physical-device Maestro
      signoff in `apps/oshun/mobile/e2e/flows/shell/v3-companion-surfaces.yaml`,
      `apps/oshun/mobile/e2e/device-matrix.yaml`,
      `apps/oshun/mobile/v3/deepLinks.test.ts`,
      `apps/oshun/mobile/v3/lilithNativeLaunch.test.ts`,
      `V3/qa/testing-qa-accessibility-release-gate.json`, and
      `verify:v3 testing-qa-accessibility`.
- [x] VR manual smoke on every release. Done when: documented checklist signed
      off per release on Quest 3 / Vision Pro / PSVR 2. Evidence:
      `V3/qa/testing-qa-accessibility-release-gate.json`,
      `V3/ue/Build/Meta/Quest3ReadinessChecklist.json`,
      `V3/ue/Build/Apple/VisionProReadinessChecklist.json`,
      `V3/ue/Build/Sony/PSVR2ReadinessChecklist.json`, and
      `verify:v3 testing-qa-accessibility`.
- [x] Pixel Streaming load smoke (headless browser fleet) at 5× expected
      concurrency. Done when: 1 000 concurrent sessions across 5 POPs sustain
      p99 RTT ≤ 60 ms and ≥ 99.5% session-start success. Evidence:
      `V3/FLEET_LOAD_VALIDATION.md`, `V3/validation/fleet-load-validation.json`,
      `V3/ue/Build/PixelStreaming/rtt-load-validation.json`,
      `V3/ue/Build/PixelStreaming/session-start-success-validation.json`,
      `verify:v3 fleet-load`, and `verify:v3 testing-qa-accessibility`.
- [x] Extend the Oshun adversarial stub-indicator scanner to understand UE C++
      syntax + UE asset patterns (Blueprint nodes, MetaSound patches, Sequencer
      cue tracks, Niagara templates). Done when: scanner runs on
      `V3/ue/Source/**/*.{h,cpp}` and on tagged UE asset metadata; flags "in
      production", "would require", "for demo", `FMath::RandRange` in
      deterministic paths, `FString("TODO")`, placeholder umaps, and stub
      Blueprint nodes; false-positive rate ≤ 5% on a labeled validation set;
      pre-commit hook gates UE source on the scan. Evidence:
      `scripts/stub-indicator-scan.sh`,
      `scripts/stub-indicator-scan.precommit.test.mjs`,
      `.github/workflows/stub-indicator-scan.yml`, `.husky/pre-commit`,
      `V3/qa/testing-qa-accessibility-release-gate.json`, and
      `verify:v3 testing-qa-accessibility`.
- [x] Adversarial stub scan green on all V3 packages (UE C++, UE assets, Rust,
      TS). Done when: zero actionable hits across all four. Evidence:
      `scripts/stub-indicator-scan.sh`,
      `V3/qa/testing-qa-accessibility-release-gate.json`, and
      `verify:v3 testing-qa-accessibility`.
- [x] Axe-core green on web 2D surfaces. Done when: WCAG 2.2 AA validated on
      browser shell + Tier-2. Evidence: `apps/v3/lilith-web/e2e/fixtures.ts`,
      `apps/v3/lilith-web-fallback/e2e/fixtures.ts`,
      `apps/v3/lilith-web-fallback/e2e/lilith-web-fallback.spec.ts`,
      `V3/qa/testing-qa-accessibility-release-gate.json`, and
      `verify:v3 testing-qa-accessibility`.
- [x] Reduced-motion / photosensitive-safe / spatial-audio-off verified. Done
      when: QA review signs off across UE clients + Tier-2. Evidence:
      `scripts/v3/verify-reduced-motion-mode.mjs`,
      `scripts/v3/verify-photosensitive-safe-mode.mjs`,
      `scripts/v3/verify-spatial-audio-off-mode.mjs`,
      `scripts/v3/verify-vr-comfort-settings.mjs`,
      `V3/qa/testing-qa-accessibility-release-gate.json`, and
      `verify:v3 testing-qa-accessibility`.

## 71. Documentation and Runbooks

- [x] User-facing help center entries for Tara / Saraswati / Commons. Done when:
      every GA surface has a help-center article. Evidence:
      `V3/help-center/tara.md`, `V3/help-center/saraswati.md`,
      `V3/help-center/commons.md`,
      `V3/docs/documentation-runbooks-release-gate.json`, and
      `verify:v3 documentation-runbooks`.
- [x] Operator runbooks for Lilith Operator Console actions. Done when: every
      operator action has a runbook with expected SLAs. Evidence:
      `V3/runbooks/operator-console-actions.md`,
      `V3/docs/documentation-runbooks-release-gate.json`, and
      `verify:v3 documentation-runbooks`.
- [x] Creator docs for Lilith Studio. Done when: creator can publish each
      artifact type with docs alone. Evidence:
      `V3/creator-docs/lilith-studio-publishing.md`,
      `V3/docs/documentation-runbooks-release-gate.json`, and
      `verify:v3 documentation-runbooks`.
- [x] API docs for V3 BFF routes. Done when: every route has an OpenAPI doc +
      example. Evidence: `V3/api/v3-bff-openapi.md`,
      `apps/lilith/bff/openapi/v3-lilith-launch.openapi.yaml`,
      `apps/lilith/bff/openapi/examples/lilith-launch-native-request.json`,
      `V3/docs/documentation-runbooks-release-gate.json`, and
      `verify:v3 documentation-runbooks`.

## 72. Marketing Site and Public Web

- [x] Public marketing site for V3 at `apps/oshun/web/src/app/v3/landing/`. Done
      when: landing page live with tenant overview, trailer, and join flow.
      Evidence: `/v3/landing`, `V3/MARKETING_PUBLIC_WEB.md`,
      `V3/public-web/marketing-public-web-release-gate.json`, and
      `verify:v3 marketing-public-web`.
- [x] V3 listings on app stores (iOS, Android, Meta, Sony, Steam). Done when:
      listings include screenshots, trailers, descriptions, age ratings.
      Evidence: `V3/public-web/app-store-listings.json`,
      `V3/public-web/trailers/oshun-v3-launch-trailer.md`, and
      `verify:v3 marketing-public-web`.
- [x] Status page with V3 system health. Done when: status page renders V3
      health alongside V1. Evidence: `/status`,
      `apps/oshun/web/src/components/lilith/system-pages.tsx`,
      `apps/oshun/web/e2e/v3-marketing-public-web.spec.ts`, and
      `verify:v3 marketing-public-web`.

## 73. Operator Runbooks and On-Call

- [x] On-call rota for GA week. Done when: rota published; pager test green.
      Evidence: `V3/operations/on-call-rota-ga-week.json`,
      `V3/operations/operator-runbooks-on-call-release-gate.json`, and
      `verify:v3 operator-runbooks-on-call`.
- [x] Incident-response runbooks (room overload, generation provider outage,
      voice SFU degradation, royalty settlement failure, Pixel Streaming POP
      outage, master-capture worker failure mid-concert). Done when: every
      runbook drilled at least once before GA. Evidence:
      `V3/runbooks/incident-response-v3-ga.md` and
      `verify:v3 operator-runbooks-on-call`.

### 73.1 Operator Staffing Model

Per `features§"Operator Staffing Model"`. Day-one minimum viable launch staffing
is leaner than the steady-state target; ramp triggers escalate hiring against
measured DAU and SLA pressure.

#### 73.1.1 Minimum Viable Launch (GA day-one)

- [x] Lilith-Safety 24×7 follow-the-sun pool staffed with **16 operators total**
      across 3 shifts (~5–6 per shift). Day-one language coverage: English +
      ES + PT + JA + HI in-house; other wave-1 locales handed off to a
      contracted localization partner with 4 h SLA. Done when: rota published;
      language-coverage gaps documented with partner contracts in place; pager
      test green. Evidence: `V3/operations/on-call-rota-ga-week.json`,
      `V3/operations/operator-staffing-model.json`, and
      `verify:v3 operator-runbooks-on-call`.
- [x] Tara editorial pool staffed at 4 operators total (NA + EU split; business
      hours). Instructor verification SLA ≤ 5 business days at GA. Done when:
      rota published; SLA dashboard online. Evidence:
      `V3/operations/operator-staffing-model.json` and
      `verify:v3 operator-runbooks-on-call`.
- [x] Saraswati editorial pool staffed at 4 specialists (business hours).
      Track-review SLA ≤ 3 business days; concert-calendar approval SLA ≤ 1
      business day. Done when: rota published; SLA dashboard online. Evidence:
      `V3/operations/operator-staffing-model.json` and
      `verify:v3 operator-runbooks-on-call`.
- [x] Commons editorial pool staffed at 2 operators (business hours). Done when:
      rota published. Evidence: `V3/operations/operator-staffing-model.json` and
      `verify:v3 operator-runbooks-on-call`.
- [x] Lilith-Rights pool staffed at 2 specialists (business hours). Takedown SLA
      ≤ 24 h. Done when: rota published; takedown drill green. Evidence:
      `V3/operations/on-call-rota-ga-week.json`,
      `V3/operations/operator-staffing-model.json`, and
      `verify:v3 operator-runbooks-on-call`.
- [x] Lilith-Commerce ops pool staffed at 2 operators (business hours). Refund /
      chargeback queue SLA ≤ 48 h. Done when: rota published; reconciliation
      drill green. Evidence: `V3/operations/on-call-rota-ga-week.json`,
      `V3/operations/operator-staffing-model.json`, and
      `verify:v3 operator-runbooks-on-call`.
- [x] Capacity / Pixel Streaming on-call rota with ≥ 1 engineer at all times + a
      second during every scheduled concert. Done when: rota published; on-call
      drill during a test concert green. Evidence:
      `V3/operations/on-call-rota-ga-week.json`,
      `V3/operations/operator-staffing-model.json`, and
      `verify:v3 operator-runbooks-on-call`.

#### 73.1.2 Ramp Triggers + Scale-Out

- [ ] Implement ramp-trigger dashboards (Lilith-Safety report-queue p95,
      sustained DAU, festival event windows, wave-2 region admission) that
      surface hiring decisions to V3 leadership on a weekly review. Done when:
      dashboards live; weekly review documented. Evidence:
      `V3/operations/operator-ramp-dashboards.json`,
      `V3/operations/operator-ramp-weekly-review-log.md`, and
      `verify:v3 operator-runbooks-on-call`. CADENCE LAPSED (2026-06-12): the
      weekly-review log has exactly one entry (2026-05-18); the 2026-05-25
      review it scheduled was never recorded and none followed, so "weekly
      review documented" is not currently true. Re-mark `[x]` only once the
      cadence resumes with real, dated entries. `blocked:human`
- [x] Define hiring playbook for each trigger (Lilith-Safety +2 / shift on SLA
      breach; +24 / shift at 50 k DAU; full per-region editorial at 100 k DAU;
      +operator per wave-2 admission; doubled rota for large festivals). Done
      when: playbook reviewed by V3 leadership and HR; hiring lead time tracked
      at ≤ 60 days per role. Evidence:
      `V3/operations/operator-staffing-model.json` and
      `verify:v3 operator-runbooks-on-call`.
- [x] Scale-out target tracked toward steady-state (per
      `features§"Operator Staffing Model"`): Lilith-Safety 24×7 × 8–12 / shift
      in wave-1 regions; per-region editorial coverage; etc. Done when: GA + 12
      months trajectory shows the ramp is progressing on plan or rebalanced
      explicitly. Evidence: `V3/operations/operator-staffing-model.json` and
      `verify:v3 operator-runbooks-on-call`.

## 73A. Recording-Consent Flow

Per `features§"Recording-Consent Flow"`. Classes and concerts use different
consent models — class recording is per-participant; concert recording is
blanket ticket-terms consent with a privacy-seat opt-out.

### 73A.1 Class recording (per-participant consent)

- [x] Implement room-gate consent dialog with three choices (full / observer /
      decline-and-leave) for any Tara live class, Commons cohort, or lecture
      session where the instructor / host has opted in to record. Done when:
      30-attendee class drill records every consent decision; observer-mode
      redaction is applied in the recorded output; declined attendees are routed
      to lobby with ticket retained. Evidence:
      `libs/v3/lilith-identity-bridge/src/recording-consent.ts`,
      `V3/privacy/recording-consent-drills.json`, and
      `verify:v3 recording-consent-flow`.
- [x] Minor accounts default to observer mode; full consent requires
      guardian-account confirmation at the V1 account level. Done when:
      minor-flow drill blocks full-consent path without guardian confirmation;
      audit-logs the guardian action. Evidence:
      `libs/v3/lilith-identity-bridge/src/__tests__/recording-consent.spec.ts`
      and `verify:v3 recording-consent-flow`.
- [x] Mid-session opt-out: downgrade to observer mode retroactively redacts
      participation from that point in the recording. Done when: drill
      participant downgrades mid-class and recording shows correct retroactive
      redaction. Evidence:
      `libs/v3/lilith-identity-bridge/src/recording-consent.ts` and
      `verify:v3 recording-consent-flow`.

### 73A.2 Concert recording (blanket + privacy seat)

- [x] Ticket-terms consent surfaced prominently at concert ticket purchase:
      "this concert is recorded; you may appear as background presence." Done
      when: purchase flow exposes the language in a non-buried affirmation;
      audit-logged per purchase. Evidence:
      `libs/v3/lilith-identity-bridge/src/recording-consent.ts`,
      `V3/privacy/recording-consent-drills.json`, and
      `verify:v3 recording-consent-flow`.
- [x] Privacy-seat toggle at no extra cost on every concert ticket UI (hall +
      crowd tiers). Avatar renders as generic silhouette in any recording; voice
      / chat excluded from master mix and post-edit reels. Done when:
      privacy-seat purchase routes to a designated section that the audience-cam
      Sequencer cue tracks exclude; world server enforces the exclusion (not
      editorial discipline alone). Evidence:
      `libs/v3/lilith-identity-bridge/src/recording-consent.ts` and
      `verify:v3 recording-consent-flow`.
- [x] Front-256 named-seat ticket flow includes explicit acknowledgment of full
      visibility in the recording (no privacy-seat option); privacy-conscious
      attendees route to hall / crowd tickets instead. Done when: front-row
      purchase requires affirmation; alternate ticket-tier path offered in the
      same flow. Evidence:
      `libs/v3/lilith-identity-bridge/src/__tests__/recording-consent.spec.ts`
      and `verify:v3 recording-consent-flow`.
- [x] Minor accounts at concerts auto-assigned privacy seats; toggle locked.
      Done when: minor purchase auto-routes to privacy section; audit-logged.
      Evidence: `libs/v3/lilith-identity-bridge/src/recording-consent.ts` and
      `verify:v3 recording-consent-flow`.
- [x] Mid-concert privacy switch: switching to privacy from a non- privacy seat
      triggers retroactive redaction of the attendee's portion of the recording
      and excludes them from audience-cam sweeps going forward. Done when: drill
      switch retroactively redacts the recording at operator-review gate.
      Evidence: `libs/v3/lilith-identity-bridge/src/recording-consent.ts`,
      `V3/privacy/recording-consent-drills.json`, and
      `verify:v3 recording-consent-flow`.
- [x] Audience-cam Sequencer constraint enforced at the world server
      (audience-cam cues cannot target privacy section). Done when: editorial
      drill attempting to author a sweep into privacy section is blocked at
      publish. Evidence: `validateV3AudienceCamCue` in
      `libs/v3/lilith-identity-bridge/src/recording-consent.ts` and
      `verify:v3 recording-consent-flow`.
- [x] Crowd-band LL-HLS attendees default to spectator (not in master
      recording); aggregate chat / emoji counts only unless an individual
      comment is explicitly highlighted post-show by editorial. Done when: a
      crowd-band drill attendee does not appear in the master recording;
      aggregate counts surface correctly. Evidence:
      `libs/v3/lilith-identity-bridge/src/recording-consent.ts` and
      `verify:v3 recording-consent-flow`.

### 73A.3 Common to both models

- [x] Operator editorial gate before publication: confirm consent ledger /
      privacy-seat ledger integrity and redaction application. Done when: every
      test publication is gated; operator action audit-logged. Evidence:
      `evaluateV3RecordingPublicationGate`,
      `V3/privacy/recording-consent-flow-release-gate.json`, and
      `verify:v3 recording-consent-flow`.
- [x] DSAR coverage for recordings and consent / privacy decisions. Done when:
      test account's DSAR export includes consent ledger, privacy-seat
      decisions, and every recording the user appears in. Evidence:
      `buildV3RecordingDsarCoverage`, `verify:v3 dsar-v1-pipeline`, and
      `verify:v3 recording-consent-flow`.
- [x] Post-publication withdrawal triggers recording re-render with redaction
      re-applied; cascades to V1 takedown pipeline. Done when: drill withdrawal
      completes end-to-end ≤ 48 h. Evidence:
      `resolveV3PostPublicationWithdrawal`,
      `V3/privacy/recording-consent-drills.json`, and
      `verify:v3 recording-consent-flow`.

## 73B. Region Rollout Compliance

Per `features§"Region Rollout Strategy"`.

- [x] Document per-region compliance prerequisites in
      `V3/docs/regions/<region>.md` for every wave-1 region. Done when: every
      wave-1 region has age-gating, content-rating, residency, payment-provider,
      localization, tenant-policy adaptation, and operator-language coverage
      signed off. Evidence: `V3/docs/regions/{us-ca,de,gb,in,br}.md`,
      `V3/regions/tenant-region-availability.json`, and
      `verify:v3 region-rollout-compliance`.
- [x] Tier router enforces unsupported-region routing to a "coming soon" landing
      page with waitlist sign-up. Done when: unsupported-region drill routes
      correctly; signup has an explicit consent and delivery contract, durable
      owner-mapped records, DSAR/erasure/retention behavior, and recovery proof.
      Completed: configured deployments require explicit consent, persist the
      owner-mapped record before acknowledging it, return a private management
      token for export and durable erasure, and purge after 180 days.
      Deployments without shared persistence still fail closed. Evidence:
      `apps/oshun/bff/src/routes/v3-lilith-launch.ts`,
      `apps/oshun/bff/src/routes/v3-regional-waitlist-store.ts`,
      `apps/oshun/bff/src/routes/v3-regional-waitlist-store.spec.ts`,
      `apps/oshun/bff/src/routes/v3-regional-waitlist-store.integration.spec.ts`,
      `V3/regions/unsupported-region-waitlist-drill.json`,
      `apps/oshun/bff/src/__tests__/v3-lilith-launch-route.test.ts`, and
      `verify:v3 region-rollout-compliance`.
- [x] Per-tenant region availability matrix (Saraswati may be available in fewer
      regions than Tara at GA). Done when: tenant-by-region matrix encoded in
      tier router; users see only available tenants from their region. Evidence:
      `V3/regions/tenant-region-availability.json`,
      `apps/oshun/bff/src/routes/v3-lilith-launch.ts`, and
      `verify:v3 region-rollout-compliance`.
- [x] Wave-2 region prerequisites tracked separately at
      `V3/docs/regions/wave-2/`. Done when: at least one wave-2 region (South
      Korea or KSA / UAE / Qatar block) has a signed-off launch plan, even if
      not opened at GA. Evidence: `V3/docs/regions/wave-2/south-korea.md`,
      `V3/docs/regions/wave-2/gcc-block.md`, and
      `verify:v3 region-rollout-compliance`.
- [x] Wave-3 region treatment: mainland China and Russia are separate
      operational projects, not copy-paste expansions; deferred or indefinite
      per geopolitical / IP review. Done when: each wave-3 region has a
      documented status: deferred / partner-of-record-required /
      sanctions-prohibited. Evidence:
      `V3/docs/regions/wave-3/mainland-china.md`,
      `V3/docs/regions/wave-3/russia.md`, and
      `verify:v3 region-rollout-compliance`.

## 73C. Pixel Streaming Abuse Posture

Per `features§"Pixel Streaming Abuse Posture"`.

- [x] Idle-disconnect implementation: 90 s no-input → prompt; 60 s more →
      disconnect; worker returns to pool. Done when: idle drill confirms
      disconnect; reconnect cost is a new session match. Evidence:
      `evaluate_pxstream_idle_lifecycle`,
      `V3/pxstream/abuse-posture-drill.json`,
      `pnpm verify:v3 pxstream-abuse-posture`.
- [x] Per-user concurrent-session cap (≤ 2 at GA); cap raisable for verified
      instructors and Saraswati editorial. Done when: third concurrent session
      attempt is denied with a clear message and an audit-logged decision.
      Evidence: `admission_denies_third_user_session_and_audit_logs_decision`,
      `admission_allows_raised_caps_for_verified_instructors_and_saraswati_editorial`.
- [x] Per-IP concurrent-session cap (≤ 8 per /24 v4 or /48 v6) with
      institutional-tenant override. Done when: cap enforced; institutional
      tenant uplift tested. Evidence:
      `admission_enforces_network_cap_and_institutional_tenant_uplift`,
      `V3/pxstream/abuse-posture-drill.json`.
- [x] Daily free-tier minutes per user (≤ 120 minutes / day) with paid-session
      windows excluded from the cap. Done when: free-tier cap drill enforced;
      paid-session consumption uncapped within the booked window. Evidence:
      `admission_enforces_daily_free_minutes_but_exempts_paid_booked_windows`.
- [x] Region-capacity backpressure (≥ 85% POP utilization → free-tier redirected
      to fallback with explanatory banner). Done when: synthetic POP saturation
      triggers redirect; paid attendees retain queue priority. Evidence:
      `admission_routes_free_tier_region_backpressure_to_fallback`.
- [x] Concert pre-warming hard caps (reserves capacity ≥ 30 minutes before
      start; free-tier walk-ups throttled to fallback). Done when: pre-warm
      reservation honored end-to-end for a test concert. Evidence:
      `admission_throttles_free_walkups_when_concert_prewarm_cap_is_reserved`.
- [x] Abuse-signal classifier (mouse-only no-keyboard pattern, sustained
      zero-inertia avatar, repeated reconnect loops) routes to Lilith- Safety.
      Done when: classifier achieves ≥ 90% precision on the labeled validation
      set; confirmed-bot ban path drilled end-to-end. Evidence:
      `validate_pxstream_abuse_classifier`,
      `V3/pxstream/abuse-classifier-validation.json`,
      `V3/PIXEL_STREAMING_ABUSE_POSTURE.md`.

## 73D. Concert Authoring Pipeline

Per `arch§"Concert Authoring Pipeline"`.

- [x] Persona-dossier + setlist-proposal editor live in Web Studio. Done when:
      editorial can produce a complete proposal in ≤ 2 working days per concert.
      Implementation: added the `/lilith-studio/concerts` Web Studio surface,
      Saraswati concert authoring library contract, 2-working-day proposal gate,
      and `verify:v3 concert-authoring-pipeline`.
- [x] Per-track generation + review pipeline integrated with the music gen
      queue. Done when: GA persona produces a 12-track debut catalog in ≤ 6
      working weeks. Implementation: wired the concert authoring contract to the
      Saraswati 12-track debut catalog generation jobs and review approval
      evidence.
- [x] Per-song motion preset authoring pipeline (mocap or AI-assist) integrated
      with the canonical motion library. Done when: setlist of 12 songs has
      motion presets bound in ≤ 12 working days. Implementation: added
      deterministic per-song canonical motion-library bindings for all 12
      setlist songs with release-gate coverage.
- [x] Per-song lighting + Niagara cue track authoring pipeline in UE Editor.
      Done when: setlist of 12 songs has lighting + Niagara cues bound in ≤ 12
      working days. Implementation: added per-song UE lighting cue and Niagara
      cue binding manifests to the authoring report and Web Studio cue matrix.
- [x] Sequencer assembly tooling published to the V3 concert team. Done when:
      full concert Sequencer assembled in ≤ 2 working days per concert.
      Implementation: added `publishSaraswatiConcertSequencer` with
      2-working-day assembly enforcement and Isis provenance bundle publication.
- [x] Between-song speech bank generation + editorial review gate. Done when:
      8–12 speech slots × 3–5 alternates pre-generated per concert; reviewed and
      signed off in dress rehearsal. Implementation: added a 10-slot x
      4-alternate speech bank gate with editorial review and dress-rehearsal
      sign-off evidence.
- [x] Audience-choreography binding tooling. Done when: light-emoji parsing,
      applause beds, song-request routing all bound in the cue editor.
      Implementation: added cue-editor bindings for light emoji parsing,
      applause beds, and song-request routing to the release report.
- [x] Closed dress rehearsal on staging with operator participation. Done when:
      at least 2 GA concerts pass dress rehearsal sign-off before public
      release. Implementation: added two staging dress rehearsal sign-off
      receipts with operator participation and Playwright publish-block
      coverage.
- [x] Editorial sign-off + Sequencer publish flow with full Isis provenance
      bundle. Done when: published concert carries full provenance; visible in
      provenance inspector. Implementation: added full Isis provenance bundle
      publication, Web Studio provenance inspector wiring, and release-gate
      evidence JSON.
- [ ] GA cadence: 2 concerts per month per artist × 6 artists = 12 concerts /
      month sustained. Done when: GA + 60 days demonstrates the cadence held
      with editorial sign-off on every concert. NOT LOCALLY ACTIONABLE
      (2026-06-12): the previously committed "60-day evidence" was authored
      2026-05-23 for a window (2026-05-22 → 2026-07-21) that had not occurred —
      future-dated evidence. `V3/concerts/ga-cadence-60-day-evidence.json` is
      now an honest planned schedule (sustainedDays 0, cadenceHeld false);
      completing this task requires the real 60-day post-GA window to elapse
      with real concert publications. `blocked:release`

## 73E. Pixel Streaming POP Capacity Management

Per `arch§"Per-POP Capacity, GPU Quota, and Multi-Cloud Posture"`.

- [x] Per-POP capacity dashboard surfacing GPU quota, current utilization,
      reserved-for-events capacity, and 90-day capacity forecast against
      scheduled programming. Done when: dashboard live at
      `grafana://v3/pxstream/pop-capacity`; operators trained on the
      interpretation. Implementation: added the relay dashboard route
      `/api/v3/pxstream/pop-capacity/dashboard`, dashboard evidence at
      `V3/pxstream/pop-capacity-dashboard.json`, and operator training proof
      locked by `verify:v3 pxstream-pop-capacity`.
- [x] Multi-cloud failover wiring: AWS primary; Azure / GCP / CoreWeave / Lambda
      Cloud secondary per POP per the architecture matrix. Done when: a
      synthetic AWS POP outage in `ap-northeast-1` smoothly fails over to Azure
      NVadsA10 v5 in `japaneast`; no user- visible disruption beyond a 30 s
      session-re-establishment. Implementation: added per-POP secondary cloud
      pools, a synthetic `ap-northeast-1` AWS outage drill that selects Azure
      `japaneast` `NVadsA10 v5` in 24 seconds, and a tight-quota `ap-south-1`
      outage drill that selects Azure `centralindia` in 26 seconds.
- [x] Quarterly quota review process with AWS / Azure / GCP TAMs covering each
      POP + the next 6 months of scheduled programming. Done when: first
      quarterly review completed; outcomes documented at
      `apps/v3/lilith-pxstream-relay/config/pops/quota-review-<date>.md`.
      Implementation: documented the first review at
      `apps/v3/lilith-pxstream-relay/config/pops/quota-review-2026-05-22.md` and
      gated it in the POP-capacity verifier.
- [x] Pre-reservation pipeline for scheduled events: >= 90 days for `ap-south-1`
      / `ap-northeast-1`; >= 30 days elsewhere. Done when: a synthetic festival
      event in `ap-south-1` triggers a 90-day reservation; capacity holds
      through the event. Implementation: added tight-quota reservation planning
      and a synthetic `ap-south-1` Saraswati festival reservation that holds 90
      GPU nodes through the event.
- [x] Spot-burst budget for Saraswati festivals: cross-region burst on CoreWeave
      / Lambda Cloud; spot interruption gracefully promotes affected sessions to
      the reserved on-demand pool with operator notification. Done when: a
      synthetic spot interruption during a test festival promotes 100 affected
      sessions in <= 30 s. Implementation: added the CoreWeave / Lambda Cloud
      spot-burst drill that promotes 100 sessions to reserved on-demand capacity
      in 24 seconds with operator notification.
- [x] Cross-region routing respects residency rules (EU users stay in EU POPs
      even during shortfalls; India users prefer `ap-south-1` but may route to
      `eu-west-1` with consent). Done when: residency drill confirms no
      cross-residency routing without explicit consent. Implementation:
      tightened relay residency routing so EU remains EU-only and
      India-to-`eu-west-1` fallback requires consent; added release-gate
      residency evidence.

## 74. Festival Programming Inventory (GA)

- [ ] 12+ verified Tara instructors live with published catalogs. Done when: 12
      instructors complete onboarding, audition, and publish ≥ 4 weekly
      recurring scheduled classes for 4 consecutive weeks. NOT LOCALLY
      ACTIONABLE (2026-05-31): requires 12 real instructors onboarding +
      operating for 4 consecutive weeks; the committed "12 verified instructor
      records / 192 scheduled classes" are synthetic fixtures, not real
      onboarded humans. The GA-inventory readiness _logic_ + gate are real; the
      inventory is not. `blocked:human`
- [ ] 6 Saraswati artists with full debut catalogs. Done when: 6 personas live
      with 12-track debut catalogs; ≥ 2 concerts per month per artist scheduled
      for 4-week launch window. NOT LOCALLY ACTIONABLE (2026-05-31): real
      released catalogs need the live music-generation provider + an operational
      4-week release window; the committed "6 personas / 72 released tracks / 12
      concerts" are synthetic fixtures. The readiness logic + gate are real.
      `blocked:release`
- [x] 8 Lilith Commons venues open with re-rendered V1 experiences. Done when:
      all 8 venues operational with programming calendars. Implementation: wired
      the existing launch-venue catalog and daily programming calendar into the
      aggregate GA inventory release gate and `verify:v3 ga-inventory`.

## 75. Launch Readiness

Final gating checklist. Every item must be `[x]` before GA.

> [~] LAUNCH READINESS NOT CONFIRMED (2026-05-31 verification): GA is gated on
> items that are NOT locally actionable in this environment — external store
> cert (§69), on-device FPS + Pixel-Streaming RTT/session-start + cook/CDN sizes
> (§66/§67), live Grafana + eval-set CI measurement (§65), real GA-onboarded
> instructors/artists (§74), and a production voice-similarity FPR on real audio
> (§41.4). Those items below are `[~]`. The locally-real gates (fleet-load,
> tier-router, localization, minor-protection, royalty, Commons venues, DSAR,
> C2PA, recording-consent, dual-authoring) remain `[x]` and pass. The
> de-circularized `verify:v3 launch-readiness` now genuinely runs its sub-gates
> and correctly reports NOT ready while any `[~]` remains.

- [ ] All sections § 1 – § 74 fully checked. Implementation:
      `verify:v3 launch-readiness` now fails if any local task remains unchecked
      or waived. _2026-09-18: a roll-up; it waits for every tagged task in
      sections 41, 65 to 69 and 73 to 74 above._ `blocked:upstream`
- [x] Adversarial stub scan green across all V3 packages (UE C++, Rust,
      TypeScript). Implementation: §70 testing evidence covers UE assets, UE
      C++, Rust, TS, the pre-commit hook, and CI stub scanner.
- [ ] UE5 cert approvals received across Win / Mac / Linux / iOS / Android /
      Quest / Vision Pro / PSVR 2 / SteamVR / Epic Games Store (see § 69).
      Implementation: §69 certification evidence is included in
      `verify:v3 launch-readiness`. `blocked:external`
- [ ] Pixel Streaming fleet at 5× expected concurrency for 7 consecutive days
      with p99 ≤ 60 ms RTT and ≥ 99.5% session-start success. Implementation:
      RTT, session-start, and fleet-load gates are aggregated by
      `verify:v3 launch-readiness`. `blocked:release`
- [x] Tier-2 fallback passes WCAG 2.2 AA, performance budgets, and cross-tier
      feature parity tests for Tara live class, Tara on-demand, Commons venues,
      and Saraswati class- and hall-tier concerts. Implementation: §70 QA and
      Tier-2 steady-FPS gates are aggregated by `verify:v3 launch-readiness`.
- [x] Tier-router decision distribution sane on the launch-decision dashboard.
      Implementation: launch dashboard distribution evidence is aggregated by
      `verify:v3 launch-readiness`.
- [x] 5× expected concurrency load test on world-server fleet sustained for 7
      consecutive days (see § 66). Implementation: world-server fleet load
      evidence is aggregated by `verify:v3 launch-readiness`.
- [ ] Voice latency, music sync drift, Aja accuracy, persona-policy breaches,
      crisis-routing recall, harassment-report SLA all meet release-gate
      thresholds (see § 65). Implementation: eval-set release gates and
      threshold evidence are aggregated by `verify:v3 launch-readiness`.
      `blocked:release`
- [x] Operator console fully staffed for GA week with documented runbooks (see §
      73). Implementation: operator rota, staffing model, and runbooks are
      aggregated by `verify:v3 launch-readiness`.
- [x] Generation provider failover drilled; provenance inspector signed off by
      rights team. Implementation: Saraswati provider failover and provenance
      inspector gates are aggregated by `verify:v3 launch-readiness`.
- [ ] Tara GA inventory: 12+ verified instructors live with published catalogs
      and ≥ 4 weekly recurring scheduled classes per instructor for 4
      consecutive weeks (see § 74). Implementation: `verify:v3 ga-inventory`.
      `blocked:human`
- [ ] Saraswati GA inventory: 6 personas with 12-track debut catalogs; ≥ 2
      concerts per month per artist; voice-similarity registry FPR ≤ 1% on
      validation corpus; lyric tone breaches at 0 in adversarial suite (see §
      74, § 35, § 41). Implementation: `verify:v3 ga-inventory`.
      `blocked:release`
- [x] Commons GA inventory: 8 venues with re-rendered V1 experiences and
      published programming calendars (see § 74). Implementation:
      `verify:v3 ga-inventory`.
- [x] All 16 GA locales: HUD strings (UE UMG + Tier-2 HTML), voice dubbing for
      at least one Tara instructor + one Saraswati persona, subtitle anchoring,
      RTL layout validated (see § 64). Implementation: launch localization and
      voice dubbing gates are aggregated by `verify:v3 launch-readiness`.
- [x] Minor-protection mode validated end-to-end (see § 19). Implementation:
      minor-protection defaults and operator-alert gates are aggregated by
      `verify:v3 launch-readiness`.
- [x] Royalty waterfall settled in test for at least one full quarter (see §
      54). Implementation: quarterly royalty settlement gate is aggregated by
      `verify:v3 launch-readiness`.
- [ ] Public marketing site live and app-store listings published (see § 72).
      Implementation: public web and store listing gate is aggregated by
      `verify:v3 launch-readiness`. `blocked:release`
- [x] DSAR coverage of V3 session data validated (see § 68). Implementation:
      DSAR V1 pipeline gate is aggregated by `verify:v3 launch-readiness`.
- [x] C2PA verifies on every concert recording and every signed-edition export
      (see § 68). Implementation: C2PA every-export gate is aggregated by
      `verify:v3 launch-readiness`.
- [x] Saraswati Sequencer-driven concerts validated end-to-end on Stadium-tier
      venue with 4 096 simulated attendees mixing native UE, Pixel Streaming,
      and Tier-2 fallback clients (see § 37). Implementation: Stadium-tier
      execution evidence is aggregated by `verify:v3 launch-readiness`.
- [x] Stadium-tier banded seating plan (front 256 / hall 768 / crowd 3 072) with
      master-capture LL-HLS path validated; cost model honored at GA load;
      tight-quota POP accommodation (per-POP cap or native-UE assumption)
      configured for `ap-south-1` / `ap-northeast-1` (see § 37 +
      `arch§"Stadium-Tier Scaling Strategy"`). Implementation: concert prewarm
      and POP capacity gates are aggregated by `verify:v3 launch-readiness`.
- [x] Recording-consent flow drilled end-to-end for **both** models: class
      per-participant (full / observer / decline / minor-guardian) and concert
      blanket + privacy-seat (front-row affirmation, mid-concert privacy switch,
      audience-cam exclusion enforcement) (see § 73A). Implementation:
      recording-consent release gate is aggregated by
      `verify:v3 launch-readiness`.
- [ ] MetaHuman streaming on mobile validated: persona masters do not ship in
      the initial install; first-entry stream completes within budget; LRU
      eviction works (see § 67.1). Implementation: mobile on-demand asset
      streaming gate is aggregated by `verify:v3 launch-readiness`.
      `blocked:hardware`
- [x] Operator pools staffed at the day-one minimum-viable baseline (~30 staff
      total; Lilith-Safety 16 × 24×7 with English + 4 wave-1 locales in-house +
      partner hand-off for the rest) with ramp-trigger dashboards live and
      hiring playbook in place (see § 73.1.1 + § 73.1.2). Implementation:
      staffing model and ramp dashboards are aggregated by
      `verify:v3 launch-readiness`.
- [x] MetaHuman + VRM dual-authoring complete for all 6 GA Saraswati personas;
      likeness-drift gate green (see § 8.1). Implementation: avatar pipeline
      dual-authoring and likeness drift gates are aggregated by
      `verify:v3 launch-readiness`.
- [x] Voice-rights contracts signed by all GA persona contributors and any
      opted-in Tara instructors; royalty waterfall settles in test (see § 41, §
      41.1). Implementation: voice-cloning consent registry and royalty gates
      are aggregated by `verify:v3 launch-readiness`.
- [x] Design-tokens → UE UMG codegen green; visual regression vs. reference
      passes on Desktop + Mobile + VR cooks (see § 1.3). Implementation:
      design-token codegen and regression evidence are aggregated by
      `verify:v3 launch-readiness`.
- [x] All wave-1 region prerequisites signed off; tier router enforces
      unsupported-region routing (see § 73B). Implementation: region rollout
      gate is aggregated by `verify:v3 launch-readiness`.
- [x] Pixel Streaming abuse posture defaults configured and drilled: idle
      disconnect, per-user / per-IP caps, daily free-tier minutes, region
      backpressure, concert pre-warming caps, abuse classifier (see § 73C).
- [ ] Concert authoring pipeline sustained the GA cadence (2 concerts / month /
      artist × 6 artists) for 60 days post-GA with editorial sign-off on every
      concert (see § 73D). NOT LOCALLY ACTIONABLE (2026-06-12): the 60-day
      post-GA window has not elapsed; the prior evidence was future-dated (see
      §73D and `V3/concerts/ga-cadence-60-day-evidence.json`). `blocked:release`
- [x] Pixel Streaming POP capacity dashboards green; multi-cloud failover
      drilled in `ap-south-1` and `ap-northeast-1`; quarterly quota review
      completed (see § 73E).
- [x] Deep-link scheme registration live on iOS + Android; Universal Links + App
      Links route into UE5 native when installed, fall back to V1 web V3 routes
      when not (see § 11.2 + `V3/docs/deep-links.md`). Implementation: deep-link
      docs and companion mobile certification evidence are aggregated by
      `verify:v3 launch-readiness`.
- [x] Steam Deck Verified or Playable rating achieved (see § 10.2 + § 69).
      Implementation: Steam Deck compatibility checklist and certification
      evidence are aggregated by `verify:v3 launch-readiness`.
- [x] Client build-size budgets met across every platform (see § 67.1).
      Implementation: client asset, cook-size, console/desktop, VR store, and
      patch-headroom gates are aggregated by `verify:v3 launch-readiness`.
- [x] VR per-user calibration (IPD / height / arm-length) persisted, synced via
      V1 identity; floor-recalibrate gesture available in every venue (see §
      12). Implementation: VR calibration and floor recalibration gates are
      aggregated by `verify:v3 launch-readiness`.
- [x] Avatar nameplate LOD ladder green: stadium-tier render holds frame budget
      at 4 096 attendees; class-tier readability verified; accessibility
      nameplate-density review passed (see § 14). Implementation:
      avatar-nameplate LOD gate is aggregated by `verify:v3 launch-readiness`.
- [x] Cancellation / refund policy live with the three-tier user schedule,
      platform-cancel goodwill, provider-outage protocol, signed-edition
      burn-or-keep choice, waitlist promotion, stadium band downgrades, and
      per-region tax reversal (see § 53.1). Implementation: cancellation,
      refund, waitlist, signed-edition cancellation, stadium reshuffle, and tax
      reversal gates are aggregated by `verify:v3 launch-readiness`.
- [x] Adversarial stub scanner extended to UE C++ + UE assets; pre-commit hook
      gated on UE source; zero actionable hits across UE C++ + UE assets +
      Rust + TS (see § 70). Implementation: §70 testing evidence, pre-commit
      hook, and CI stub scanner are aggregated by `verify:v3 launch-readiness`.
- [x] UE anti-mod / anti-cheat posture documented and adopted:
      server-authoritative everywhere, persona-impersonation gates enforced,
      platform-level integrity (Apple / Quest / Sony / Steam) enabled, no
      client-side attestation at GA (see
      `arch§"UE Anti-Mod     and Anti-Cheat Posture"`). Implementation:
      `V3/security/ue-anti-mod-anti-cheat-posture.json` is aggregated by
      `verify:v3 launch-readiness`.

V3 is GA-ready only when every box above is `[x]`.