docs(assessment): Phase 2 — nine layer cards, verified against code not documents

Fills the taxonomy with evidence. Every liveness label re-verified at
8927c563 rather than inherited from the 2026-06-09 system map. Three
inherited claims did not survive, and every one of them came from a
document while every falsification came from reading code.

CORRECTIONS:

- Phase 0 Finding 0-C was WRONG. The L11 always-on process IS BUILT:
  chat/always_on.py::run_continuous, chat/always_on_daemon.py::run_daemon
  (single-instance lock, SIGINT/SIGTERM stop, load-time identity guard),
  CLI `core always-on`. Landed 2026-06-14 — five days AFTER the system-map
  snapshot that declared no forever entrypoint exists. The real finding is
  sharper: built, with a complete falsifiable soak harness, never run to a
  recorded artifact, and enforced by NO SUITE AT ALL.
- CR-1 attention/allocation is not a missing layer but a live undocumented
  one: generate/stream.py:255-263 runs SalienceOperator -> AttentionOperator
  and gates every generation step; use_salience defaults True. It owns the
  ~73%-of-turn hot path and has no ADR, no card, no layer in any ratified
  articulation. (generate/salience.py COMPOSES core.physics.salience — not
  a duplicate; that false lead is recorded, not propagated.)
- CR-2's components exist: DriveGradientMap and ExertionMeter are both
  constructed in chat/runtime.py. DriveGradientMap is NEVER READ — textbook
  decoration by the sabotage test. ExertionMeter runs but feeds telemetry
  only; fatigue gates no decision. The claim survives and sharpens: CORE has
  drive objects and no chooser.

STAGE-COVERAGE AUDIT: 7 of 9 covered; non-text ingest uncovered (59
sensorium modules reach no serving path); the cycle's runner claimed-only.

CROSS-CUTTING: F-1 built-and-off is the dominant pattern (17 flags default
False, only deduction_serving ratified ON) with no register of the set or
what would flip it. F-2 enforcement lags capability — orphaned pins are
undetectable because suite tuples are hand-curated. F-3 formation's
six-boundary trust standard is not applied at M2, the surface facing
untrusted user text. F-4 ADR/code contradictions are load-bearing (the
daemon has no ADR while ADR-0146 rejected the daemon shape; ADR-0252's
"34 surface organs" does not reproduce — 18 found). F-5 what is excellent,
stated plainly: the typed learning boundary, selection-not-rewrite, the
non-hardening invariant, fail-closed lane shapes.

No layer is wrong-solution. Two candidates deferred to Phase 4 with
evidence: Wilson/replay independence in licensing, DriveGradientMap.

docs/assessment/04-phase2-findings.md

@@ -0,0 +1,108 @@
+# Phase 2 — Findings, Corrections, and the Phase 3 Handoff
+
+**Executor:** Opus 5, 2026-07-27. **Verified against:** `forgejo/main` @ `8927c563`.
+**Deliverable:** nine layer cards in `10-layer-cards/` (M0, M1, M2, M3, M4, M5, M6, MG, MV), each schema-compliant per `03-card-schema.md`.
+
+---
+
+## 1. Corrections forced by re-verification
+
+Phase 2's charter was to verify rather than inherit. Three inherited claims did not survive. Recording them prominently, because the *pattern* matters more than any single correction: **every falsified claim came from a document, and every falsification came from reading code.**
+
+### 1.1 The L11 always-on process is BUILT (Phase 0 Finding 0-C was wrong)
+
+`chat/always_on.py::run_continuous` (279 lines), `chat/always_on_daemon.py::run_daemon` (195 lines, single-instance lock, SIGINT/SIGTERM-wired stop, load-time identity guard), and CLI command `core always-on` (`core/cli.py:244`) all exist. They landed **2026-06-14** — five days *after* the `.system-map/` snapshot of 2026-06-09 that declared "no forever entrypoint exists." Phase 0 inherited the map's claim.
+
+The real M6 finding is different and more actionable: the process is built, has a complete falsifiable soak harness (`evals/l10_always_on`, four predicates with `*_holds`/`*_bites` pairs), **has never been run to a recorded long-horizon artifact**, and is **enforced by no suite at all**.
+
+### 1.2 Candidate CR-1 (attention/allocation) is not a missing layer — it is a live, undocumented one
+
+Phase 1 registered attention as a possibly-missing function whose blueprint articulation (ADR-0008) had no successor. **The mechanism is live on the serving path.** `generate/stream.py::_attention_candidates` (`:255-263`) runs `SalienceOperator().compute(...)` then `AttentionOperator(inhibition_threshold).plan(...)`, and the resulting `allowed_indices` are intersected with language candidates at `:329` — replacing them outright at `:331` when language candidates are absent. `use_salience` defaults **True** (`core/config.py:35`).
+
+Note also that `generate/salience.py` *composes* `core.physics.salience.SalienceOperator` (imported as `CurvatureSalienceOperator`) rather than duplicating it — so this is a layering, not the duplicate-implementation hazard it first appeared to be. That correction is recorded here rather than propagated as a false finding.
+
+**CR-1 is therefore re-characterized:** not "does attention exist?" but "the mechanism that gates every generation step, and consumes ~73% of turn time through `cga_inner`, has no owning ADR, no card, and no layer in any ratified articulation." The blueprint's `InhibitionMask` class exists in `core/physics/inhibition.py` but is imported only by `core/physics/__init__.py` — the live inhibition is a scalar threshold, not the operator. The gap is **governance and documentation, not capability** — which makes it cheaper to close and easier to have missed.
+
+### 1.3 Candidate CR-2 (agenda/drive) — the components exist; the claim survives and sharpens
+
+Phase 1 recorded `DriveGradientMap` and `ExertionMeter` as never built. Both are constructed in `chat/runtime.py` (`:716`, `:714`). But:
+
+- **`DriveGradientMap` is constructed and never read.** No site reads `self._drive_map`. Deleting it changes no output. By the sabotage test this is **decoration** — and it is the cleanest instance the assessment found.
+- **`ExertionMeter` is exercised** (`record` at `:2912`, `fatigue` at `:2913`) but its output flows only into `drive_summaries` and `fatigue_index` — telemetry. **Fatigue gates no decision.**
+
+So CR-2's substance is confirmed and stated more precisely: CORE has drive and exertion *objects* and no *chooser*. Nothing ranks what to do next. The mechanisms exist as instrumentation; the function does not exist as agency.
+
+---
+
+## 2. The stage-coverage audit
+
+The taxonomy's central instrument, run with evidence. A stage is **covered** only where a live component owns it *and* carries evidence that would fail if the mechanism were deleted.
+
+| Stage | Verdict | Owner | Basis |
+|---|---|---|---|
+| listen/ingest (text) | **covered** | M2 | `inject` on the live path, closure-checked at the gate |
+| listen/ingest (non-text) | **uncovered** | M2 | `sensorium/` (59 modules) imports nowhere on the serving path; no projection heads |
+| comprehend | **covered, narrowly** | M3 | Deduction bands `wrong=0` over 18,000 cases; reader spans 19 constructions vs a 1739-construction writer, fabricates on 22 |
+| recall | **covered** | M1 | Exact CGA recall live; fabrication-control lane pinned |
+| think/reason | **covered** | M3 | ROBDD entailment 716/716 against an independent oracle |
+| articulate | **covered** | M4 | Live serving, ratified `wrong=0` lanes, typed refusal, negation now representable |
+| learn from reviewed correction | **covered** | M5 | Two pinned loop-closure lanes prove the single reviewed path |
+| replay deterministically | **covered** | MV | 11 SHA-pinned lanes, CI-failing on drift |
+| *(the cycle's runner)* | **claimed-only** | M6 | Process exists; no measured horizon, no suite-enforced pin, continuity flags default off |
+
+**Seven of nine covered; one uncovered by deliberate scoping; one — the runner — claimed-only.** The single uncovered *stage* is non-text ingest. The single unproven *layer* is the one the telos names.
+
+---
+
+## 3. Cross-cutting findings
+
+**F-1 — Built-and-off is the dominant pattern, and it is unaccounted.** Across layers, substantial machinery exists behind flags that default `False`: `unified_ingest`, `curriculum_serving_enabled`, `ask_serving_enabled`, `verified_serving_enabled`, `consolidate_determinations`, `review_pending_proposals`, `review_derived_close_proposals`, `auto_contemplate`, `auto_proposal_enabled`, `vault_promotion_enabled`, `persist_session_state`, `strict_identity_continuity`, `identity_wave_gate`, `identity_action_surface`, `realizer_grounded_authority`, `accrue_realized_knowledge`, `estimation_enabled`. Only `deduction_serving_enabled` is ratified ON. Each default is individually defensible; **no document states the set**, nor what evidence would flip any of them. This is the largest single lever in the system and it has no register.
+
+**F-2 — Enforcement lags capability, most where it matters most.** M6's soak pins run in no suite; M1's no-approximate-recall prohibition has no verified failing pin; MG's cross-cutting writ has no bypass pin. In each case the *mechanism* is sound and the *guarantee that it stays sound* is doctrinal rather than mechanical. MV's hand-curated suite tuples cannot detect an orphaned pin — the highest-leverage single fix the assessment has found.
+
+**F-3 — The strongest in-repo standard is not applied where exposure is highest.** M5's formation pipeline declares six trust boundaries, content-addressed in and out, no floats in hashed payloads, no pickle, an audit record for every rejection. M2 — the boundary facing untrusted user text in production — has no comparable declared table. The bar exists; it has not been carried to the hotter surface.
+
+**F-4 — Documentation debt is now load-bearing, not cosmetic.** `chat/always_on_daemon.py` has no ratifying ADR while the governing ADR-0146 explicitly *rejected* the daemon shape. The live attention mechanism has no ADR. The `MIND-PHYSICS-BLUEPRINT` renderer line is stale. ADR-0252's "34 surface organs" does not reproduce (**18** `resolve_promotable_*`, all in `generate/derivation/`). When the record contradicts the code, every downstream reasoner inherits the error — as Phase 0 did.
+
+**F-5 — What is excellent, stated plainly.** The typed learning boundary (M5) dissolves the autonomy-versus-safety trade-off rather than splitting it. The selection-not-rewrite surface discipline (M4) preserves the honest artifact even when it is not served. The non-hardening invariant (M1) structurally forbids an axiom flag. Fail-closed unknown lane shapes and NON-CANONICAL run stamping (MV) are the habits of a system that expects to be wrong. Phase 5 should carry these forward as the standard other layers are measured against, not merely as an audit's polite paragraph.
+
+---
+
+## 4. Layer verdict summary
+
+| Layer | Liveness (re-verified) | Fitness | The one-line reason |
+|---|---|---|---|
+| M0 Substrate | `live-serving` | `fit` | Does one thing without compromise; optimization has twice aimed at the wrong function |
+| M1 Knowledge & Memory | `partial-wiring-debt` | `fit` | Exactness and typed standing reinforce each other; what compounds vs resets is invisible in the name |
+| M2 Afferent Boundary | `partial-wiring-debt` / `inert` | `strained` | 59 modules reach no serving path; the trust-boundary bar exists elsewhere in-repo |
+| M3 Comprehension & Reasoning | `partial-wiring-debt` | `strained` + `superseded-in-place` | Expert substrate, novice reader — ratified diagnosis, unrun acceptance gate |
+| M4 Expression & Serving | `live-serving` | `strained` | Excellent discipline; surface precedence accreted one arm per capability |
+| M5 Learning & Growth | `partial-wiring-debt` | `fit` / `strained` | Best-executed idea in CORE, 24×–73× under-fed |
+| M6 Continuity & Process | `partial-wiring-debt` | `strained` | Built further than reported, proven less than assumed, enforced by nothing |
+| MG Governance & Identity | `live-serving` | `fit` / `strained` | Alignment as structure; enforcement gate off and unauthorized |
+| MV Verification & Evidence | `partial-wiring-debt` | `strained` | Right instincts; coverage is a curation artifact with a hole at the worst spot |
+
+No layer is `wrong-solution`. Two candidate `wrong-solution` findings are deferred to Phase 4 with evidence: the Wilson/replay independence basis in M5's licensing, and `DriveGradientMap` as constructed decoration.
+
+---
+
+## 5. Handoff to Phase 3
+
+**Deliverable:** component cards in `20-component-cards/`, per `03-card-schema.md` §6 depth allocation.
+
+**Descent order:**
+1. **The four ⚑ zero-subsystem zones**, all load-bearing, three on the serving path: `comprehend-organ` (→ `core/comprehension_attempt/`, 6 modules), `determine-phase` (→ `generate/determine/`, 8 modules), `realize-phase` (→ `generate/realize/` + `realizer.py` + `realizer_guard.py`), `sensorium-falsification` (→ `sensorium.environment.falsification`).
+2. **M6's built half** — `engine_state/`, `chat/always_on.py`, `chat/always_on_daemon.py`, and the `evals/l10_*` harnesses. Establish what the soak *would* prove if run.
+3. **M3's derivation organs** — resolve the 34-vs-18 count against ADR-0252's diagnosis. This determines whether the debt is being paid down or was measured differently.
+4. **M4's surface-selection arms** — enumerate every arm and its precedence; this is the input to the Phase 4 Third-Door question.
+5. **The CR-1 attention mechanism** — `generate/salience.py`, `generate/attention.py`, `core/physics/{salience,attention,inhibition}.py`. It gates every generation step and owns the hot path; it needs a card regardless of how the layer question is ruled.
+
+**Verification obligations (non-negotiable):**
+- Stamp `verified_at` with the SHA actually inspected. The system map is a prior; 2026-06-09 is stale by two major arcs.
+- Apply the sabotage test to every `live-*` claim. `DriveGradientMap` shows the failure mode is present in this tree, not hypothetical.
+- For every invariant cited, name its pin **and** confirm the suite that runs it. Several Phase 2 cards had to record `suite: none`.
+- Distinguish *imported* from *constructed* from *read* from *gating a decision*. All four appear in this tree and only the last is load-bearing.
+
+**Standing:** PR #138's fabrication findings are measured-and-pinned, held for ADR + ratification — record, never re-discover, never fix.
+
+**Open items for Phase 4 seeded by Phase 2:** the flag-default register (F-1); the orphaned-pin meta-check (F-2); M2 adopting formation's trust-boundary table (F-3); the ADR/code contradictions (F-4); Wilson/replay independence in licensing; `DriveGradientMap` deletion; surface-precedence as a declarative table; the `evals/l10_*` suite assignment.

docs/assessment/10-layer-cards/M0-substrate.md

@@ -0,0 +1,83 @@
+# M0 — Substrate
+
+**Kind:** layer · **Parent:** CORE · **Assessor:** Opus 5 (Phase 2)
+**Verified at:** `8927c563` (2026-07-27)
+**Liveness:** `live-serving` · **Fitness:** `fit` · **Topology role:** runtime boundary
+
+> The medium, not the mind. Per the governing mental model, the field is the *electricity* and the intelligence is in the wiring — M0's entire job is to be a substrate so well-behaved that everything above it can be exact, replayable, and locatable when wrong. Cl(4,1) was chosen for one reason: it is the minimal algebra in which every conformal transformation is a versor, so every cognitive operation is algebraically closed by construction rather than by special-case handling. M0 must contain no cognition-specific policy; the moment it does, the substrate has started deciding.
+
+**Telos stages:** recall, think/reason, articulate, backbone-runtime, replay/determinism (as the medium of all)
+**Macro role:** Supplies closure, exactness, and bit-level replayability to every layer above.
+
+---
+
+## What it is / What it does
+
+`algebra/` (9 modules) implements Cl(4,1) — geometric product, versor apply, reverse, `cga_inner`, the versor condition — with `algebra/backend.py` dispatching between a pure-Python implementation and an opt-in Rust one. `field/` (4 modules) holds `FieldState` and propagation. `core/physics/` (37 modules) sits atop the algebra with the wave/identity/quantity machinery.
+
+The one non-negotiable invariant is `versor_condition(F) = ‖F·reverse(F) − 1‖_F < 1e-6`, checked at the injection gate and preserved across every transition, which is only ever the sandwich product `F' = V·F·reverse(V)`. Closure of field transitions is owned **solely** by `algebra/versor.py::_close_applied_versor`; no other site may repair it. `AGENTS.md` draws the bright line explicitly: *semantic anchoring* (allowed at named construction boundaries, preserves the condition by construction, expresses a relation in the cognitive model) versus *drift repair* (forbidden — restoring an invariant a prior function should have preserved). Naming may not disguise the distinction.
+
+---
+
+## Contract
+
+- **Inputs:** injected multivectors from M2's gate; versors from packs and operators.
+- **Outputs:** `FieldState`, exact CGA distances, closure verdicts.
+- **Invariants:**
+  - `versor_condition(F) < 1e-6` — never weakened to make code or tests pass — pin: algebra suite (15 files) — status: **running**.
+  - No normalization/closure/repair outside owned boundaries; forbidden in `generate/stream.py`, `field/propagate.py`, `vault/store.py`, logging/telemetry — pin: `tests/test_third_door_cohesion.py` (AST-pinned off-serve quarantine).
+  - Physics hot ops must import from `algebra.backend`, not direct pure-algebra modules — pin: `tests/test_physics_backend_dispatch_hygiene.py`.
+  - f64 wave-residual pins stay on the Python product (Rust f32 GP is not parity-safe for 1e-9 pins).
+
+---
+
+## Design vs build
+
+- **Design:** `docs/Yellowpaper.md` (formal Cl(4,1) specification), `docs/position_paper.md` §3, ADR-0241/0242 (wave-field, Fibonacci operators), ADR-0245 (CGA unification), ADR-0243 (lifecycle). `AGENTS.md` carries the invariants as law.
+- **Build:** `live-serving`. Key files: `algebra/versor.py`, `algebra/backend.py`, `field/state.py`, `field/propagate.py`, `core/physics/`.
+- **Evidence:**
+  - Versor closure is enforced and the algebra suite runs it (15 test files) — pin+suite — would-fail-if-absent: **yes**.
+  - Pure Python is the deterministic default; Rust is opt-in via `CORE_BACKEND=rust` — code-read — `algebra/backend.py:1-9` — would-fail-if-absent: **yes**.
+  - `versor_condition` costs **0.448 ms against a 200 ms turn — 0.22%** — measurement — `docs/research/cga-hot-path-measurement-2026-07-25.md` — would-fail-if-absent: **n/a (a measurement)**.
+  - CGA is ~73% of turn time via `cga_inner` → `geometric_product` at ~33,986 calls/turn in nearest-neighbour and salience search — measurement — same document.
+
+---
+
+## Capacity
+
+- **Designed:** algebraically closed over the full conformal group; exact recall as a geometric fact.
+- **Measured:** closure holds at the 1e-6 gate across all serving lanes; Rust backend records `core_rs import: False`, `using_rust(): False`, status `python_fallback` in the benchmark run.
+- **Ceilings:** bit-exact determinism forbids JIT float reassociation (blocks MLX fusion without a ratifying ADR) and rules out bf16 (ε ≈ 7.8e-3, four orders coarser than the gate). Rust f32 geometric product is not parity-safe for the f64 residual pins.
+
+---
+
+## Dependencies & provenance
+
+**feeds** → every layer; **constrained-by** → MV (bit-exact parity pins, `core-rs/tests/test_crdt_hash_parity.rs`); **owning ADRs:** ADR-0241, ADR-0242, ADR-0243, ADR-0245, ADR-0180.
+
+---
+
+## Stage coverage
+
+| Stage | Verdict | Evidence |
+|---|---|---|
+| *(medium for)* recall / think / articulate / backbone / replay | **covered** | Closure enforced by a running suite; exact CGA distance is the recall primitive; determinism pinned bit-exact |
+
+**Zone roster:** `L0-algebra` (live-serving, confirmed), `L1-field` (partial-wiring-debt, not individually re-verified).
+
+**Rollup note:** weakest-link rollup. M0 is the most solid layer in CORE and the least in doubt.
+
+---
+
+## Judgment
+
+**Fitness: `fit`.** M0 does exactly one thing and does it without compromise. Notably, the position paper's claim that drift-correction machinery "was deleted because it only exists when the algebra is not closed" is architecturally coherent with `AGENTS.md`'s bright-line rule — the doctrine and the code tell the same story here, which is not true everywhere else in this assessment.
+
+**Honest wrinkles:**
+- **The optimization target has been repeatedly misidentified**, twice in documented history. Both an external assessment and a hardware blueprint aimed at `versor_condition` (0.22%) rather than `cga_inner`/`geometric_product` (~73%). The lesson generalizes past M0: the invariant is the *most visible* thing in the layer, so it attracts attention the profile does not justify.
+- **`CORE_BACKEND=rust` is off by default and nobody currently knows whether parity holds.** The verification attempt on 2026-07-25 was blocked — `cargo` could not reach `static.crates.io` under the sandbox network policy. This is an open question with a stated blocker, which is the honest state, but it means a written-and-shipped Rust kernel sits unused and unverified.
+- The measured hot path (`cga_inner` in salience/nearest-neighbour search) is M0 *compute* driven by an M3/CR-1 *mechanism* that has no owning card or ADR. Optimization work here has nowhere to attach architecturally — see the Candidate Register CR-1 revision in the M2/M3 cards and Phase 4.
+
+**Open questions:**
+- Does `core_rs` still hold bit-exact parity, and should Rust become the default? (→ ruling; blocked on network access)
+- Does the ~73% CGA cost in salience search justify an algorithmic change rather than a backend change? (→ Phase 4)

docs/assessment/10-layer-cards/M1-knowledge-memory.md

@@ -0,0 +1,90 @@
+# M1 — Knowledge & Memory
+
+**Kind:** layer · **Parent:** CORE · **Assessor:** Opus 5 (Phase 2)
+**Verified at:** `8927c563` (2026-07-27)
+**Liveness:** `partial-wiring-debt` · **Fitness:** `fit` · **Topology role:** runtime boundary + reviewed pack data
+
+> What is known, at rest — and the standing at which it is known. M1 is where CORE's rejection of statistical retrieval becomes concrete: a recall hit is a *geometric fact*, not a probabilistic suggestion, because the CGA inner product **is** Euclidean distance in conformal embedding. Exactness here is not a performance trade-off; it is what makes a recalled result verifiable at all. M1 also carries the epistemic-status regime, so it stores not just claims but their position in the revision graph.
+
+**Telos stages:** recall (primary); comprehend and articulate (as the source of packs and vocabulary)
+**Macro role:** Holds and returns knowledge exactly, with its standing attached.
+
+---
+
+## What it is / What it does
+
+`vault/` (5 modules) is exact CGA recall — `best_match = argmax_i {Q · V_i}` — with no ANN index, no HNSW, no embedding ranking, no tunable similarity threshold; the runtime invariant forbids introducing any. `packs/` (48 modules) holds compiled runtime language packs plus governance/style modality packs. `vocab/`, `morphology/`, `alignment/` form the lexical substrate. `core/contemplation/` (13 modules) is memory in motion — idle consolidation, the wave seam, hypothesis-versus-evidence reconstruction.
+
+The epistemic surface (ADR-0021) types every claim by its **position in the revision graph**, not by source trust: `COHERENT` (fits current field geometry), `CONTESTED` (incoherent with a reviewed claim, review pending), `SPECULATIVE` (proposed, admissible only as candidate), `FALSIFIED` (incoherent under accumulated evidence — *retained*, eligible for inversion). Two properties deserve emphasis. First, the **non-hardening invariant**: no reviewed claim ever becomes unrevisable; no `final`/`frozen`/`axiom`/`permanent` flag exists or may be added. The only closure in the architecture is mathematical (`versor_condition`), never epistemic. Second, the **curator rule**: status transitions are computed from coherence with the reviewed field, and the curator's *only admissible reasoning is geometric* — source credentials, popularity, and institutional position are explicitly inadmissible as justification.
+
+The dual-pack serve boundary (ADR-0253 / INV-33) separates compiled runtime packs (`packs/data/<pack_id>/`, the only serve authority, loaded via `packs.compiler.load_pack`) from source/draft language trees (`packs/he`, `packs/grc`, `packs/en`, …), which serve entrypoints must not import as Python packages.
+
+---
+
+## Contract
+
+- **Inputs:** reviewed teaching applies and certified promotions (M5), compiled pack artifacts, session writes.
+- **Outputs:** exact recall hits with `epistemic_status`, lexical entries, mounted packs, vocabulary manifold positions, consolidated derived facts with `Derivation` provenance.
+- **Invariants:**
+  - Exact recall only — no cosine similarity, ANN, HNSW, or embedding ranking as runtime memory truth — pin: architectural invariants; **status: enforced by doctrine + review**, mechanical pin not individually re-verified at this SHA.
+  - INV-21 (vault-writer allowlist), INV-22/23 (unmarked → SPECULATIVE), INV-24 (recall categorization; user-facing evidence COHERENT-only), INV-29 (only `vault/store.py` transitions status) — pins: `tests/test_architectural_invariants.py`, `tests/test_epistemic_invariants.py`.
+  - Non-hardening — pin: `tests/test_epistemic_invariants.py`.
+  - INV-33 dual-pack serve boundary — pin: `tests/test_pack_draft_serve_boundary.py` (static AST + process import probe).
+  - Morphology rows load only from compiled packs, carrying `language`, `source_pack_id`, `source_span` — provenance-complete or not loaded — pin: `tests/test_observed_he_morph_constraint_v0.py` (four-arm ablation).
+
+---
+
+## Design vs build
+
+- **Design:** ADR-0021 (epistemic surface), ADR-0054 (exact CGA recall indexing/batching), ADR-0253 (dual-pack boundary), ADR-0180 (Delta-CRDT sharded vault), ADR-0243 (wave-field lifecycle), ADR-0241 (holographic standing-wave storage — **off-serve quarantined**), `docs/position_paper.md` §3.3.
+- **Build:** `partial-wiring-debt`. Key files: `vault/store.py`, `packs/compiler.py`, `core/contemplation/`, `core/physics/holographic_vault.py` (quarantined).
+- **Evidence:**
+  - Exact recall is the runtime primitive; `recall`/`recall_batch` in `vault/store.py:224,296` — code-read — would-fail-if-absent: **yes**.
+  - Pack-grounded and teaching-grounded composers serve real turns — lanes — `evals/domain_contract_validation`, `evals/fabrication_control` (phantom endpoints, cross-pack non-bridges, sibling collapses all refuse), both pinned in `CLAIMS.md` — would-fail-if-absent: **yes**.
+  - Off-serve quarantine of the wave/holographic modules is AST-pinned — pin — `tests/test_third_door_cohesion.py` — would-fail-if-absent: **yes**.
+  - Five Tier-1 domains hold ratified packs with zero open gaps — `CLAIMS.md`.
+
+---
+
+## Capacity
+
+- **Designed:** exact, verifiable recall over a curated manifold, with standing attached to every claim.
+- **Measured:** 5 ratified domains (2 `reasoning-capable`, 3 `audit-passed`); packs across en / he / grc / el; `docs/gaps.md` shows all 26 historical coverage gaps closed.
+- **Ceilings:** **the vocabulary manifold is finite and curated by design.** Extending to a new domain requires constructing pack vocabulary, establishing coherence with reviewed claims, and passing an eval lane. The position paper states the honest limit: whether this scales to the breadth of human knowledge is an open question; whether it can be done without confabulation is not. T1 vault contents are discarded on process exit (ADR-0146; see M6).
+
+---
+
+## Dependencies & provenance
+
+**feeds** → M3 (recall, packs, vocabulary), M4 (lexicon, register packs); **written-by** → M5 (the single reviewed path); **built-on** → M0 (CGA distance is the recall primitive); **residency-gated-by** → M6.
+
+---
+
+## Stage coverage
+
+| Stage | Verdict | Evidence |
+|---|---|---|
+| recall | **covered** | Exact CGA recall serving live; fabrication-control lane pinned |
+| comprehend / articulate (as source) | **covered** | Compiled packs are the only serve authority (INV-33 pinned) |
+| *(consolidation — straddles M5)* | **covered, flag-gated** | CLOSE consolidation is proof-gated and defaults OFF |
+
+**Zone roster:** `L2-vault`, `L3-packs`, `vocab-manifold` (live-serving), `morphology` (live-internal), `alignment-resonance` (live-internal), `L8-memory-contemplation` ✱ (straddles M5; owned here, cross-referenced there).
+
+**Rollup note:** weakest-link rollup. `vocab-manifold` is confirmed live-serving; the layer label understates it.
+
+---
+
+## Judgment
+
+**Fitness: `fit`.** The exactness commitment and the epistemic-status regime are mutually reinforcing: exact recall makes a hit verifiable, and typed standing makes it *interpretable*. The non-hardening invariant is a genuinely unusual and, in this assessor's reading, correct design choice — most systems acquire an axiom flag eventually, and forbidding it structurally is what keeps the revision graph honest.
+
+**Honest wrinkles:**
+- **The knowledge that compounds and the knowledge that resets are different sets.** Packs and reviewed corpora persist; the T1 vault does not survive process exit. So "memory" in M1 means two very different things depending on tier, and the distinction is invisible in the layer name. This is the M6 residency question seen from the other side.
+- `FALSIFIED` claims are **retained**, not deleted — correct and easy to misread as clutter. Any future cleanup pass must not treat falsified rows as dead data.
+- The holographic standing-wave vault (ADR-0241) is real, uses the INV-21 writer, and is **hard-quarantined off-serve** by AST pin. It is a substantial built capability that no serving path may touch — legitimate research quarantine, but worth Phase 4 attention as capacity that exists and cannot be used.
+- The exact-recall prohibition (no ANN/cosine/HNSW) is stated in `AGENTS.md` as law; I did not individually verify a mechanical pin that would *fail* if someone added a cosine ranker. Doctrine-enforced-by-review is weaker than doctrine-enforced-by-test. Flagged for Phase 3.
+
+**Open questions:**
+- Is there a failing-when-violated pin for the no-approximate-recall invariant, or is it review-enforced? (→ Phase 3)
+- Should the holographic vault's quarantine have an exit criterion? (→ ruling)
+- Does the identity-divergence curriculum still bypass formation's gates? (→ Phase 3, from M5)

docs/assessment/10-layer-cards/M2-afferent-boundary.md

@@ -0,0 +1,90 @@
+# M2 — Afferent Boundary
+
+**Kind:** layer · **Parent:** CORE · **Assessor:** Opus 5 (Phase 2)
+**Verified at:** `8927c563` (2026-07-27)
+**Liveness:** `partial-wiring-debt` (text) / `inert` (non-text) · **Fitness:** `strained` · **Topology role:** runtime boundary
+
+> World → field. M2 is where untrusted reality becomes admissible structure, and it is the only layer whose failure mode is *contamination* rather than error: everything downstream inherits whatever M2 admits. Its philosophical charge is that admission is an act with consequences — the gate does not merely parse, it *vouches*. Every entry point is therefore a trust boundary, and normalization is permitted here precisely because this is a declared construction boundary, not a repair site.
+
+**Telos stages:** listen/ingest
+**Macro role:** Admits input into the field under a closure-preserving construction boundary, or refuses it.
+
+---
+
+## What it is / What it does
+
+`ingest/gate.py::inject` is the live text path: it converts tokens into field excitation and is one of the explicitly **allowed normalization boundaries** in `AGENTS.md` — permitted because injection is construction, not drift repair. `core_ingest/` (7 modules) is the ingest compiler. `ingest/` itself is small (2 modules). OOV policy is applied at the same seam via `packs.OOVPolicy`.
+
+`sensorium/` (59 modules — the largest non-test, non-generate package after `core/`) is the afferent track for non-text modalities, plus `sensorium.environment.falsification` (ADR-0211), a deterministic replay surface comparing expected against actual `ObservationFrame` evidence with a closed two-verdict set (`SUPPORTED` / `FALSIFIED`). Neither verdict promotes anything to reviewed memory or mutates packs, vault, identity, or policy.
+
+**Verified at this SHA: `sensorium` is imported by neither `chat/runtime.py` nor `core/cognition/pipeline.py`.** The afferent track is off the serving path entirely — consistent with the map's `inert` label for `sensorium-afferent`, and consistent with the position paper's honest statement that vision, audio, and motor modalities are *planned, not built*: the `ProjectionHead` protocol supports them architecturally; the projection heads do not exist.
+
+---
+
+## Contract
+
+- **Inputs:** raw user text; (designed) non-text modality frames.
+- **Outputs:** injected `FieldState` satisfying `versor_condition < 1e-6`, OOV decisions, `ObservationFrame` evidence, falsification verdicts.
+- **Invariants:**
+  - Every accepted field state satisfies the versor condition **at the gate** — pin: algebra/ingest suites — status: running.
+  - Normalization is allowed **only** at declared construction boundaries (`ingest/gate.py` is named explicitly); drift repair is forbidden and may not be disguised by naming.
+  - Falsification bench forbids raw pixels/PCM/event streams/byte payloads/actuator traces in traces; forbids motor-efferent units in v1; forbids learned latents as substrate; forbids probabilistic confidence or tolerance thresholds in verdicts; forbids `generate/*` dependencies and vault mutation — pin: sensorium suite (21 files) — status: running.
+  - Trust-boundary defaults: explicit opt-in for arbitrary execution; reject unsafe paths before filesystem access; no hidden background execution.
+
+---
+
+## Design vs build
+
+- **Design:** ADR-0007 (ingest → `CandidateGeometricPressure` → `FieldState`), ADR-0211 (environmental falsification), ADR-0243 §multimodal ingress, `AGENTS.md` allowed-normalization-boundaries rule, formation's six trust boundaries as the adjacent standard (M5).
+- **Build:** text path `partial-wiring-debt`; non-text `inert`.
+- **Evidence:**
+  - `inject` is the live serving entry — code-read — `chat/runtime.py:115 from ingest.gate import inject` — would-fail-if-absent: **yes**.
+  - Sensorium is absent from both serving entrypoints — code-read (negative) — would-fail-if-absent: **n/a; this is evidence of absence**.
+  - `sensorium` suite exists with 21 test files — code-read — `core/cli_test.py` — would-fail-if-absent: **yes** (the falsification bench is genuinely exercised).
+  - `unified_ingest=False` (`core/config.py:243`) — measurement — the unified ingest path is built and **off by default**.
+
+---
+
+## Capacity
+
+- **Designed:** any modality admitted through a closure-preserving, trust-bounded gate.
+- **Measured:** text only, in production. Non-text afferent machinery is substantial (59 modules) and exercised by its own suite, but reaches no serving path.
+- **Ceilings:** no projection heads exist for vision/audio/motor. The falsification bench is deliberately v1-closed (two verdicts, no probabilistic confidence, no tolerance thresholds) — a scoping decision, not a defect.
+
+---
+
+## Dependencies & provenance
+
+**feeds** → M0 (field excitation), M3 (tokens, OOV decisions); **reads** → M1 (packs, OOV policy, vocabulary); **verified-by** → MV.
+
+---
+
+## Stage coverage
+
+| Stage | Verdict | Evidence |
+|---|---|---|
+| listen/ingest (text) | **covered** | `inject` is on the live path and gate-checks closure |
+| listen/ingest (non-text) | **uncovered** | Sensorium imports nowhere on the serving path; no projection heads exist |
+
+**Zone roster:** `ingest-boundary`, `ingest-compiler`, `sensorium-afferent` (inert, **confirmed** by import evidence), `sensorium-falsification` ⚑ (live-internal; zero subsystems mapped).
+
+**⚑ Zero-subsystem zone.** `sensorium-falsification` is the fourth unmapped zone and the only one outside M3. What is known: it corresponds to `sensorium.environment.falsification` under ADR-0211 with a closed verdict set and an explicit forbidden-list, and its suite runs. What is unmapped: internal decomposition and the boundary against the rest of `sensorium/`. The system map labels it layer **"L12"** — a stratum no other CORE document uses. That label should be either adopted deliberately or dropped; it currently exists only in a local, gitignored artifact.
+
+**Rollup note:** weakest-link rollup, and here it is genuinely informative rather than misleading: M2's text half serves and its non-text half does not.
+
+---
+
+## Judgment
+
+**Fitness: `strained`.** The text gate is sound and correctly privileged as a construction boundary. The strain is proportional: **59 modules of afferent machinery reach no serving path**, which is the largest quantity of built-and-disconnected code the assessment has located. That is not automatically waste — a deliberately staged capability awaiting projection heads is legitimate — but it is a large standing bet whose entry criterion is nowhere stated.
+
+**Honest wrinkles:**
+- The single most consequential asymmetry in this layer: **M5's formation pipeline declares six explicit trust boundaries with content-addressed inputs and outputs and an audit record for every rejection; M2 — the boundary that actually faces untrusted user text in production — has no comparable declared table.** Both are "the place the world gets in," and only one of them has a published contract of that rigor. This is a Phase 4 item and, in this assessor's reading, the strongest single hindrance-audit lead outside M6: the standard exists in-repo and has not been applied where the exposure is highest.
+- `sensorium-falsification`'s "L12" layer label exists in one local artifact and no ratified document. Minor, but it is exactly how a phantom stratum enters an architecture.
+- `unified_ingest` is built and off; like M5's learning flags, the gap between built and on is undocumented.
+- The falsification bench's explicit prohibition on motor/efferent units in v1 is the **only** place in the corpus that takes a position adjacent to Candidate CR-3 (efferent action) — and it is a scoping constraint on one bench, not a system-level ruling. CR-3 remains unruled.
+
+**Open questions:**
+- Should M2 adopt formation's trust-boundary table format? (→ Phase 4 / ruling)
+- What is the entry criterion for the sensorium track reaching serving? (→ ruling)
+- Adopt or drop the "L12" label (→ Phase 1 taxonomy amendment or ruling)

docs/assessment/10-layer-cards/M3-comprehension-reasoning.md

@@ -0,0 +1,93 @@
+# M3 — Comprehension & Reasoning
+
+**Kind:** layer · **Parent:** CORE · **Assessor:** Opus 5 (Phase 2)
+**Verified at:** `8927c563` (2026-07-27)
+**Liveness:** `partial-wiring-debt` · **Fitness:** `strained` (with one `superseded-in-place` sub-region) · **Topology role:** runtime boundary
+
+> The wiring that thinks. Per the governing mental model — the field is electricity, the intelligence is in the wiring — M3 is where CORE's intelligence actually lives. It takes what M2 admitted and what M1 knows, and produces a decided proposition: what is the case, what follows, what cannot be determined. Its governing competence standard is ADR-0252: comprehension must grasp *deep relational structure* that subsumes a family of problems, not surface features of one.
+
+**Telos stages:** comprehend, think/reason (primary); recall (in-turn)
+**Macro role:** Turns admitted input into a decided, evidence-bearing proposition graph — or a typed refusal.
+
+---
+
+## What it is / What it does
+
+M3 spans recognition (`recognition/`, teaching-derived structural recognizers via anti-unification), the cognition pipeline (`core/cognition/`, 13 modules, `pipeline.py` at 1381 lines), the comprehension attempt/router (`core/comprehension_attempt/`: `classify.py`, `failure_family.py`, `router.py`, `proposal.py`), the determine phase (`generate/determine/`: `determine.py`, `consolidate.py`, `estimate.py`, `estimation_license.py`, `render.py`), the realize phase (`generate/realize/`, `generate/realizer.py`), the deduction flagship (`generate/proof_chain/` — ROBDD tautology engine under six ratified bands), curriculum-grounded reasoning, the GSM8K math reader (demoted to diagnostic), and the field-wedge research zone (a recorded negative result).
+
+Operationally, the live path enters M3 after ingest: intent classification → `PropositionGraph` construction → determination or entailment → `ArticulationTarget`. Deduction serving is **ratified ON** (`deduction_serving_enabled=True`, `core/config.py:397`); curriculum serving is **OFF** (`curriculum_serving_enabled=False`, `:412`), as are `ask_serving_enabled` and `verified_serving_enabled`. The deduction engine is `generate/proof_chain/entail.py` — canonicalize `(P1 & … & Pn) → Q`, ask `is_tautology` over a ROBDD. It is a decision procedure, not a derivation: `EntailmentTrace` carries an outcome, a reason, and five canonical BDD node keys (opaque hashes). **There are no intermediate proof steps in the object**, which is why "the renderer drops the proof chain" was previously diagnosed at the wrong layer — nothing is dropped because nothing exists to drop. Multi-step articulation is engine work.
+
+---
+
+## Contract
+
+- **Inputs:** injected `FieldState`, tokenized/OOV-policed text, mounted packs and vocabulary (M1), session context.
+- **Outputs:** `PropositionGraph` (now carrying `GraphNode.negated`, ADR-0265), `ArticulationTarget`, `EntailmentTrace` / `Determined` / `Undetermined`, typed refusals, recognizer outcomes, `ContractAssessment`.
+- **Invariants:**
+  - **INV-30** — open-world `determine()` constructs only `Determined(answer=True)` or refuses; never asserts `False` — pin: `tests/test_architectural_invariants.py` — suite: present in the test tree; **suite membership unverified at this SHA** (flagged).
+  - **INV-31** — closed-world `FrameVerdict` cannot reach the open-world runtime (transitive import containment + single construction allowlist + typed refusal) — pin: `tests/test_architectural_invariants.py`.
+  - **INV-34** — cognition-pipeline failures are typed, never silent; a `None` `ContractAssessment` is itself a violation; unresolvable referents refuse rather than fill; no PASSTHROUGH in the intent ratifier — pin: `tests/test_linguistic_governance_phases.py`.
+  - Kernel no-new-legacy — new derivation must consume `ProblemFrame`/`KernelFacts`; new raw-prose regex requires an explicit `LEGACY_EXCEPTION` — pin: `tests/test_kernel_no_new_legacy_derivation_surfaces.py`.
+
+---
+
+## Design vs build
+
+- **Design:** **ADR-0252 (Accepted, governing)** — the problem-solving paradigm and its §4 conformance bar; ADR-0251 (halt bespoke per-case regex work; the prohibition governing every math-reader increment); ADR-0249/0250 (reader→Hamiltonian compiler); ADR-0256–0261 (six deduction bands); ADR-0262/0264 (curriculum); ADR-0265 (negation in the proposition graph); ADR-0243 (wave-field lifecycle); ADR-0142 (epistemic taxonomy).
+- **Build:** `partial-wiring-debt`.
+- **Evidence:**
+  - Deduction serving decides real arguments end-to-end, `wrong=0` across all splits — lane — `evals/deduction_serve/report.json`, pinned SHA `0b461a5a…` in `CLAIMS.md` — would-fail-if-absent: **yes**.
+  - Propositional entailment scored against an independent truth-table oracle, 716/716 correct, `wrong=0`, `refused=0` — lane — `evals/deductive_logic/report.json`, pinned `97a23094…` — would-fail-if-absent: **yes**.
+  - `deductive` suite exists and carries 20 test files — code-read — `core/cli_test.py` — would-fail-if-absent: **yes**.
+  - 25 sealed bands / 18,000 cases / `wrong=0`; capability index breadth 13, `wrong_total=0` — measurement — `chat/data/deduction_serve_ledger.json`, `evals/capability_index/baseline.json` (confirmed mechanically 2026-07-25).
+  - **Structure-mapping (the ADR-0252 §6 correction) — not built.** `conformal_procrustes` exists in `core/physics/dynamic_manifold.py` but is off-serving and unwired to comprehension. would-fail-if-absent: **no**.
+
+---
+
+## Capacity
+
+- **Designed:** comprehension that grasps deep relational structure, one canonical structure subsuming a family (generalization ratio > 1).
+- **Measured — the two-grammars result, and it is the sharpest number in the assessment.** Reader and writer inventories measured against each other (PR #138, `c69f9948`): the **writer emits 1739 constructions; the reader comprehends 19; the overlap is 6**, all set-theoretic. The reader **fabricates on 22 more** — `every dog is a mammal` → `member(every_dog, mammal)`; `Given: furthermore; p implies q; p.` reaching served output with `furthermore` recited back as a premise. *These are measured and pinned, held for ADR + ratification — recorded here, not re-discovered and not fixed.* Prior prose claiming the reader "reads" its arguments was falsified: `g_args_rate` was `0.0` throughout.
+- **Ceilings:** curriculum bands are capped at ≤16 entailed cases by the 16-premise compilation cap (ADR-0264 §4.1), so **no curriculum band can earn SERVE until query-scoping lands** — an engineering blocker, not a content one. Deduction's ROBDD decides but cannot narrate multi-step derivations. The GSM8K sealed holdout (1,319 cases) has never been opened against a parser with sufficient coverage.
+
+---
+
+## Dependencies & provenance
+
+**reads** → M1 (packs, vocabulary, vault recall), M0 (field, CGA); **receives** ← M2; **feeds** → M4 (articulation and serve seam), M5 (refusals and comprehension failures become proposal candidates); **verified-by** → MV; **governed-by** → MG.
+
+---
+
+## Stage coverage
+
+| Stage | Verdict | Evidence |
+|---|---|---|
+| comprehend | **covered, narrowly** | Deduction bands decide real arguments with `wrong=0`; but the reader spans 19 constructions against a 1739-construction writer and fabricates on 22 — coverage is real and thin |
+| think/reason | **covered** | ROBDD entailment, 716/716 against an independent oracle; idle consolidation climbs to deductive closure under proof-gating |
+| recall (in-turn) | **covered** | Exact CGA recall via M1 |
+
+**Zone roster:** `L4-recognition`, `L5-cognition`, `comprehend-organ` ⚑, `determine-phase` ⚑, `realize-phase` ⚑, `reasoning-deductive`, `gsm8k-math`, `field-wedge-research`.
+
+**⚑ Zero-subsystem zones — honest scoping.** Three of the four unmapped zones live here and all three sit on the serving path. What is *known* at this SHA: `comprehend-organ` corresponds to `core/comprehension_attempt/` (6 modules: classify, failure_family, router, proposal, model); `determine-phase` to `generate/determine/` (8 modules incl. consolidate, estimate, estimation_license, render); `realize-phase` to `generate/realize/` + `generate/realizer.py` (306 lines) + `generate/realizer_guard.py`. What is *unmapped*: their internal decomposition, per-component liveness, and the boundary between `comprehension_attempt` and `L5-cognition`. **These are Phase 3's first descent targets.**
+
+**Rollup note:** weakest-link rollup; not a completion rate. M3's deduction region is genuinely strong (ratified, evidenced, `wrong=0`); its comprehension region is measurably narrow. A single layer label cannot express that split, which is why the stage table above separates them.
+
+---
+
+## Judgment
+
+**Fitness: `strained`, with the 18 derivation organs `superseded-in-place`.**
+
+The strain is precisely what ADR-0252 named: an expert substrate driven by a novice reader. The ADR is *ratified*, its diagnosis stands, its §6 correction is designed — and its §5 acceptance gate **has never returned a verdict** (two unmerged worktrees, `rnd/structure-mapping-experiment` and `rnd/sme-experiment-v2`; the latter's tip is "formalize §5 experiment scaffolding"). So the condemned mechanism keeps serving under an explicit ruling that it should, until a proven replacement exists. That is `superseded-in-place`, and the schema's separation of liveness from fitness is what lets this card state it without contradiction.
+
+**Honest wrinkles:**
+- **The "34 surface organs" count does not reproduce.** At this SHA there are **18** `resolve_promotable_*` functions, all in `generate/derivation/`. ADR-0252 cites 34. Either the count used a different basis, or consolidation has occurred since ratification. The discrepancy is unresolved and matters, because 34→18 would be evidence the debt is already being paid down — or evidence the ADR's diagnosis was calibrated against something else. Phase 3 should resolve it rather than repeat either number.
+- The single load-bearing empirical claim of the *governing* paradigm ADR is unresolved, and a well-controlled NO-GO is defined as full credit — so the experiment is cheap to finish and expensive to leave open. This is the highest-leverage open item in the assessment.
+- Deduction's strength and comprehension's narrowness are easy to conflate. `wrong=0` across 18,000 cases is a statement about the *decision procedure*, not about how much English CORE can read.
+- `field-wedge-research` is `research-negative` — a mechanism honestly refuted. It is knowledge and must not be tidied into `inert`.
+
+**Open questions:**
+- Run ADR-0252 §5 to a verdict (→ ruling; highest leverage)
+- Reconcile the 34-vs-18 organ count (→ Phase 3)
+- Descend the three ⚑ serving-path zones (→ Phase 3, first)
+- Is multi-step proof articulation wanted, given it is engine work with a real soundness surface? (→ ruling)

docs/assessment/10-layer-cards/M4-expression-serving.md

@@ -0,0 +1,90 @@
+# M4 — Expression & Serving
+
+**Kind:** layer · **Parent:** CORE · **Assessor:** Opus 5 (Phase 2)
+**Verified at:** `8927c563` (2026-07-27)
+**Liveness:** `live-serving` · **Fitness:** `strained` · **Topology role:** runtime boundary
+
+> Field → world. M4 owns the only bytes a user ever sees, which makes it the layer where the project's central discipline — `wrong=0` or refuse — either holds or fails. Everything upstream can be correct and M4 can still serve a falsehood by selecting the wrong surface; everything upstream can refuse and M4 must render that refusal honestly rather than filling it. Its philosophical charge is that *saying* is a distinct act from *knowing*, governed separately.
+
+**Telos stages:** articulate (primary); replay/determinism (trace emission)
+**Macro role:** Selects, governs, decorates, and emits the served surface; emits the telemetry that makes the turn auditable.
+
+---
+
+## What it is / What it does
+
+`chat/runtime.py` (3364 lines) is the layer's centre of mass, with `core/cognition/pipeline.py` (1381) wrapping it for the full cognitive turn, and `generate/realizer.py` + `generate/surface.py` producing the articulation. Around them: the register axis (`chat/register_variation.py`, `chat/register_substantive.py`), response governance (`core/response_governance/`: `govern_response`, `shape_surface`), grounding composers (`chat/pack_grounding.py`, `chat/teaching_grounding.py`, `chat/deduction_surface.py`, `chat/curriculum_surface.py`), the refusal surface (`chat/refusal.py`), safety and ethics checks, and telemetry (`chat/telemetry.py`, `chat/verdicts.py`).
+
+The load-bearing behavior is **surface selection**, contracted in `runtime_contracts.md`: `surface = determination_surface` when a turn determined an answer over realized knowledge; `= [approximate] estimate` under a genuine SERVE license; `= _UNKNOWN_DOMAIN_SURFACE` when the unknown-domain gate fires; `= articulation_surface` otherwise. `walk_surface` and `articulation_surface` are both *always* retained as evidence — a determination or a gate is a **selection**, never a rewrite. This is the layer's best design property: the honest artifact survives even when it is not what was served.
+
+Three distinct surfaces exist for three distinct invariants, and conflating them is a documented hazard: `surface` (what the user read), `walk_surface` (manifold/token-walk evidence), and `hash_surface` (the register-invariant truth-path capture that `compute_trace_hash` folds). Because `TurnEvent` carries the served surface but never `hash_surface`, **`trace_hash` is not reconstructable from telemetry** — a contract, not a defect. Verify a hash by replaying the pipeline, never by rebuilding it from a turn record.
+
+---
+
+## Contract
+
+- **Inputs:** `ArticulationTarget` / `PropositionGraph` from M3, determination or entailment results, mounted register/safety/ethics/identity packs (M1, MG), session context.
+- **Outputs:** `ChatResponse` (`surface`, `walk_surface`, `articulation_surface`), `TurnEvent`, `TurnVerdicts`, `trace_hash`, `CognitivePipelineRecord`, `grounding_source`, `epistemic_state`.
+- **Invariants:**
+  - Register must not move `trace_hash` (ADR-0069 inv C) — pin: register lane tests — status: running (register suites present).
+  - Unknown-domain gate honoured — the realizer's fallback must not override the gate's stub — pin: contract tests in the cognition suite.
+  - Realizer slot-type guard / C1 coherence floor (ADR-0075), with a **documented** exemption for deduction's quoted templates at both guard sites (`chat/runtime.py:2371-2375`, `:3007-3010`).
+  - Grounding-source registration is a three-part atomic change (enum + `enum-snapshot.json` + UI badge contract) — pin: `workbench-ui/enumCoverage.test.ts` fails the build on divergence; `tests/test_workbench_deduction_provenance.py`.
+  - A live `/chat/turn` with a trace hash but no `status="recorded"` pipeline record fails before journal append; pre-widening rows must show `missing_evidence`, never a synthesized green pipeline.
+
+---
+
+## Design vs build
+
+- **Design:** `docs/specs/runtime_contracts.md` (the frozen surface-selection policy, the `trace_hash` contract, audit-ledger R7); ADR-0069/0071/0075/0077 (register axis and guards); ADR-0206 (response-governance bridge); ADR-0039 (audit completeness); ADR-0153 (trace-hash back-stamp); ADR-0254 (grounded-open hedge arm); ADR-0265 (negation reaches the surface); ADR-0024/0025/0026 (typed refusal, rotor and margin admissibility).
+- **Build:** `live-serving`.
+- **Evidence:**
+  - Deduction serving is ratified ON and reaches served output — measurement — `core/config.py:397 deduction_serving_enabled=True`; verified by execution 2026-07-25 (`_run_chat_turn` on a modus-ponens prompt returns the entailment surface) — would-fail-if-absent: **yes**.
+  - Surface selection honours the unknown-domain gate — contract + pin — `runtime_contracts.md` §"Unknown-domain gate honour" — would-fail-if-absent: **yes**.
+  - Provenance falsification (a proved deduction answer recorded as `grounding_source='none'`) is **closed** — the registration requirement and its pin are now documented in `runtime_contracts.md` §"Grounding-source registration" — would-fail-if-absent: **yes**.
+  - Negation reaches the surface (ADR-0265, merged `8927c563`): under `realizer_grounded_authority`, "evidence does not support truth" and "evidence supports truth" previously served **byte-identical** surfaces — would-fail-if-absent: **yes**.
+  - Register decoration does not move `trace_hash` — pin — would-fail-if-absent: **yes**.
+
+---
+
+## Capacity
+
+- **Designed:** every served surface is either grounded, disclosed, or an honest refusal; `wrong=0` or refuse.
+- **Measured:** `wrong=0` holds across every ratified serving lane (deduction 18,000 cases / 25 bands; curriculum physics 32/32; deductive logic 716/716). Writer-side construction inventory: **1739 constructions emitted**. Refusal is typed and carries a machine-readable reason plus per-step rejection evidence.
+- **Ceilings:** a real refusing turn still returns `surface == ""` with `refusal_reason == ""` through `ChatRuntime.respond()`'s `str` contract — the typed evidence is **unread between the raise site and the public return**. The plumbing exists on `CognitiveTurnResult` and `compute_trace_hash`; materialisation awaits a future ADR. Curriculum serving is OFF; `ask` and `verified` serving are OFF.
+
+---
+
+## Dependencies & provenance
+
+**receives** ← M3; **reads** → M1 (packs, register, lexicon), MG (safety, ethics, identity); **feeds** → M5 (correction capture), MV (telemetry, trace, pipeline record), M6 (checkpoint at turn boundary); **governed-by** → MG (safety is fail-closed and never swappable).
+
+---
+
+## Stage coverage
+
+| Stage | Verdict | Evidence |
+|---|---|---|
+| articulate | **covered** | Live serving with ratified `wrong=0` lanes; typed refusal; disclosed estimates; negation now representable |
+| replay/determinism (emission side) | **covered, with a known asymmetry** | `trace_hash` is deliberately register-invariant and deliberately not reconstructable from `TurnEvent`; audit-ledger R7 closed by deferred emission at the serve boundary |
+
+**Zone roster:** `L6-chat-runtime` (partial-wiring-debt per map → **revised to `live-serving` at layer level**: the serving path demonstrably executes end-to-end), `L9-epistemic-verdicts` ✱ (straddles MG; owned here, cross-referenced there).
+
+**Rollup note:** the map's `partial-wiring-debt` label on `L6-chat-runtime` reflects internal wiring debt (dormant modules, unmaterialised refusal strings), not a non-serving path. The layer serves; parts of it are unwired. Weakest-link rollup again understating the serving reality.
+
+---
+
+## Judgment
+
+**Fitness: `strained`.** M4's *architecture* is among the strongest in CORE — the selection-not-rewrite discipline, the three-surface separation, the fail-closed typing, the atomic enum/UI coupling. The strain is that its surface-selection policy has accreted one arm per capability (determination, estimate, unknown-domain, deduction, curriculum, hedge, register decoration, logos-morph override), each individually contracted, with no single place that states the precedence order as an executable rule. `runtime_contracts.md` documents it in prose across several sections; `chat/runtime.py` implements it across 3364 lines. That is the classic shape of a trade-off being split rather than dissolved — and a Third Door candidate for Phase 4 (a declarative resolution table with the precedence pinned, rather than ordered branches).
+
+**Honest wrinkles:**
+- **A refusing turn serves the empty string.** `respond()`/`arespond()` convert any `ValueError` to `""` for their public `str` contract, so the typed refusal — reason code, blocking region, per-step evidence — is constructed and then discarded before the caller sees it. The system's honesty machinery is real and, on this path, unread.
+- The layer that owns `wrong=0` is also the layer where the PR #138 fabrications *surface*: the reader's fabricated `member(every_dog, mammal)` and the recited `furthermore` premise reach **served output**. The defect is M3's; the blast radius is M4's. Measured and pinned, held for ADR + ratification — recorded, not fixed.
+- `epistemic_state` degrades honestly (`epistemic_state_needed`) where hand-copied whitelists degraded dishonestly (`none`). The asymmetry is a reusable design lesson: a coercion that asserts a falsehood is strictly worse than doing nothing.
+- Surface selection is documented as "current policy… future realizer work may change it" — a standing invitation to accrete another arm.
+
+**Open questions:**
+- Materialise the typed refusal into `ChatResponse.refusal_reason` (→ ruling; ADR already anticipated)
+- Should surface precedence become a declarative table? (→ Phase 4 hindrance audit)
+- Whether `TurnEvent` should carry `hash_surface` remains an open ruling recorded in `runtime_contracts.md` (→ ruling)

docs/assessment/10-layer-cards/M5-learning-growth.md

@@ -0,0 +1,86 @@
+# M5 — Learning & Growth
+
+**Kind:** layer · **Parent:** CORE · **Assessor:** Opus 5 (Phase 2)
+**Verified at:** `8927c563` (2026-07-27)
+**Liveness:** `partial-wiring-debt` · **Fitness:** `fit` (mechanism) / `strained` (throughput) · **Topology role:** runtime boundary + reviewed pack data
+
+> Controlled mutation. M5 answers the question that separates a cognitive engine from a database: how does the system come to know something it did not know, without acquiring the ability to lie to itself? CORE's answer is a **typed** boundary — durable standing is reviewed or proof-carrying; provisional standing may update autonomously *iff* it is typed, isolated, replayable, and structurally unable to masquerade as ratified truth. This is the layer where the project's epistemology becomes mechanism.
+
+**Telos stages:** learn from reviewed correction (primary); replay/determinism
+**Macro role:** Converts served experience and curated material into standing knowledge, at a rate and standing the evidence licenses.
+
+---
+
+## What it is / What it does
+
+Four regions. **Teaching** (`teaching/`, 46 modules): the reviewed loop — proposals, review, store, replay-equivalence gate, discovery, curriculum premises, ratification, domain chains. **Formation** (`formation/`, 23 modules): the content-addressed data foundry — Mine → Smelt → Forge → Compose → Compile → Run → Ratify → Promote — with six declared trust boundaries, every boundary content-addressed in and out, every rejection producing an audit record. **Reliability calibration** (`core/reliability_gate/`, `core/ratified_ledger.py`): earned SERVE licenses under a Wilson floor (θ_SERVE = 0.99), sealed practice ledgers, hash-verified on load. **Capability** (`core/capability/`, 14 modules): the ledger, the nine-predicate domain contract, lane-shape registry, reviewer registry, expert-demo promotion.
+
+The boundary is enforced by failing-when-violated invariants rather than convention — INV-21 (vault-writer allowlist), INV-22/23 (unmarked defaults to SPECULATIVE), INV-24 (recall categorization; user-facing evidence is COHERENT-only), INV-29 (only `vault/store.py` transitions `epistemic_status`), INV-30 (open-world `determine()` never asserts False). Autonomous provisional writes — idle CLOSE consolidation, reliability counts, proposal emission, disclosed estimates — all flow through the same `VaultStore.store` path, written SPECULATIVE, rendered `as_told` / `[approximate]` / "proposal". There is no parallel learning path, which is itself an invariant.
+
+---
+
+## Contract
+
+- **Inputs:** served turns and corrections (M4), comprehension failures and typed refusals (M3), curated source material (formation), curator/HITL rulings, sealed practice results.
+- **Outputs:** `PackMutationProposal` / `ReviewedTeachingExample` (SPECULATIVE at creation), ratified chain corpora, sealed + SHA-verified ledgers, `LicenseDecision`, capability ledger rows, `MasteryReport` (self-sealing SHA).
+- **Invariants:** INV-21/22/23/24/29/30 as above; formation's six trust boundaries; content-addressing rules (canonical JSON, sorted keys, **no floats in hashed payloads**, **no pickle** — pickle defeats replay and is a code-execution surface); pack mutation proposal-only until reviewed; identity-manifold mutation by prompt or correction **forbidden**.
+
+---
+
+## Design vs build
+
+- **Design:** ADR-0021 (epistemic surface + one-mutation-path), ADR-0057 (teaching-chain proposal/review/replay-equivalence), ADR-0175 (calibrated attempt-and-eliminate learning; an engine cannot raise its own bar), ADR-0263 (ratified-ledger bridge: seal → ratify → SHA-verify → serve-gate), ADR-0262/0264 (curriculum + negative curriculum), ADR-0091/0106/0109 (domain contracts, expert-demo promotion, lane-shape registry), ADR-0218 (`apply_certified_promotion`), ADR-0161 (HITL async queue — **scope only**), `docs/teaching_order.md` (five-layer prerequisite-topological doctrine).
+- **Build:** `partial-wiring-debt`.
+- **Evidence:**
+  - Miner- and curriculum-sourced proposals route through the *single* reviewed teaching path — lanes — `evals/miner_loop_closure`, `evals/curriculum_loop_closure`, both pinned in `CLAIMS.md` — would-fail-if-absent: **yes**.
+  - Earned-license machinery is real: 25 sealed bands / 18,000 cases with `wrong=0` gate deduction's SERVE — measurement — `chat/data/deduction_serve_ledger.json` — would-fail-if-absent: **yes**.
+  - `formation` suite exists and points at `tests/formation` — code-read — `core/cli_test.py:208` — would-fail-if-absent: **yes**.
+  - Five Tier-1 domains carry ratified status (3 `audit-passed`, 2 `reasoning-capable`), all with zero open gaps — `CLAIMS.md`, mechanically generated.
+  - **Curriculum serve ledger does not exist.** `chat/curriculum_serve_license.py:46` is the single production call site passing `missing_ok=True`, correctly, because `chat/data/curriculum_serve_ledger.json` is absent — code-read.
+
+---
+
+## Capacity
+
+- **Designed:** an autonomous half that proposes and a reviewed half that ratifies, with volume flowing from curated material through formation into serving licenses.
+- **Measured — the binding constraint is throughput, and it is quantified.** Curriculum bands are **24×–73× short** of the entailed-bucket floor, and **no served subject has a family close enough to flag as "next."** Compounding this, ADR-0264 §4.1 establishes that the 16-premise compilation cap holds any band to ≤16 entailed cases, so **no curriculum band can earn SERVE until query-scoping lands** — an engineering blocker gating a content problem. Separately, distinct-evidence counting is unsound where replay is treated as independent trials: **21 of 25 ratified bands are short** on that basis (Wilson assumes independence; a replay is one trial).
+- **Ceilings:** HITL review is CLI-synchronous — the operator cannot review while the engine serves (W-009 open, L10-gated). Vocabulary extension is deliberately manual and slow; the position paper states this plainly as an open scaling question.
+
+---
+
+## Dependencies & provenance
+
+**receives** ← M4 (corrections), M3 (failures/refusals); **writes** → M1 (the promotion target; vault and packs); **gated-by** → MG (identity mutation forbidden; safety non-swappable); **evidenced-by** → MV (lanes, ledgers, CLAIMS); **blocked-by** → M6 (async HITL needs the process).
+
+---
+
+## Stage coverage
+
+| Stage | Verdict | Evidence |
+|---|---|---|
+| learn from reviewed correction | **covered** | Single reviewed path proven by two pinned loop-closure lanes; proposal-only discipline mechanically enforced |
+| replay/determinism | **covered** | Replay-equivalence gate on teaching chains; content-addressed, float-free, pickle-free hashing |
+| *(autonomous provisional learning)* | **covered, flag-gated** | CLOSE consolidation climbs to deductive-closure fixed point under proof-gating; **every relevant flag defaults OFF** (`consolidate_determinations`, `review_pending_proposals`, `review_derived_close_proposals`, `auto_contemplate`, `auto_proposal_enabled`, `vault_promotion_enabled`) |
+
+**Zone roster:** `L7-teaching`, `formation-curriculum`, `reliability-calibration`, `capability` ✱ (straddles MV; owned here).
+
+**Rollup note:** weakest-link rollup. M5's *mechanisms* are among the most rigorously built in the repository; its *volume* is the constraint. Do not read `partial-wiring-debt` as "the learning loop is unbuilt."
+
+---
+
+## Judgment
+
+**Fitness: `fit` on mechanism, `strained` on throughput.** The typed learning boundary is, in this assessor's reading, CORE's most distinctive and best-executed idea — it dissolves the usual "autonomy versus safety" trade-off rather than splitting it, which is the Third Door done correctly and worth naming as a success rather than only auditing for faults. The strain is entirely on the other side: a ratification pipeline that is architecturally sound and 24×–73× under-fed.
+
+**Honest wrinkles:**
+- **The autonomous half is built and switched off.** Six or more learning-related flags default `False`. The machinery for a self-improving loop exists, is proof-gated, and does not run by default. Whether that is correct caution or accumulated hesitancy is a ruling, not a finding — but the gap between "built" and "on" is the largest in this layer.
+- **A committed ledger is necessarily an *earning* one**, which makes the outcome-mix ruling the binding constraint — and the curriculum ledger does not exist yet. The one production `missing_ok=True` is honest and narrow, but it is load-bearing scaffolding.
+- **The Wilson independence problem is not cosmetic.** If replay is being counted as distinct evidence anywhere a license is earned, licenses are being granted on overstated evidence. 21/25 bands are affected. This deserves Phase 4 attention as a possible `wrong-solution` in the counting, not the gating.
+- Formation's trust-boundary table is exemplary — content-addressed in and out, no floats in hashed payloads, no pickle, every rejection audited. It should be the template other layers are measured against, and Phase 4 should check whether M2's ingest boundary meets the same bar.
+- `docs/teaching_order.md` records a known gap since 2026-05-17: the identity-divergence curriculum predates the formation pipeline and still flows through `runner.py` rather than Forge → Compose → Ratify → Promote. Unverified at this SHA; carried forward.
+
+**Open questions:**
+- Is the Wilson/replay independence defect actually granting licenses on overstated evidence? (→ Phase 4, then ruling)
+- Which autonomous-learning flags should be ratified ON, and on what evidence? (→ ruling)
+- Does M2's ingest boundary meet formation's trust-boundary bar? (→ Phase 2 M2 card / Phase 3)
+- Curriculum query-scoping: the engineering blocker gating all curriculum SERVE (→ ruling; ADR-0264 §4.1 names it)

docs/assessment/10-layer-cards/M6-continuity-process.md

@@ -0,0 +1,105 @@
+# M6 — Continuity & Process
+
+**Kind:** layer · **Parent:** CORE · **Assessor:** Opus 5 (Phase 2)
+**Verified at:** `8927c563` (2026-07-27)
+**Liveness:** `partial-wiring-debt` · **Fitness:** `strained` · **Topology role:** runtime boundary
+
+> The life itself. M6 is the layer that makes CORE an organism rather than a function call: a process that persists across time, accumulates capability across reboots, and resumes as *the same life*. Every other layer describes a capability; M6 describes the subject that has them. The foundational telos — "one continuous life" — is this layer's charter, and its condition is the single sharpest measure of the distance between what CORE is for and what CORE is.
+
+**Telos stages:** replay/determinism, backbone-runtime · hosts every other stage (the cycle's runner)
+**Macro role:** Holds field, vault, session, and identity continuity over indefinite time; runs the heartbeat that lets the engine learn when nobody is talking to it.
+
+---
+
+## ⚠️ Correction to Phase 0 Finding 0-C and to the system map
+
+**Phase 0 recorded that the L11 always-on process is unbuilt. That is wrong, and the error is instructive.**
+
+`chat/always_on.py::run_continuous` (279 lines) and `chat/always_on_daemon.py::run_daemon` (195 lines) exist and are reachable from the CLI as `core always-on` (`core/cli.py:244 cmd_always_on`). Both landed **2026-06-14** (`18e25580`, `efd280d4` / PR #758) — **five days after** the `.system-map/` snapshot of 2026-06-09 that declared "no forever entrypoint exists." Phase 0 inherited that claim without re-verification; Phase 2's re-verification obligation is exactly what caught it.
+
+This is the clearest possible vindication of schema principle P3 (stamped verification) and of the taxonomy's rule that the map is a prior, never a source. It also means the assessment's own worst risk is real: **a 48-day-old map is wrong precisely where the project moved fastest.** Every card in Phases 2–3 must assume the map is stale on anything load-bearing.
+
+What remains true from Phase 0: the **spike was never run to completion and never recorded**, and the built process is **ungated**. Those are the findings below, and they are different — and more actionable — than "unbuilt."
+
+---
+
+## What it is / What it does
+
+M6 is two halves at very different maturity, joined by a checkpoint.
+
+**The built half.** `engine_state/EngineStateStore` performs atomic checkpointing (same-dir temp → `fsync` → `os.replace`, mode-bits preserved) of the `RecognizerRegistry`, the `DiscoveryCandidate` working set, and a manifest, written at turn boundaries and reloaded on the next process start. A revision mismatch *warns and never refuses* — "reboot is recovery, not control flow." A `reboot_event` audit line records that a lifetime was lost and regained. On top of this sits `run_continuous`: an unbounded heartbeat loop where each beat advances `idle_tick` (continuous learning), records closure and learning evidence, self-checkpoints on real work, and checkpoints once at exit. `run_daemon` wraps it with a single-instance lock (one life per engine-state dir, lock file deliberately never unlinked), SIGINT/SIGTERM-wired `stop` checked before each beat and interrupting the inter-beat wait, and a load-time identity guard. A `lived_life.json` report feeds the Workbench's Lived Life surface.
+
+**The unbuilt half — restated correctly.** Not the process: the *proof*, the *gate*, and the *residency*. The 24h+ no-drift soak has a complete falsifiable harness (`evals/l10_always_on`, four predicates H1 closure / H2 bounded-idle / H3 convergence / H4 reboot-resume, each with `*_holds` and `*_bites` test pairs, plus `evals/l10_continuity`) and **has never been run to a recorded artifact**. And per ADR-0146 the T1 vault and field excitation remain deliberately ephemeral, so what compounds across reboots is the recognizer/discovery layer — not the recalled or excited substrate.
+
+---
+
+## Contract
+
+- **Inputs:** `DerivedRecognizer` objects, `DiscoveryCandidate` objects, `turn_count`, `CORE_ENGINE_STATE_DIR`, git short-revision, prior on-disk checkpoint.
+- **Outputs:** `engine_state/{recognizers,discovery_candidates}.jsonl`, `manifest.json`, `lived_life.json`, buffered `reboot_event`, restored working set, advisory `RuntimeWarning` on revision mismatch.
+- **Invariants:**
+  - Atomic checkpoint — crash between write and replace leaves the prior checkpoint intact — pin: `tests/test_adr_0146_engine_state.py` — suite: **none** — status: **not run by any suite**.
+  - Reboot round-trip byte-identity — state after (boot, N turns, reboot, reload) equals state after (boot, N turns) — pin: flagged by the system map as possibly *schema-as-decoration* — status: **unverified at this SHA**.
+  - Versor closure under long-horizon idle (`VERSOR_CEILING`) — pin: `tests/test_l10_always_on_soak.py` — suite: **none** — status: **not run by any suite**.
+  - One life per engine-state dir — pin: `tests/test_l10_always_on_daemon.py` — suite: **none**.
+
+---
+
+## Design vs build
+
+- **Design:** `docs/adr/L10-runtime-model-scope.md` (scope only — process shape, state partitioning, reboot recovery, async HITL left open), ADR-0146 (Shape B hybrid checkpoint chosen over Shape A daemon / Shape C audit replay), ADR-0156/0157/0158, `L11-hitl-async-queue-scope.md`. **The design record is now behind the code**: ADR-0146 explicitly *rejected* the Shape A daemon, and a daemon was subsequently built. No ADR ratifies `always_on_daemon.py`. That is a governance gap, not merely a documentation lag.
+- **Build:** `partial-wiring-debt`. Key files: `engine_state/__init__.py`, `chat/always_on.py`, `chat/always_on_daemon.py`, `core/cli.py::cmd_always_on`, `evals/l10_always_on/`, `evals/l10_continuity/`.
+- **Evidence:**
+  - Always-on loop and daemon exist and are CLI-reachable — code-read — `chat/always_on.py:179`, `core/cli.py:244` — would-fail-if-absent: **yes** (CLI command would not resolve).
+  - Falsifiable soak harness with holds/bites predicate pairs exists — code-read — `evals/l10_always_on/predicates.py`, `tests/test_l10_always_on_soak.py` — would-fail-if-absent: **yes**.
+  - Long-horizon no-drift result — **absent**. No JSON artifact under `evals/l10_always_on/` or `evals/l10_continuity/`. would-fail-if-absent: **n/a — the claim has no evidence**.
+  - Suite enforcement — **absent**. No `l10`/`always_on` test appears in any of the 21 `TEST_SUITES` tuples. would-fail-if-absent: **no — nothing runs these pins**.
+  - Persistence defaults — `persist_session_state=False`, `strict_identity_continuity=False` (`core/config.py:285,293`) — measurement — the continuity machinery is **off by default**.
+
+---
+
+## Capacity
+
+- **Designed:** an indefinitely-running single process holding field + vault + session without drift, contemplating in slack, resuming as the same life through interruption.
+- **Measured:** heartbeat loop runs for a bounded `heartbeats` count or until `stop`; checkpoint round-trip works at turn granularity; **no measured horizon exists** — the longest verified run is whatever the short soak tests exercise, and those run in no suite. The compounding surface is the recognizer/discovery layer only.
+- **Ceilings:** T1 vault and field excitation are discarded on exit **by design** (ADR-0146), so recall and excitation substrate reset every process. Cross-reboot `EngineIdentity` verification is shelved. Async HITL-while-serving is still CLI-synchronous (W-009 open).
+
+---
+
+## Dependencies & provenance
+
+- **feeds** → M4 (`ChatRuntime` is the sole consumer of the checkpoint store); **recalls-from** → M3 (recognizer registry) and M1/M5 (discovery candidates); **reads** → M1 (vault, deliberately ephemeral) and M0 (field, deliberately ephemeral); **verifies** → MV (round-trip byte-identity is a replay obligation); **depends-on** → MG (same-life identity continuity overlaps identity doctrine, not yet wired to the identity axes).
+- **Owning ADRs:** ADR-0146, ADR-0156, ADR-0157, ADR-0158, ADR-0220 (identity/build-provenance split); scopes `L10-runtime-model-scope.md`, `L11-hitl-async-queue-scope.md`. **Unowned:** `chat/always_on_daemon.py`.
+
+---
+
+## Stage coverage
+
+| Stage | Verdict | Evidence |
+|---|---|---|
+| backbone-runtime | **claimed-only** | Process exists and runs; no measured horizon, no suite-enforced pin, continuity flags default off |
+| replay/determinism | **claimed-only** | Round-trip byte-identity invariant flagged as possible schema-as-decoration; unverified at this SHA |
+| *(hosting the cycle)* | **covered, degraded** | `idle_tick` genuinely advances learning per beat; but what compounds is recognizers/discovery only — field and vault reset |
+
+**Zone roster:** `L10-11-runtime-identity` (partial-wiring-debt → **revised: build materially more complete than mapped**), `engine-state` (live-internal, confirmed), `edge-sync` (inert, not re-verified), `core-protocol-ctp` (spike, not re-verified).
+
+**Rollup note:** zone liveness is a weakest-link rollup and is not a completion rate. M6 is better built than either the map or Phase 0 reported, and *less proven* than the existence of the code suggests. Those are not in tension — they are the layer's actual condition.
+
+---
+
+## Judgment
+
+**Fitness: `strained`.** Not `wrong-solution`: Shape B checkpointing is a sound mechanism, and the daemon built on top of it is a reasonable shape. Strained because the layer's *proof obligations* have not kept pace with its *code*, and because its central design document still rejects the architecture that was subsequently built. A layer whose invariants are pinned by tests that no suite runs is protected by nothing.
+
+**Honest wrinkles:**
+- The most telos-critical component in CORE is enforced by **zero running tests**. Every `l10`/`always_on` pin sits outside all 21 suites. By the project's own doctrine (a pin in no suite never runs), the continuous life is unguarded.
+- **`DriveGradientMap` is constructed and never read.** `chat/runtime.py:716` builds `self._drive_map`; no site reads it. Deleting it would change no output. This is textbook decoration and is recorded here rather than fixed.
+- `ExertionMeter` *is* exercised (`record` at :2912, `fatigue` at :2913) but its output flows only to `drive_summaries` and `fatigue_index` — telemetry. Fatigue **gates no decision**. It is live-internal, not load-bearing.
+- The daemon has no ratifying ADR while the governing ADR-0146 explicitly rejected the daemon shape. Whatever the right answer, the record currently contradicts the code.
+- "One continuous life" remains, in substance, *many short lives sharing a recognizer checkpoint* — but the reason is now a **deliberate ADR-0146 scoping decision** about vault/field ephemerality, not an absence of process machinery. That reframes the L10 question entirely: it is no longer "build the process" but "decide what the process is allowed to hold."
+
+**Open questions:**
+- Run the long-horizon soak and record the artifact — what horizon does the engine actually survive? (→ ruling: this is the ADR-0146 Phase-4 spike, still owed)
+- Should `l10`/`always_on` pins enter a suite, and which? (→ Phase 4)
+- Does the daemon need a ratifying ADR that supersedes ADR-0146's Shape-A rejection? (→ ruling)
+- Is vault/field ephemerality still the right call now that a real process exists to hold them? (→ ruling; this is the highest-value M6 question)

docs/assessment/10-layer-cards/MG-governance-identity.md

@@ -0,0 +1,89 @@
+# MG — Governance & Identity (cross-cutting)
+
+**Kind:** layer (cross-cut) · **Parent:** CORE · **Assessor:** Opus 5 (Phase 2)
+**Verified at:** `8927c563` (2026-07-27)
+**Liveness:** `live-serving` · **Fitness:** `fit` (with one `strained` region) · **Topology role:** runtime boundary + reviewed pack data
+
+> Who the system is, and what it will not do. MG is cross-cutting because a governance mechanism obeyed by only one layer is not governance — it is a feature. Its philosophical charge is the alignment thesis stated geometrically: keep behavior inside an intended region of possibility space *by construction*, so that alignment is a structural property of the manifold rather than a filter applied to output. The load-bearing asymmetry is that identity and ethics are swappable while safety is not.
+
+**Telos stages:** articulate (governs the served surface), replay/determinism (verdicts are evidence)
+**Macro role:** Constrains every layer's behavior to an identity- and safety-consistent region, and refuses in typed form when it cannot.
+
+---
+
+## What it is / What it does
+
+Four pack families with deliberately different mutability. **Safety** (`packs/safety/`) is **never swappable and fail-closed** — five boundaries present in every manifold; a `SafetyVerdict` violation produces a deterministic typed refusal. **Identity** (`packs/identity/`) is swappable; ship default `default_general_v1`; the manifold is loaded from `packs/identity/<pack_id>.json`. **Ethics** (`packs/ethics/`) is swappable with opt-in typed refusal. **Register/anchor-lens** packs shape expression without moving truth.
+
+Identity scoring is **wave-only and fail-closed** (ADR-0244 §3, INV-32): `IdentityCheck.check(trajectory, manifold, wave_field=...)` requires an explicit Cl(4,1) wave field; absence raises typed `MissingWaveStateError`, malformed fields raise `ValueError`, and the scalar-L2 dual-mode fallback has been **excised** and may not be reintroduced. Crucially, live *refusal* remains flag-gated (`identity_wave_gate`, default **off**, explicitly *not authorized*) — the flag controls refusal only, never the scoring path.
+
+The identity contract is protective in both directions: a flagged score must not silently erase useful generation absent an explicit, tested hard-block policy; and **identity-manifold mutation by user prompt or correction is forbidden**, with identity-override attempts *rejected, not learned*. Adversarial override probes are seeded before the concepts they protect (`docs/teaching_order.md` layer 1).
+
+---
+
+## Contract
+
+- **Inputs:** trajectory + final wave field from M3/M4, mounted identity/safety/ethics/register packs, session identity path.
+- **Outputs:** `IdentityScore` (with `flagged`), `SafetyVerdict`, `EthicsVerdict`, typed refusals, hedge injection, `TurnVerdicts`.
+- **Invariants:**
+  - **INV-32** — identity scoring is wave-only; no scalar-L2 fallback exists — pins: `tests/test_stage2_physics_hardening.py` (excised symbols absent), `tests/test_adr_0244_identity_gate_runtime.py`.
+  - Identity manifold is never mutated by prompt or correction; override attempts rejected, not learned.
+  - Safety pack is never swappable; violation → deterministic typed refusal.
+  - Hedge injection is exclusive with refusal (never both).
+  - No epistemic seal: no `final`/`frozen`/`axiom`/`permanent` flag may exist (shared with M1's non-hardening invariant).
+
+---
+
+## Design vs build
+
+- **Design:** ADR-0027 (identity packs), ADR-0244 (wave-field identity manifold and inalienable geometric alignment), ADR-0246 (induced identity action and path integrity), ADR-0010 (identity physics — the mind-physics blueprint element that *did* land), ADR-0220 (engine identity split from build provenance), `docs/identity_packs.md`, `docs/safety_packs.md`, `docs/ethics_packs.md`, `docs/refusal-taxonomy.md`, `docs/position_paper.md` §6.
+- **Build:** `live-serving`. Key files: `packs/safety/check.py`, `packs/identity/loader.py`, `packs/ethics/check.py`, `core/physics/identity.py`, `core/physics/identity_manifold.py`, `core/physics/identity_action.py`.
+- **Evidence:**
+  - Safety and identity are constructed and consulted on the live serving path — code-read — `chat/runtime.py:93,104-105` (`load_identity_manifold`, `SafetyCheck`, `load_safety_pack`) — would-fail-if-absent: **yes**.
+  - Scalar-L2 fallback is excised and its absence is pinned — pin — `tests/test_stage2_physics_hardening.py` — would-fail-if-absent: **yes** (a reintroduced symbol fails the pin).
+  - Identity protection under adversarial input is claimed and evidenced in `docs/position_paper.md` §4 with an eval lane (`evals/identity_divergence/`) — lane.
+  - Three merged authority demos (claims / proposed tool actions / epistemic-state assignment) — `docs/position_paper.md`, PRs #687/#688/#690.
+
+---
+
+## Capacity
+
+- **Designed:** alignment as a structural property — the system cannot leave the intended region because the geometry does not admit it.
+- **Measured:** identity scoring is metric-exact geometry (Gram / operator-preservation) on every turn; refusal is typed and taxonomized; five safety boundaries present in every manifold.
+- **Ceilings:** **live identity *refusal* is off.** `identity_wave_gate` defaults `False` and is documented as "not authorized" — so identity currently *scores and flags* but does not *block*. Likewise `identity_action_surface=False` and `strict_identity_continuity=False`.
+
+---
+
+## Dependencies & provenance
+
+**governs** → M4 (surface), M3 (what may be concluded), M5 (identity mutation forbidden); **reads** → M1 (packs), M0 (wave field, Gram geometry); **evidenced-by** → MV; **overlaps** → M6 (same-life continuity across reboot).
+
+---
+
+## Stage coverage
+
+| Stage | Verdict | Evidence |
+|---|---|---|
+| articulate (governance of) | **covered** | Safety/ethics/identity consulted on the live path; typed refusal; hedge injection |
+| *(identity enforcement)* | **claimed-only** | Scoring is live and fail-closed; **blocking is flag-gated off and unauthorized** |
+
+**Zone roster:** `governance-identity-safety` (live-serving, **confirmed** by serving-path imports); `L9-epistemic-verdicts` ✱ (owned by M4, cross-referenced here).
+
+**Rollup note:** the only macro layer besides M4 that the map rates `live-serving` at zone level, and re-verification supports it.
+
+---
+
+## Judgment
+
+**Fitness: `fit`, with the enforcement region `strained`.** The design here is the strongest expression of CORE's alignment thesis: making safety non-swappable while identity and ethics are swappable is a genuine structural distinction rather than a policy label, and excising the scalar fallback outright — rather than deprecating it — is the correct response to a dual-mode hazard. The `strained` region is enforcement: the machinery is built, hardened, pinned, and **not switched on**.
+
+**Honest wrinkles:**
+- **Identity flags but does not block.** The gate is default-off and explicitly *not authorized*, which is an honest and deliberate posture — but it means the strongest claim in the alignment story ("behavior stays in the intended region") is, at runtime today, a *measurement* rather than a *constraint*. The distinction between scoring and refusing must be stated precisely wherever this capability is described externally; `runtime_contracts.md` does state it precisely, and this card records it so no downstream summary blurs it.
+- Cross-cutting writ is asserted but not mechanically verified. I found no pin that would fail if some layer *bypassed* governance — as distinct from pins that verify governance works when called. For a cross-cutting layer that is the invariant that matters most, and its absence is the analogue of M1's unverified no-approximate-recall pin. Flagged for Phase 3.
+- Safety's non-swappability is doctrine plus loader design; whether a *test* fails on an attempt to swap the safety pack was not verified at this SHA.
+- MG is where CORE's most defensible public claims live. That makes precision about flag state a reputational as well as a technical obligation.
+
+**Open questions:**
+- Is there a pin that fails when a layer bypasses governance entirely? (→ Phase 3)
+- Under what evidence should `identity_wave_gate` be authorized live? (→ ruling)
+- Is safety-pack non-swappability mechanically enforced or loader-conventional? (→ Phase 3)

docs/assessment/10-layer-cards/MV-verification-evidence.md

@@ -0,0 +1,90 @@
+# MV — Verification & Evidence (cross-cutting)
+
+**Kind:** layer (cross-cut) · **Parent:** CORE · **Assessor:** Opus 5 (Phase 2)
+**Verified at:** `8927c563` (2026-07-27)
+**Liveness:** `partial-wiring-debt` · **Fitness:** `strained` · **Topology role:** benchmark/eval artifact + tooling surface
+
+> How CORE knows what it knows about itself. MV is cross-cutting because replay is a *property* of every layer and an *apparatus* of this one. Its philosophical charge follows directly from the thesis: a decoding system's failures are locatable, so the machinery that locates them is not overhead — it is the difference between a structured failure that can be fixed and a stochastic one that can only be regularized. MV is also the layer this assessment most depends on, and therefore the one whose gaps most threaten the assessment's own conclusions.
+
+**Telos stages:** replay deterministically (primary); learn (evidence for calibration)
+**Macro role:** Produces the evidence that every other layer's claims are measured against, and fails loudly when a claim drifts.
+
+---
+
+## What it is / What it does
+
+`evals/` (375 modules) holds the lane runners and their contracts. `tests/` (881 modules) holds the pins. `core/cli_test.py` defines **21 suites** as hand-curated tuples — `fast, smoke, runtime, cognition, teaching, packs, algebra, sensorium, pulse, formation, proof, refusal, margin, rotor, inner-loop, phase5, phase6, adr-0024, math, deductive, full`. `CLAIMS.md` is machine-generated from in-tree state: Tier 1 = five ratified domains from `core.capability.ledger_report`; Tier 2 = eleven lanes pinned by report SHA-256, where mismatch is a CI failure. `workbench/` (22 modules) is the read-only operator/auditor projection. `scripts/verify_lane_shas.py` is the Tier-2 verifier.
+
+The validation doctrine is **local-first**: the in-worktree run is the merge bar (`uv run core test --suite smoke -q` pre-push, larger suites pre-merge, `[Verification]:` on the PR). A pre-push hook runs smoke **plus** the `warmed_session` consistency lane pin, deliberately targeted at a regression class smoke does not cover. `scripts/ci/local-ci.sh` reads suite membership *from the CLI* rather than restating it, so the runner cannot drift from the hook. The interpreter contract is fail-closed: `requires-python == "3.12.13"` exactly, and a degraded run stamps itself **NON-CANONICAL** on every line — a degraded run is legitimate, a degraded run reporting itself as the real thing is not.
+
+---
+
+## Contract
+
+- **Inputs:** every other layer's runtime behavior; lane runners; pinned SHAs.
+- **Outputs:** lane reports (JSON), `CLAIMS.md` rows, `trace_hash`, `CognitivePipelineRecord`, telemetry events, capability ledger, `[Verification]:` evidence.
+- **Invariants:**
+  - Tier-2 lane report SHA-256 must reproduce byte-for-byte; drift is a CI failure and demotes the claim.
+  - Replay treats `pipeline_record` as **critical evidence** — divergence is evidence against equivalence, not wall-clock noise.
+  - Pre-widening journal rows must show `missing_evidence`, never a synthesized green pipeline.
+  - `derive_evidence_digest` is deterministic in field order; re-running against on-disk lane results reproduces `claim_digest`.
+  - Unknown lane ids **fail closed** (`lane <id> has no registered shape — introduce via ADR amendment`); a broken `reviewers.yaml` yields an empty registry rather than silently granting `audit_passed=true`.
+
+---
+
+## Design vs build
+
+- **Design:** ADR-0092/0093/0096/0098/0099 (registry, contract validation, fabrication control, demo composition, public demo), ADR-0106/0109 (expert-demo promotion, lane-shape registry), ADR-0119.x (GSM8K lane + seal discipline), ADR-0167 (audit-as-evidence), `docs/testing-lanes.md`, `docs/eval_methodology.md`, `AGENTS.md` §Local-First CI Validation Protocol.
+- **Build:** `partial-wiring-debt`.
+- **Evidence:**
+  - Eleven Tier-2 lanes carry pinned SHAs verified by CI — `CLAIMS.md` + `.github/workflows/lane-shas.yml` — would-fail-if-absent: **yes**.
+  - Suite membership is read from the CLI by the local runner, so hook and runner cannot diverge — code-read — `scripts/ci/local-ci.sh` — would-fail-if-absent: **yes**.
+  - Fabrication-control lane enforces per-class `refused == n, fabricated == 0` — lane shape — `core/capability/expert_demo.py` — would-fail-if-absent: **yes**.
+  - Sealed holdout discipline: 1,319 GSM8K cases age-encrypted, plaintext never on disk, no CI workflow sets `CORE_HOLDOUT_KEY`, team operates blind — code-read + contract.
+  - **Suite coverage is incomplete in a load-bearing way** — measurement — no `l10`/`always_on` test appears in any of the 21 suite tuples (see M6).
+
+---
+
+## Capacity
+
+- **Designed:** every claim mechanically derived from in-tree state and verified by CI.
+- **Measured:** 21 suites; 881 test modules; 11 SHA-pinned lanes; 5 Tier-1 domains; `deductive` suite at 20 files, `smoke` at 23, `sensorium` at 21, `algebra` at 15. The full ~12k fast-lane runs async by design so the pre-push hook stays targeted rather than gridlocking the push cycle.
+- **Ceilings:** the smoke gate is not the full suite — a PR's own tests must be run against the rebased base pre-merge, which is process discipline rather than mechanism. Remote Actions are secondary observability only; GitHub mirror Actions are billing-locked dead signals. Roughly 31 red tests were retired historically. The sealed GSM8K holdout has never been opened against a parser with sufficient coverage.
+
+---
+
+## Dependencies & provenance
+
+**witnesses** → every layer; **reads** → M5 (capability ledger, reviewer registry), M4 (telemetry, trace); **constrains** → M0 (bit-exact parity pins).
+
+---
+
+## Stage coverage
+
+| Stage | Verdict | Evidence |
+|---|---|---|
+| replay deterministically | **covered** | Tier-2 SHA pinning is mechanical and fails CI on drift; pipeline record is critical replay evidence |
+| *(evidence for learning)* | **covered** | Sealed practice ledgers, capability ledger, lane-shape registry all fail closed on unknown shapes |
+| *(coverage of the telos-critical layer)* | **uncovered** | No suite runs any L10/always-on pin |
+
+**Zone roster:** `evals-determinism`, `tooling-cli-workbench-rs`; `capability` ✱ (owned by M5, cross-referenced here).
+
+**Rollup note:** weakest-link rollup. MV's *mechanisms* for the things it covers are excellent; its *coverage map* has a hole at precisely the layer with the least other protection.
+
+---
+
+## Judgment
+
+**Fitness: `strained`.** MV's design instincts are consistently right — machine-generated claims, fail-closed registries, SHA pinning, a non-canonical stamp for degraded runs, suite membership read rather than restated. These are the habits of a system that expects to be wrong and wants to find out. The strain is structural rather than qualitative: **suite membership is hand-curated**, so coverage is a curation artifact, and nothing detects the *absence* of a pin from every suite. That is how the most telos-critical layer in CORE came to be enforced by nothing while its tests exist and pass on demand.
+
+**Honest wrinkles:**
+- **The hole is where it hurts most.** M6 has a complete falsifiable soak harness with holds/bites predicate pairs — genuinely excellent test design — that no suite runs. The tests are not weak; they are *unscheduled*. A hand-curated suite list has no mechanism to notice.
+- **There is no meta-pin for coverage.** The project has learned "a pin in no suite never runs" as doctrine, but nothing mechanically enforces it. A test file that belongs to zero suites is currently indistinguishable from a test file that runs everywhere. This is, in this assessor's reading, MV's single highest-leverage improvement and a strong Phase 4 Third-Door candidate: rather than curating harder, make orphaned pins detectable.
+- The gap registers this layer ought to feed are dead (Phase 0 Finding 0-D): `docs/gaps.md` is 26/26 closed, the liveness ratchet is L10-blocked and stale, and `docs/analysis/` is a chronological archive of ~130 documents with no aggregator. MV produces excellent point-in-time evidence and has no standing instrument that accumulates it.
+- Long-horizon evidence has no home. The soak harness's `__main__` exists; no results artifact does. Lanes are pinned by SHA precisely because point-in-time reports drift — but a lane nobody runs produces no report to pin.
+- MV's honesty machinery (`missing_evidence`, NON-CANONICAL stamping, fail-closed unknown lanes) is a genuine model for the rest of the system and should be cited as such in Phase 5 rather than only audited.
+
+**Open questions:**
+- Add a meta-pin asserting every `tests/*.py` belongs to ≥1 suite (or an explicit exclusion list)? (→ Phase 4; likely highest-leverage single change in MV)
+- Which suite should own the L10/always-on pins, given they are soaks? (→ Phase 4 / ruling)
+- Should the assessment's gap register become the standing instrument MV lacks? (→ Phase 4)