chore(delivery): consolidate 31 queued green slices into one landing vehicle (#175)

.github/workflows/docs-quality.yml

@@ -2,12 +2,18 @@ name: Documentation Quality
 
 on:
   pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - ready_for_review
     paths:
       - "**/*.md"
       - "**/*.json"
       - ".github/workflows/**"
       - "scripts/validate_documentation.py"
       - "tests/quality/test_validate_documentation.py"
+      - "crates/**"
   push:
     branches:
       - main
@@ -17,6 +23,7 @@ on:
       - ".github/workflows/**"
       - "scripts/validate_documentation.py"
       - "tests/quality/test_validate_documentation.py"
+      - "crates/**"
   workflow_dispatch:
 
 permissions:

.gitignore

@@ -7,3 +7,5 @@ __pycache__/
 *.py[cod]
 .pytest_cache/
 /.codegraph/
+node_modules/
+origin/

ARCHITECTURE.md

@@ -53,16 +53,16 @@ boundaries above remain the target modular MSA architecture.
 |---|---|
 | `evidence_core` | immutable evidence domain primitives |
 | `semantic_core` | span-grounded semantic units; language is not identity |
+| `location_membership` | location is not entity identity and not a language channel |
 | `temporal_core` | typed clocks, intervals, and temporal reasoning |
-| `event_core` | event instances, mentions, roles, and provenance |
+| `event_core` | event instances, mentions, roles, provenance, and CHRONOS occurrence-prediction calibration |
 | `relation_graph` | typed relations and forward-transition validation |
 | `membership_core` | time-varying cross-classified multiple membership, Kish ESS, nested ICC with non-nested refusal |
 | `persistence_postgres` | PostgreSQL repositories and migrations |
 | `corpus_split` | cutoff-safe, relation-aware partitioning |
 | `tepp_simulation` | known-truth temporal/event data generation |
-| `validation_core` | RMSE, bias, coverage, graph, and Monte Carlo metrics |
+| `validation_core` | RMSE, bias, coverage, graph, Monte Carlo, and exact-head claim-promotion metrics |
 | `tepp_api` | versioned DTO, schema, and export contracts |
-| `location_membership` | location is not entity identity and not a language channel |
 | `prompt_source` | prompt boilerplate is not unique latent content and not stopword deletion |
 | `corpus_background` | corpus-background wording is not unique latent content and not stopword deletion |
 | `modality_source` | non-lexical modality is not unique latent content and not stopword deletion |
@@ -99,12 +99,18 @@ boundaries above remain the target modular MSA architecture.
 | `interpretation_gateway` | evidence-bounded LLM interpretations; not estimators or observed facts |
 | `model_selection` | statistical/Pareto candidate-`K` gates; LLM votes are not numerical authority |
 | `checkpoint_authority` | a model checkpoint is not the CPU `f64` estimator |
+| `compute_backend` | VRAM-budgeted streamed planning, executable OOM retry plans, and a compensated CPU `f64` reference |
+| `episode_membership` | episode membership cannot escape the episode event-time interval |
 | `membership_target` | language, episode, template, department, and opportunity-pool targets cannot collapse into entity or project |
 
 
 Foundation crates expose only tested contracts. Empty façades are not public
 APIs.
 
+No crate exposes placeholder production behavior in Task 1. This prevents an
+empty façade from becoming a de facto public API before its invariants and tests
+exist.
+
 ## Immutable evidence boundary
 
 Task 2 begins the executable `evidence_core` boundary. Stable RFC 9562 `UUIDv7`
@@ -158,6 +164,8 @@ TEPP stores event/valid time, assertion time, document time, system time, availa
 \operatorname{available\_time}(d) \leq \operatorname{knowledge\_cutoff}.
 \]
 
+When availability is an interval, every possible instant in that interval must satisfy the inequality. Unknown or open-ended availability that can extend past the cutoff fails closed; event time and document time cannot substitute for availability.
+
 Forward transition edges require a temporally valid partial order. Retrospective, revision, translation, citation, support, and contradiction relations retain their direction and provenance but do not create reverse state transitions.
 
 ## Measurement invariants

CHANGELOG.md

@@ -34,16 +34,12 @@ All notable changes to TEPP are documented here. The format follows Keep a Chang
 - `stopword_deletion` method gate: a default or global stopword list cannot erase repeated report language; recovered deletion kinds match known truth at a higher computed rate than collapsing every token treatment to stopword deletion (ADR 0004/0012).
 - `persistence_postgres` retention/deletion/legal-hold (migration `0007`): policy rows, legal holds that block completed deletion, evidence tombstones without raw-source restore, analysis exclusion only for `logical_revocation`/`identity_tombstone` (not `cache_export_removal`), and deletion requests bound to the cited retention policy's tenant/class/purpose.
 - `copy_identity` identity gate: a template or pasted copy cannot reuse the source document identity or become a state transition; recovered copy kinds match known truth at a higher computed rate than collapsing every copy to the source (ADR 0003).
-- `persistence_postgres` retention/deletion/legal-hold (migration `0007`): policy rows, legal holds that block completed deletion, evidence tombstones without raw-source restore, analysis exclusion only for `logical_revocation`/`identity_tombstone` (not `cache_export_removal`), and deletion requests bound to the cited retention policy's tenant/class/purpose.
 - `provider_receipt` disclosure receipt: records provider field codes and
   purpose-bound receipt metadata without persisting source text or source
   identity (ADR 0009).
 - `intake_authorization` identity gate: documents, serialized records, checkpoints, and LLM outputs cannot be accepted without a purpose-bound grant; size/identity/provenance bounds are not that grant; recovered grant-presence flags match known truth at a higher computed rate than accepting every intake (ADR 0009).
-- `persistence_postgres` retention/deletion/legal-hold (migration `0007`): policy rows, legal holds that block completed deletion, evidence tombstones without raw-source restore, analysis exclusion only for `logical_revocation`/`identity_tombstone` (not `cache_export_removal`), and deletion requests bound to the cited retention policy's tenant/class/purpose.
 - `summarizes_edge` identity gate: a summary may point to earlier event time but cannot become a state transition or reuse the source document identity; recovered summary kinds match known truth at a higher computed rate than collapsing every summary to the source (ADR 0003).
-- `persistence_postgres` retention/deletion/legal-hold (migration `0007`): policy rows, legal holds that block completed deletion, evidence tombstones without raw-source restore, analysis exclusion only for `logical_revocation`/`identity_tombstone` (not `cache_export_removal`), and deletion requests bound to the cited retention policy's tenant/class/purpose.
 - `outcome_order` identity gate: `input_to` and `process_to` cannot move backward or stay contemporaneous in event-time rank; `outcome_of` may point at an earlier producer and cannot become a state transition; recovered kinds match known truth at a higher computed rate than collapsing every kind to `input_to` (ADR 0002/0003).
-- `persistence_postgres` retention/deletion/legal-hold (migration `0007`): policy rows, legal holds that block completed deletion, evidence tombstones without raw-source restore, analysis exclusion only for `logical_revocation`/`identity_tombstone` (not `cache_export_removal`), and deletion requests bound to the cited retention policy's tenant/class/purpose.
 - `retrospective_edge` identity gate: retrospective reporting may point to earlier event time but cannot become a state transition or a translation; recovered reporting kinds match known truth at a higher computed rate than collapsing every report to a contemporaneous forward report (ADR 0002/0003).
 - `payload_bound` identity gate: documents, serialized records, model checkpoints, and LLM outputs stay untrusted until identity, provenance, size, and depth validate; recovered accept/reject flags match known truth at a higher computed rate than accepting every payload (ADR 0008/0013).
 - `inferred_status` identity gate: inferred relations cannot be promoted to observed evidence or to state transitions; recovered observed/inferred labels match known truth at a higher computed rate than treating every status as observed (ADR 0003).
@@ -86,9 +82,38 @@ All notable changes to TEPP are documented here. The format follows Keep a Chang
   not required; this PR is implemented-main`). Only never/do not/does not/
   cannot/must not plus promote/treat/make/mean counts as a promotion denial.
 - `checkpoint_authority` estimator gate: a model checkpoint remains an untrusted run artifact until identity, canonical `SHA-256`, and model-run provenance validate, and it cannot replace the CPU `f64` estimator or promote a scientific claim; recovered roles match known truth at a higher computed rate than collapsing every artifact to the estimator (ADR 0001/0014).
-- `persistence_postgres` retention/deletion/legal-hold (migration `0007`): policy rows, legal holds that block completed deletion, evidence tombstones without raw-source restore, analysis exclusion only for `logical_revocation`/`identity_tombstone` (not `cache_export_removal`), and deletion requests bound to the cited retention policy's tenant/class/purpose.
 - `event_core` now requires and retains `EventEvidenceLayer::PromotedTransition` when constructing an `EventInstance`; every other layer is rejected at the promotion boundary, and TDT story classification uses a caller-owned hash set for expected constant-time membership checks.
 - `event_core` ADR 0016 evidence-status gates: TDT detections and CHRONOS predictions cannot admit a forward state transition; first-story detection scores miss/false-alarm rates against a known story stream (Allan 2002 task).
+- `compute_backend` ADR 0006 first slice: VRAM profiles and reserve-aware micro-batching, executable successive OOM retry plans, CPU fallback, compensated `f64` reference arithmetic with scale-aware parity tolerance, grouped adaptation policies, and fail-closed estimand-preserving memory policies.
+- `validation_core` ADR 0014 claim-promotion gates: `decision_accepted`, `implemented_main`, `scientifically_supported`, and `released` bind to an exact commit SHA; queued, predecessor, skipped-required, and LLM evidence fail closed; scientific promotion uses computed RMSE and its standard error rather than a hardcoded threshold (no new migration).
+- `relation_graph` causal-identification gate: only `causes` and `intervenes_on` may be described as causal; association, temporal precedence, production, and provenance fail closed.
+- `temporal_core` interval-aware historical eligibility: `evaluate_historical_eligibility` admits an `AvailableTime` interval only when every possible availability instant is at or before `KnowledgeCutoff`; unknown and open-ended upper availability fail closed, and event/document time cannot be substituted.
+- `event_core` TDT tracking contracts: hypothesized track assignments, fail-closed duplicate mentions, refusal to treat a track as an instance or state transition, and computed pair precision/recall, identity-switch rate, and RMSE against known-truth assignments.
+- `event_core` CHRONOS schema-slot gate: predicted role fillers stay distinct from promoted instances and transitions, slot precision/recall are computed from known-truth fills, and production label/confidence APIs produce calibrated occupancy RMSE ≈ 0.1411 versus always-fill ≈ 0.7071 in the contract fixture.
+- `event_core` TDT story-segmentation contracts: ordered unit partitions, fail-closed empty/mismatched windows, refusal to treat a detected story cut as an instance or state transition, and computed `WindowDiff`, `Pk`, boundary precision/recall, plus RMSE against known-truth boundaries.
+- `event_core` CHRONOS occurrence-prediction calibration: forecasts stay hypothetical, refuse promotion to event instances, and recover a computed Brier score against later-observed occurrence truth, with empty or mismatched streams failing closed.
+- `persistence_postgres` entity/project target SQL: fail-closed insert/lookup for `entity_record` and `project_record` so membership foreign keys cannot be seeded from empty, oversized, or hostile type/status labels. No new migration number (ADR 0003 / ADR 0013).
+- `cutoff_clock` identity gate: event time, system time, and availability time cannot stand in for knowledge cutoff; recovered cutoff stamps match known truth at a higher computed rate than treating every stamp as availability time (ADR 0002).
+- `assertion_clock` identity gate: event, system, document, and availability time cannot stand in for assertion time; recovered assertion stamps match known truth at a higher computed rate than treating every stamp as event time (ADR 0002).
+- `event_clock` identity gate: assertion, system, document, and availability time cannot stand in for event/valid time; recovered event stamps match known truth at a higher computed rate than treating every stamp as assertion time (ADR 0002).
+- `system_clock` identity gate: event, assertion, document, availability, and knowledge-cutoff time cannot stand in for system time; recovered system stamps match known truth at a higher computed rate than treating every stamp as event time (ADR 0002).
+- `support_edge` identity gate: support, contradiction, summary, and `outcome_of` edges cannot become state transitions; recovered evidential kinds match known truth at a higher computed rate than collapsing every kind to support (ADR 0002/0003).
+- `inferred_status` identity gate: inferred relations cannot be promoted to observed evidence or to state transitions; recovered observed/inferred labels match known truth at a higher computed rate than treating every status as observed (ADR 0003).
+- `payload_bound` identity gate: documents, serialized records, model checkpoints, and LLM outputs stay untrusted until identity, provenance, size, and depth validate; recovered accept/reject flags match known truth at a higher computed rate than accepting every payload (ADR 0008/0013).
+- `outcome_order` identity gate: `input_to` and `process_to` cannot move backward or stay contemporaneous in event-time rank; `outcome_of` may point at an earlier producer and cannot become a state transition; recovered kinds match known truth at a higher computed rate than collapsing every kind to `input_to` (ADR 0002/0003).
+- `summarizes_edge` identity gate: a summary may point to earlier event time but cannot become a state transition or reuse the source document identity; recovered summary kinds match known truth at a higher computed rate than collapsing every summary to the source (ADR 0003).
+- `provider_receipt` disclosure receipt: records provider field codes and
+  purpose-bound receipt metadata without persisting source text or source
+  identity (ADR 0009).
+- `intake_authorization` identity gate: documents, serialized records, checkpoints, and LLM outputs cannot be accepted without a purpose-bound grant; size/identity/provenance bounds are not that grant; recovered grant-presence flags match known truth at a higher computed rate than accepting every intake (ADR 0009).
+- `copy_identity` identity gate: a template or pasted copy cannot reuse the source document identity or become a state transition; recovered copy kinds match known truth at a higher computed rate than collapsing every copy to the source (ADR 0003).
+- `stopword_deletion` method gate: a default or global stopword list cannot erase repeated report language; recovered deletion kinds match known truth at a higher computed rate than collapsing every token treatment to stopword deletion (ADR 0004/0012).
+- `episode_membership` identity gate: a document's episode membership cannot start before or end after the episode event-time interval; recovered containment flags match known truth at a higher computed rate than accepting every membership (ADR 0003).
+- `style_source` identity gate: house-voice style residue is not unique latent content and is not erased by a stopword list; recovered style kinds match known truth at a higher computed rate than collapsing every token to unique content (ADR 0004/0012).
+- `modality_source` identity gate: non-lexical modality is not unique latent content and is not erased by a stopword list; recovered modality kinds match known truth at a higher computed rate than collapsing every token to unique content (ADR 0004/0012).
+- `corpus_background` identity gate: corpus-level background wording is not unique latent content and is not erased by a stopword list; recovered background kinds match known truth at a higher computed rate than collapsing every token to unique content (ADR 0004/0012).
+- `prompt_source` identity gate: instruction and prompt boilerplate is not unique latent content and is not erased by a stopword list; `identity_recovery_rate` reports exact kind matches, with a contract test comparing correct recovery with an all-unique collapse on a mixed known-truth fixture (ADR 0004/0012).
+- `location_membership` identity gate: geographic and market assignments are time-varying memberships, not permanent entity identity and not language channels; recovered location kinds match known truth at a higher computed rate than collapsing every assignment to entity identity (ADR 0003).
 - `membership_target` identity gate: language, episode, template, department, and opportunity-pool memberships cannot collapse into the entity/project pair stored by migration `0006`; comparison-contract tests record recovered target kinds against an entity-collapse baseline (ADR 0003).
 
 - `tepp_api` naruon live loopback HTTP/1.1 listener: `serve_one` installs a read/write deadline, requires a loopback `Host`, refuses `Transfer-Encoding` and NIM/proxy credential headers, parses `knowledge_cutoff` as RFC 3339 and refuses a future cutoff, keys analysis-run idempotency by tenant plus key, and proves both analysis-run and export POSTs over a real `TcpStream`. Not a production TLS/`$PORT` service (ADR 0011).
@@ -187,8 +212,12 @@ All notable changes to TEPP are documented here. The format follows Keep a Chang
   head SHA to that exact-head register, including #201 `6afd650667e1` (RFC 5646
   cited once; first GAP-005 slice, not implemented-main), stacked drafts
   #202–#204, and #164 `ff2e645b1785` as the predecessor register head. Duplicate
- PR #179 remains closed. Stacked-merged heads and queued Checks are not
- implemented-main.
+  PR #179 remains closed. Stacked-merged heads and queued Checks are not
+  implemented-main.
+- Removed the completed one-shot PR #51 repair job from `docs-quality.yml`; the
+  workflow no longer invokes deleted repair scripts or requests write authority
+  after the executable compute implementation is already present.
+- `persistence_postgres` entity and project target inserts now bind their tenant session context before rendering SQL, keeping `FORCE ROW LEVEL SECURITY` behavior consistent with every other tenant-scoped write; live coverage still proves raw wrong-tenant rejection.
 - Clarified ADR 0001 so it owns Rust-first numerical/reference-backend authority while ADR 0011 owns cross-service MSA/service authority.
 - Clarified ADR 0006 so it owns GPU/VRAM and model-credential boundaries; ADR 0010 now owns LLM orchestration policy and ADR 0015 owns autonomous repository-write/review/merge authority.
 - Expanded ADR 0002–0005 and 0009–0011 with explicit implementation maturity, alternatives, failure/recovery, compatibility/migration, verification, and rollback/supersession boundaries where they were previously implicit.