# The Rail (V10) — Implementation TODOS

**Date:** 2026-07-16 · **Source:** `V_SERIES_AMBIENT_RAIL.md` (concept doc,
2026-07-16) **Status of source decisions:** D1–D8 are settled and treated as
fixed inputs here (one shared Rail, product-designated **V10** — its own
V-series product riding V1's identity graph (D8); dual-face channels; granted
loudness; Veritas-live video flagship in both modes; third-party docking; V3
Stage + Aphrodite; own native shell via **Tauri** on V1 identity).

This file is the actionable breakdown of the entire concept document into tasks
executable by Claude Code or a similar coding agent. Tasks that are **not**
locally actionable by an agent (rights deals, legal review, content licensing,
human dogfooding) are collected in §HG at the bottom and tagged inline as
`(HUMAN GATE)` where they block an agent task — per repo rules they stay `[ ]`
and get skipped with a note, never marked done by an agent.

---

## 0. Ground rules for executing this checklist

These follow `CLAUDE.md` and are restated because they were written for exactly
this kind of long checklist:

- **One task at a time, sequentially.** Read the code for that task, implement
  or verify, run its tests, mark `[x]` with the Edit tool, commit + push (both
  `git push origin <branch>` and `git push origin <branch>:main`). Then the next
  task. No batch marking, ever.
- **Limit parallelism.** At most ONE concurrent subagent (session limits have
  been hit repeatedly on this account). Prefer main-loop work; delegate only
  large read-only audit sweeps, and design agent prompts to be resumable.
- **Zero stubs.** Every task below means a full, domain-specific, tested
  implementation. Where a real integration is absent (no creds, no runtime, no
  content), build the honest fail-loud seam (`not_configured` throw / 503
  fail-closed / `{ configured: false }`) — never fake success. Run the
  adversarial stub grep from `CLAUDE.md` before marking any implementation task.
- **Ordering.** Phases R0 → RA → RB → RC → RD. Within a phase, tasks are ordered
  by dependency; do not skip ahead to a later phase before the earlier one's
  non-gated tasks are done. Gated tasks (tagged `GATED:`) are skipped with a
  note when the gate is closed, and revisited when it opens.
- **Mac hygiene.** This box is a 16 GB MacBook Air. One heavy job at a time
  (build OR emulator OR browser sweep); check `memory_pressure` before long
  runs; tear down dev servers at task boundaries; track PIDs.
- **Consolidation invariant (§10 of the source doc).** The Rail must be the
  consolidation, not an eleventh duplicate: exactly ONE channel contract
  (`libs/contracts/src/v10`), ONE streaming substrate (generalized from
  Aphrodite), ONE C2PA signer (`libs/shared/content-signing`,
  `@oshun/content-signing`). Any task that would create a second one of these is
  wrong — reuse instead.

**Proposed code homes** (established in R0.1; adjust there if the layout task
finds a better fit, then treat as fixed):

| Concern                          | Home                                                                                    |
| -------------------------------- | --------------------------------------------------------------------------------------- |
| Contract types + schemas         | `libs/contracts/src/v10/`                                                               |
| Rail kernel libraries            | `libs/v10/rail-*` (the Rail is V10 — D8; account-shaped state stays on V1's graph — D7) |
| Native shell (Tauri)             | `apps/v10/shell/` (Rust core + config)                                                  |
| Rail web UI (shell + P1 browser) | `apps/v10/web/`                                                                         |
| Channel adapters                 | `libs/v10/rail-channel-<id>/` or in the owning V's libs                                 |
| BFF endpoints                    | `apps/oshun/bff` (extend — identity/entitlements live here)                             |

---

## Phase R0 — Contracts and policy kernel

Everything else depends on this. The kernel encodes the four broadcast-media
properties from §1 as enforceable constraints: progresses-without-you,
glance-legible, absence-is-free, co-presence.

### R0.1 Scaffolding and the channel contract (§4)

- [x] Survey the existing layout before creating anything: read
      `libs/contracts/src/index.ts` + one existing domain module (e.g.
      `libs/contracts/src/v9/`) and one existing `libs/v9/*` library's
      `project.json`/`package.json`/`tsconfig.json` to copy conventions exactly
      (build targets, path mappings in `tsconfig.base.json`, vitest setup,
      catalog deps).
- [x] Create `libs/contracts/src/v10/` with the full channel-contract type
      system, as zod schemas + inferred TS types (match how other contract
      modules do validation): _Verified 2026-07-16: every schema in
      `channel-contract.ts` read line-by-line; 5/5 vitest green; exhaustive
      surface record proven empirically (partial record rejected, zod 4);
      adversarial stub grep over `libs/contracts/src/v10` + `libs/v10` clean._
  - [x] `Ring` — `'wellness' | 'games' | 'adult'` (§9).
  - [x] `Surface` + `SurfaceAvailability` — desktop-shell, browser-panel,
        mobile, watch, tv; per-surface boolean matrix. Encode the day-one rule:
        `ring: 'adult'` forces `mobile/watch/tv = false` at the schema level
        (refinement that rejects violating manifests) (§3.1, §9.1).
  - [x] `TileSpec` (§4.1) — presence-tile descriptor: render payload schema,
        `coldCacheRender: true` required capability, `textOnlyDegradation`
        required capability, `autoplayMotion: false` as the only accepted
        default (motion allowed only via loudness-3 elevation at runtime, never
        in the manifest default).
  - [x] `DripEvent` (§4.2) — discrete timestamped event: channel id, type,
        payload, `glanceText` (2-second-readable one-liner), optional deep link.
        No priority/interrupt field exists on the type — channels cannot request
        interruption via drip, by construction.
  - [x] `MicroActSpec` (§4.3) — id, title, `expectedDurationSeconds` with a
        schema-enforced ≤30s budget, input schema, completion result schema,
        deep-link fallback for acts that outgrow the budget.
  - [x] `LiveMomentSpec` (§4.5) — typed `'scheduled' | 'emergent'`, rate-limit
        class, daypart hints. Requests elevation; never grants it.
  - [x] `AudioSourceSpec` / `VideoSourceSpec` (§6.1–6.2) — video sources carry
        `contentClass: 'first-party-live' | 'overlay' | 'docked-third-party'`.
  - [x] `DaypartAffinity` (§6.3) — affinity weights per daypart id.
  - [x] `FaceSpec` (§4.4) — `{ spectator: TileSpec; player?: TileSpec }`;
        spectator face is mandatory, player face optional (front-door audience
        first).
  - [x] `ChannelManifest` (§4.6) — composes all of the above; id format
        `"<v>.<channel>"` validated by regex (e.g. `v8.case-files`).
  - [x] `DeepLink` (§8) — target product, moment context payload, and a
        `landsInside` description; schema forbids bare product-root links (every
        tile deep-links _with context_, never to a main menu).
  - [x] Vitest suite: valid manifests for two realistic channels (v8.case-files,
        v9.wonder-recall) parse; violating manifests (adult ring on mobile,
        35-second micro-act, drip event with an interrupt field, context-free
        deep link) are rejected with specific errors.
- [x] Export the rail module from the contracts index; build + lint the
      contracts project clean.
- [x] Create `libs/v10/rail-kernel` library scaffold (project.json, package.json
      with catalog refs, tsconfig, path mapping in `tsconfig.base.json`, vitest
      config) — the home of R0.2–R0.5 engines.

### R0.2 Loudness engine (§5)

- [x] Implement the loudness model in `libs/v10/rail-kernel`:
  - [x] `LoudnessLevel` 0–3 with the exact semantics table (hidden / tile only /
        tile+drip / tile+drip+elevation).
  - [x] `effectiveLoudness(channel, daypart, grants, pins) = min(daypartCeiling, channelGrant)`
        with user-pinned exceptions overriding the min (e.g. "always break
        through for V2 finals") — pins are per-channel + per-moment-type, stored
        data, never channel-settable.
  - [x] Default grant for every newly subscribed channel is exactly 1.
  - [x] Deep-work audio-lane exemption: the audio lane holder remains active at
        ceiling 1 (§5, §6.3).
- [x] Implement the elevation budget: per-channel per-day request budget by
      rate-limit class; unspent budget does NOT accumulate (reset at local-day
      boundary); requests beyond budget are rejected with a typed reason.
- [x] Implement the Rail invariants as executable policy checks the UI and
      channel host must consult (single `RailPolicy` API):
  - [x] `no-absence-punishment`: channel manifests and drip payloads are
        rejected if they declare streak-loss/decay/expiring-reward semantics
        (schema-level flag + runtime assertion; adopt Arete's
        `done|partial|skip|decline|miss` vocabulary for anything streak-shaped).
  - [x] `no-autoplay-below-3`: motion/sound autoplay is a runtime capability
        granted only at effective loudness 3.
- [x] Vitest suite with specific numeric cases: ceiling 1 + grant 3 → 1; ceiling
      3 + grant 2 → 2; pin overrides ceiling; day rollover resets budget and
      discards unspent; budget exhaustion rejects; default-grant-is-1 on
      subscribe.

### R0.3 Daypart engine (§6.3)

- [x] Implement dayparts in `libs/v10/rail-kernel` (or a sibling `rail-dayparts`
      module if size warrants):
  - [x] Default schedule exactly per the doc: morning-brief (ceiling 2), deep
        work (1), breaks (2), lunch (3), wind-down (3), with per-daypart surface
        descriptions as data.
  - [x] User-tunable boundaries (times per weekday), persisted as user settings;
        timezone-correct across DST using the user's IANA zone.
  - [x] Daypart transition events (the audio-lane handoff trigger and the
        director-profile switch consume these).
  - [x] Adult-ring eligibility flag: true only in wind-down + an explicit
        `private` daypart the user can define (§6.3, §9.1).
  - [x] Calendar-awareness is Phase RD — leave a typed `CalendarSource`
        interface seam that throws `not_configured` (fail-loud, per rules).
- [x] Vitest: default table matches the doc verbatim; boundary math at
      midnight/DST; transition event emission; adult eligibility only where
      specified.

### R0.4 Timeline and drip batching (§4.2, risk 4)

- [x] Implement the merged timeline in `libs/v10/rail-kernel`:
  - [x] Ingest `DripEvent`s from all subscribed channels into one ordered
        timeline; channels get a fire-and-forget emit API with no delivery
        control (batching is Rail policy, not channel courtesy).
  - [x] Batching policy per daypart: deep work holds all drips (delivered at the
        next break), breaks/lunch deliver in batches, wind-down delivers
        promptly; policy is data-driven so dayparts own it.
  - [x] Per-channel drip rate limiting AND a **global drip budget** across all
        channels per daypart (risk 4: ten channels at loudness 2 is still a
        noisy timeline) — overflow degrades to a per-channel "n more events"
        rollup entry, never silent drop.
  - [x] Ordering: batch-internal ordering by timestamp; rollups keyed to
        channel + type.
- [x] Vitest: deep-work holdback then break flush; global budget overflow
      produces rollups with correct counts; a hostile channel emitting 1000
      events cannot exceed its rate slice; nothing is silently dropped.

### R0.5 Live-moment arbitration (§4.5)

- [x] Implement elevation request handling in `libs/v10/rail-kernel`:
  - [x] Channels submit typed requests (`scheduled` announced ≥ N minutes ahead
        vs `emergent`); the Rail decides via: effective loudness must be 3 (or a
        user pin), budget available, daypart allows, ring allows.
  - [x] Scheduled moments can pre-announce in the timeline at loudness ≥2
        ("accusation window at 8pm") without elevating.
  - [x] Every decision (granted/denied + reason) is recorded for the calm SLO
        (R0.8).
- [x] Vitest: emergent request at deep work + grant 3 → denied (ceiling 1); same
      with user pin → granted; budget-exhausted denial; decision log
      completeness.

### R0.6 Rings and policy walls (§9)

- [x] Implement the three-ring model in `libs/v10/rail-kernel` (rings are static
      channel attributes; walls are Rail-enforced behaviors):
  - [x] Ring registry: wellness (V1 house channels, V9, V3 Motion,
        Tara/Nyx/Arete, Ori), games (V2, V4, V5, V7, V8, V3 Stage), adult
        (Aphrodite content).
  - [x] Adult-ring wall, each clause as an enforced check with its own test
        (§9.1): absent from default channel directory; absent from all
        recommendation surfaces; opt-in requires an age-verification assertion
        from V1 identity (integration in RD.3 — until then the opt-in path
        throws `not_configured`); web/desktop only; eligible only in
        private/wind-down dayparts; excluded from Ori narration input set;
        excluded from watch parties; excluded from all cross-channel promotion.
  - [x] Gambling-adjacency guard (§9.2): prediction micro-acts must declare
        `stakes: 'points-only'`; any manifest whose micro-act schema contains
        value-in/value-out semantics is rejected. Document in the module README
        that anything wager-shaped requires its own review.
- [x] Vitest: one test per wall clause proving the wall holds; a
      points-and-bragging-rights prediction act passes; a wagering act is
      rejected.

### R0.7 Discretion mode kernel (§9.3 — P0, not polish)

- [x] Implement discretion state in `libs/v10/rail-kernel`:
  - [x] Modes: `off`, `text-only` (per-channel), `hidden` (instant, global).
  - [x] One-keystroke instant hide: kernel exposes a `panic()` transition that
        the shell binds to a global shortcut (RA.1); state transition must be
        synchronous (no awaits between input and hide decision).
  - [x] Per-channel text-only tile option persisted per user.
  - [x] Screen-share auto-engage: kernel consumes a `ScreenShareDetector` signal
        (shell provides it; browser fallback provides a degraded
        `getDisplayMedia`-based self-share signal); on engage, personal tiles
        (health, Ori, adult ring, active case) collapse to neutral text
        immediately; disengage requires explicit user confirmation, never
        auto-restore.
  - [x] Tile neutral-text transform: every `TileSpec` must supply its
        `textOnlyDegradation`; the kernel refuses to register channels without
        it (already schema-required in R0.1 — assert at runtime too).
- [x] Vitest: transition matrix; auto-engage collapses the personal-tile set and
      nothing else in wellness ring is lost; no auto-restore.

### R0.8 Calm metrics and the anti-engagement lock (§5, §12 risk 1)

- [x] Implement the metrics module (`libs/v10/rail-kernel` or `rail-metrics`):
  - [x] Event schema + local aggregation for exactly: **docked-hours**,
        **micro-act completion quality** (completed within budget / abandoned /
        outgrew-to-dive), **voluntary-return rate** (opens not caused by an
        elevation), and the **calm SLO** (elevations per user-day; alert when a
        channel or the Rail exceeds its ceiling).
  - [x] The forbidden metric is structurally absent: no counter for
        interrupts-clicked exists; add a code comment + test asserting the
        exported metric set equals the allowed list (this is the lock the doc
        asks to install _now_).
  - [x] Spectator-is-success (§8): face state (spectator vs player) is a
        dimension on docked-hours, not a conversion funnel stage; no
        "conversion" naming anywhere in the module.
- [x] Vitest: aggregation correctness with synthetic weeks of events; calm-SLO
      breach detection at the exact ceiling boundary.

### R0.9 Identity, entitlements, persistence (§2 D7, §3, §10)

- [x] Read the existing V1 identity/entitlement code (`libs/oshun/auth`,
      `libs/shared/identity`, `libs/shared/auth`, `apps/oshun/bff`) and write a
      short mapping note (in the rail-kernel README) of where accounts,
      entitlements, and grants live today — the shell owns nothing
      account-shaped (D7), so all Rail state below rides V1's graph.
- [x] Implement Rail user-state persistence on the V1 graph via the BFF:
  - [x] Channel subscriptions (subscribe/unsubscribe, ring-aware: adult ring
        requires the R0.6 opt-in path).
  - [x] Loudness grants + pinned exceptions (R0.2 shapes).
  - [x] Daypart schedule overrides (R0.3 shapes).
  - [x] Discretion preferences (R0.7 shapes).
  - [x] Ring opt-ins with audit trail (who/when/what-verification).
- [x] Add the BFF endpoints in `apps/oshun/bff` following its existing composer
      conventions (read several existing endpoint modules first); wire to the V1
      database with migrations matching repo practice.
- [x] Face selection from entitlement state (§4.4): a pure function
      `selectFace(manifest, entitlements)` → spectator when the user lacks the
      product entitlement/progress, player when they have it; per-channel
      override ("show me the spectator face anyway") supported.
- [x] Vitest + integration tests against the BFF (existing test patterns):
      round-trip each state kind; adult opt-in blocked without age-verification
      assertion; face selection for entitled/unentitled users.

### R0.10 Channel host runtime (§4, §1 properties)

- [x] Implement the channel host in `libs/v10/rail-kernel` — the runtime that
      loads manifests and mediates every channel interaction:
  - [x] Registration: validate manifest against contracts; reject on any schema
        violation (fail-loud, listing every violation).
  - [x] Tile lifecycle: request render payloads on a Rail-owned cadence; enforce
        cold-cache render (a channel whose tile cannot render from the last
        cached payload is marked degraded and shows its text fallback, never a
        spinner); enforce text-only degradation availability.
  - [x] Face selection wired to R0.9.
  - [x] Micro-act execution: host the act, enforce the ≤30s budget (soft-warn at
        budget, offer the deep link — never hard-kill user input mid-act),
        report completion quality to R0.8.
  - [x] Deep-link dispatch: resolve `DeepLink` context into the owning product's
        URL/app scheme; refuse context-free links (schema already forbids;
        assert at dispatch too).
  - [x] "Progresses without you" is a channel-side property the host makes
        observable: track per-channel drip/tile-change recency and surface stale
        channels in a host diagnostic (a channel that drips nothing is worse
        than no channel — risk 3; the host must make that visible).
- [x] Build a `test-channel` fixture package (a fully real, tiny channel — a
      clock/quote channel with genuine tile, drip, micro-act, live moment) used
      by kernel + UI tests. This is a test double at a dependency boundary, not
      a stub: it really computes what it shows.
- [x] Vitest: registration rejection cases; cold-cache degradation path;
      micro-act quality reporting; deep-link context enforcement.

---

## Phase RA — the Rail exists (P0, §11 Phase A)

Ship order within the phase: web UI against the kernel first (testable in
Chrome), then the Tauri shell wrapping it, then pilot channels one at a time.

### RA.1 Rail web UI (`apps/v10/web`) — shared by shell and P1 browser fallback

- [x] Scaffold `apps/v10/web` following an existing web app's conventions (read
      `apps/oshun/web` setup first: framework, design tokens via
      `libs/oshun/design-tokens` / `design-language`, lint/test wiring). It must
      run standalone in a browser (that IS the P1 fallback) and inside the Tauri
      webview unchanged.
- [x] Layout: narrow one-third-split geometry as the design target; vertical
      stack of presence tiles; merged timeline; audio-lane control strip;
      video-lane panel; micro-act surface. Responsive from ~320px width up.
- [x] Presence tile stack:
  - [x] Tile renderer honoring `TileSpec`: silent, no autoplay motion, renders
        from cached payload, text-only mode, 2-second legibility as the design
        bar (tile header + one state line + one glance metric).
  - [x] Loudness-0 channels hidden; drag-reorder; degraded/stale channel
        treatment from the host diagnostic (R0.10).
- [x] Timeline: batched drip rendering with rollup entries; daypart-aware
      delivery from R0.4; per-event deep links; scheduled live-moment
      pre-announcements.
- [x] Micro-act surface: hosts `MicroActSpec` interactions inline; budget
      indicator; completion/abandon/outgrow flows reporting to R0.8.
- [x] Settings surfaces: channel directory (ring-aware — adult ring invisible
      pre-opt-in), per-channel loudness grants + pins, daypart editor,
      discretion preferences.
- [x] Discretion mode UI: instant-hide (also bound to a keystroke inside the web
      app), text-only rendering, screen-share auto-engage banner + explicit
      restore.
- [x] Wire everything to the BFF endpoints (R0.9) with the repo's existing
      client conventions; all state changes optimistic + reconciled.
- [x] Test with Claude in Chrome (mandatory per CLAUDE.md for frontend):
      visual + functional pass over tiles, timeline batching, micro-acts,
      loudness settings, discretion hide, using the `test-channel` fixture.
- [x] Component/unit tests per repo convention for the tile renderer, timeline
      batcher rendering, and settings forms.

### RA.2 Native desktop shell (`apps/v10/shell`, Tauri — D7)

- [x] Scaffold a Tauri 2.x app in `apps/v10/shell` (Rust core), integrated with
      Nx via `nx:run-commands` (the repo's polyglot pattern); loads
      `apps/v10/web` as its frontend (dev server in dev, bundled dist in
      release).
- [x] Window management — this is the product (D7, P0 requirements):
  - [x] Launches narrow (one-third-split default size derived from the active
        monitor's work area).
  - [x] Edge docking: snap to left/right screen edge with drag-to-dock and a
        keyboard command; remember which edge.
  - [x] Pinned across restarts: persist and restore monitor, edge, size,
        always-on-top state, and visibility.
  - [x] Always-on-top toggle (menu + shortcut + tray).
- [x] Tray / menu-bar presence (macOS first — this box — with the cross-platform
      code paths kept honest):
  - [x] Tray menu with: show/hide panel, always-on-top toggle, discretion
        instant-hide, audio-lane transport (play/pause/skip/handoff), and the
        top-N tile glance lines (text-only by construction).
  - [x] Tray remains functional with the panel closed (the shell keeps the
        kernel session alive headless).
- [x] Global shortcuts: discretion `panic()` (works when unfocused — register a
      system-global accelerator), show/hide panel.
- [x] Screen-share detection feeding R0.7: on macOS detect active capture
      (ScreenCaptureKit/CGDisplay capture-status APIs from the Rust side); where
      the platform offers no signal, expose `{ supported: false }` and surface
      that honestly in settings (fail-loud seam, no fake detection).
- [x] IPC bridge: typed commands between web UI and shell (window ops, tray
      updates, shortcut events, screen-share signals); define the contract in
      `libs/contracts/src/v10/` (shell-bridge schema) so web and Rust stay in
      lockstep.
- [x] Autostart-at-login as an opt-in setting.
- [x] Rust unit tests for window-state persistence + IPC command decoding;
      portable end-to-end native launch automation; document what still needs
      eyes. _Verified 2026-07-18 on the available Linux host: the 34-test Rust
      suite round-trips and durably reloads the complete versioned monitor,
      edge, size, always-on-top, and visibility record; rejects unsupported
      state schemas and expanded/malformed bridge payloads; decodes every shared
      contract fixture; and dispatches the closed window command through Tauri's
      real IPC test envelope. The two-test TypeScript shell contract, Rust
      format/check/clippy gates, and `pnpm verify:launch` also pass. The launch
      gate built the custom-protocol binary, kept its real webview/tray process
      alive for ten seconds under isolated D-Bus/Xvfb, and validated the
      complete persisted `window-state.json`. The checked implementation also
      includes macOS System Events automation for left/right docking, Keep on
      Top, close-to-tray, and tray restore, plus an explicit visual-eye
      checklist in `apps/v10/shell/LAUNCH_VERIFICATION.md`; no macOS result is
      claimed from this Linux run._
- [ ] `GATED: a macOS host with Accessibility permission` Run
      `pnpm verify:launch` on macOS and record the Dock/Keep on Top/tray result
      plus the five presentation observations from
      `apps/v10/shell/LAUNCH_VERIFICATION.md`. _2026-09-18: the Mac is one of
      this project's two machines, so the host exists; what is missing is a
      person granting the Accessibility permission in System Settings and
      watching the five observations. An agent prepares the run and the
      recording sheet._ `blocked:human`
- [x] Add shell build/dev commands to root docs (README or docs center entry).

### RA.3 Audio lane (§6.1)

- [x] Implement audio-lane arbitration in `libs/v10/rail-kernel` (or
      `rail-lanes` module):
  - [x] Exactly one holder at a time; the Rail is the mixing desk. Handoffs
        occur ONLY on user action or daypart transition — the API gives channels
        no "grab" verb (requests queue as _offers_ the user/daypart policy
        accepts).
  - [x] Holder lifecycle: acquire → play state (play/pause/volume owned by the
        Rail transport) → release/handoff; brief voice interjections (Ori, RB.3)
        modeled as time-boxed _ducking overlays_ the holder must declare support
        for, not a second holder.
  - [x] Deep-work exemption honored (lane keeps playing at ceiling 1).
- [x] Web UI transport strip + tray transport (RA.1/RA.2) driving the lane.
- [x] Vitest: two channels contending → second queues as offer; daypart
      transition executes the configured handoff; no API path lets a channel
      self-acquire.

### RA.4 Video lane with third-party docking (§6.2, D5)

- [x] Implement video-lane arbitration alongside RA.3: one primary holder, same
      offer/accept model; four content classes carried on `VideoSourceSpec`,
      including first-party progressive/VOD without the live substrate.
- [x] Docked third-party (the day-one slot-geometry win):
  - [x] Embed hosting for YouTube and Twitch via their official iframe/embed
        APIs (user pastes/picks a URL or channel; we host the embed, we do not
        moderate the content); persist the user's docked source across restarts.
  - [x] Playback state surfaced to the lane transport where the embed API allows
        (play/pause/mute); where it doesn't, show honest reduced controls.
  - [x] Loudness/daypart integration: at effective loudness ≤2 embeds start
        muted + paused-until-user-acts (no autoplay invariant applies to
        third-party video too); ambient posture in deep work only if
        user-pinned.
  - [x] CSP/frame-ancestors and privacy review of the embeds documented in the
        module README (what the embed can see, what we send).
- [x] Overlay/second-screen primitives (used by Veritas in RB.1): a synced
      companion-layer slot tied to an external-video clock source (manual sync
      control now; provider-time integrations later) — build the slot + sync
      model, with the Veritas ticker as its first consumer in RB.1.
- [x] First-party live class: stub-free seam — plays HLS/DASH from the streaming
      substrate once RB.4 lands; until then the class reports `not_configured`
      and no channel may declare it (registration-time check), so nothing fake
      ships in Phase A. V3 Stage's Phase A video (RA.8) uses progressive/VOD
      playback of real encoded assets, which needs no live substrate.
- [x] Web UI panel: lane holder view, docked-source picker, overlay slot.
- [ ] Claude-in-Chrome functional pass: dock a real YouTube embed, verify
      mute/pause invariants at loudness ≤2, verify persistence.
  - 2026-07-17 environment note: the active Codex toolset exposes no
    Claude-in-Chrome/Chrome automation MCP, so the named sign-off remains open.
    The strongest available equivalent passed in desktop Playwright Chromium
    against the live `youtube-nocookie.com` iframe and official IFrame API (the
    Rail BFF policy alone was controlled locally), including quiet start, device
    persistence, no automatic lane reacquisition, and explicit saved- source
    handoff. The opt-in probe is retained under `RAIL_REAL_PROVIDER_E2E=1`.
    _2026-09-18, reworded by the board audit: CLAUDE.md retires the
    Chrome-extension route on this Mac (its window is occluded,
    `visibilityState: hidden`, no rAF, false readings) and names the Playwright
    inspect harness instead. The sign-off this item needs is therefore the
    desktop Playwright Chromium pass the note above records. What is left: a
    second reader confirms that run covers mute and pause at loudness 2 or less
    and persistence, and checks the box on that evidence._
- [x] Vitest: arbitration parity with audio lane; content-class gating;
      no-autoplay enforcement.

### RA.5 Pilot channel 1 — V8 Case Files (anchor; §7.8)

Substrate (verified real per 2026-07-14 audit):
`libs/v8/case-{bundle,csp,gates}`,
`libs/yemaya/case-{compiler,director,engine,eval,pipeline,contracts,...}`.

- [x] Read the case stack's public APIs end-to-end first (compiler → director →
      engine → gates → bundle) and write the channel-integration note: what a
      "daily case" run needs as inputs, what the evidence-board state object
      looks like, where the Ed25519 fairness receipt comes from
      (`@oshun/content-signing` path per the audit). _Audited 2026-07-17:
      [channel-integration note](RA5_V8_CASE_FILES_CHANNEL_INTEGRATION.md)
      records the executable Loom path, parallel V8 CSP/bundle representation,
      pre-reveal-safe board projection, and the shared signing seam plus the
      currently missing case-level receipt/adapter contracts._
- [x] Daily case cook pipeline (risk 3 — a channel that drips nothing is worse
      than no channel):
  - [x] A runnable job (Nx target) that cooks one daily case: generate via the
        solve-first pipeline, verify uniqueness (CSP+DPLL gates), sign the
        fairness receipt, emit a **release schedule** (director-paced clue and
        witness drops across a workday + the evening accusation window).
        _Implemented 2026-07-17 in
        [`@oshun/v10-case-files-cook`](../apps/v10/case-files-cook/README.md):
        the Nx `cook` target composes the real Clew/Minos/Daedalus gates,
        independently proves the culprit through direct DPLL and finite-domain
        CSP, emits an IANA-zone workday schedule, and signs/self-verifies the
        versioned receipt with an injected Ed25519 key pair._
  - [x] Weekend variant: bigger case, longer schedule. _Implemented 2026-07-17:
        Saturday/Sunday dates deterministically select the hard difficulty band,
        increase VO from 22 to 35 minutes, and extend clue/witness drops plus
        the local accusation/reveal cadence through 22:15._
  - [x] Determinism + provenance: case id, seed, receipt stored with the bundle;
        job is re-runnable and fail-loud on any gate failure. _Implemented
        2026-07-17: canonical cooked JSON embeds a versioned provenance record
        and the signed receipt; fixed `--issued-at` plus identical signer/input
        produces byte-identical re-cooks, while drift, unsafe file permissions,
        or any false G1–G7 state fails closed._
  - [x] Local scheduler wiring (repo-conventional: cron-style job or BFF
        scheduled task) producing tomorrow's case daily; document the ops seam
        for real deployment. _Implemented 2026-07-17: the one-shot Nx
        `cook-tomorrow` target derives tomorrow and a stable batch instant in
        the product IANA zone;
        [operations guidance](../apps/v10/case-files-cook/OPERATIONS.md)
        supplies a locked local cron entry and the explicit production
        scheduler, secret-manager, durable-storage, alerting, and key-rotation
        seams._
- [x] Channel adapter `libs/v10/rail-channel-case-files` implementing the
      manifest against the kernel. _Completed 2026-07-17: the contract-valid
      dual-face adapter now projects leak-safe live/cached boards, emits exact
      scheduled releases through Rail batching, executes three bounded board
      acts, requests the scheduled accusation moment and delivers its signed
      reveal, enforces post-reveal-only social comparison, and resolves every
      connected dive to its exact board/release context._
  - [x] Tile: evidence-board state (suspects, clues released/total,
        contradictions marked, time to accusation window) — 2-second-legible;
        text-only degradation ("Case #214 · 5/9 clues · window 8pm"); cold-cache
        render from the last board state. _Implemented 2026-07-17: the strict
        [`CaseFilesBoardStateV1`](../libs/contracts/src/v10/case-files.ts)
        boundary rejects unreleased/hidden state, while
        [`@oshun/v10-rail-channel-case-files`](../libs/v10/rail-channel-case-files/README.md)
        maps its latest snapshot to motionless public/player glances, a
        product-zone accusation countdown, state-derived text-only output, and a
        fully validated Rail cold-cache record. Desktop and mobile Chromium
        cover the real adapter through the production tile component._
  - [x] Drip: scheduled clue/witness releases through R0.4 batching; the morning
        "case opens" event (victim, setting, cast) lands in the morning brief.
        _Implemented 2026-07-17: strict kind-specific public payload schemas
        guard the cooked schedule; the adapter maps only releases due in a
        bounded exclusive/inclusive poll window to deterministic `case.opened`,
        `clue.released`, and `witness.released` events. Real R0.4 integration
        proves the 08:00 product-zone opening batches in `morning-brief`, while
        deep-work clues/witnesses remain held until the next break. Desktop and
        mobile Chromium render the real opening without exposing future drops._
  - [x] Micro-acts: pin a suspect; mark a contradiction; take a proof-tree
        minimal hint (wire to the engine's hint mechanism; if the engine exposes
        none yet, implement it in the case engine — solve-path-derived minimal
        hint, not a canned string). _Implemented 2026-07-17: strict
        explicit-state pin/contradiction writes commit through a player-scoped
        atomic store with one-revision updates and replay-safe execution
        receipts. Clew now selects one new already-released clue from the
        verified deduction path; the Rail persists that hint cursor and exposes
        only the clue-derived minimal text, never a canned prelude, solution
        conclusion, or unreleased evidence._
  - [x] Live moment: accusation-window opening (scheduled class) at wind-down;
        the reveal delivers the provable-fairness receipt with a verify-locally
        affordance (signature check in the client). _Implemented 2026-07-17: the
        adapter derives a stable rare scheduled moment and 60-minute+
        preannouncement from the cooked product-zone opening, leaving daypart,
        loudness, ring, and budget authority in the Rail kernel. It reads sealed
        receipt authority only when reveal enters the poll window, then binds
        the case, edition, accusation, and reveal instants in a strict
        `case.revealed` delivery. The restrained Rail receipt ledger validates
        the envelope, selects a separately trusted SPKI key by id, reconstructs
        the cook's shared canonical bytes, and verifies real Ed25519 locally via
        Web Crypto; malformed, untrusted, unavailable, and changed receipts fail
        closed._
  - [x] Faces: spectator = today's public case + community solve stats
        (post-reveal only); player = your board. Social compare-deductions
        strictly post-reveal (enforced server-side by not serving others' boards
        before reveal time). _Implemented 2026-07-17: the player face remains a
        player-scoped board and private pin/contradiction counts never enter the
        spectator payload. The spectator does not touch social storage before
        reveal; after its board advances to revealed, strict case-bound
        aggregate counts produce the community solve glance. The server
        comparison gate likewise performs no friend-board read before reveal,
        then returns only minimal public-id projections whose participants and
        references are schema-validated against the revealed case._
  - [x] Deep link: into the case at the exact board moment that prompted the
        dive. _Implemented 2026-07-17: each live/cold-cached tile handoff binds
        the case, edition, face, board revision, board update instant, tile
        observation instant, and phase to a deterministic moment id; every
        case-open/clue/witness/reveal drip likewise binds its exact scheduled
        source event. The shared Rail resolver proves matching web and app
        routes/context, while the connected presence surface exposes one
        motionless 44 px action and suppresses destination copy in text-only
        discretion mode. Contract, adapter, Rail-host, component, axe, overflow,
        desktop Chromium, and mobile Chromium coverage are green._
- [x] Tests: pipeline cook test (real small case end-to-end, receipt verifies);
      adapter unit tests (schedule → drip mapping, board → tile mapping); UI
      pass via Claude in Chrome with a cooked case; timezone test for the
      evening window. _Verified 2026-07-17: the eight-test cook suite runs a
      deterministic real weekday case through dual proof, compile, release
      scheduling, signing, and receipt verification, including a tamper
      rejection and explicit America/New_York 20:00 accusation / 20:45 reveal
      round-trips. All 18 adapter tests cover bounded schedule-to-drip and
      player/spectator board-to-tile behavior. The browser fixture now invokes
      the real cook CLI with an ephemeral Ed25519 keypair, validates the cooked
      schedule/provenance/receipt bindings, and renders only the due opening;
      desktop and mobile Chromium pass with future evidence absent, no
      horizontal overflow, and zero axe violations. Claude-in-Chrome tooling is
      not exposed in this environment, so the repository-required strongest
      available equivalent was the automated Playwright Chromium pass in both
      viewports._

### RA.6 Pilot channel 2 — V9 Wonder & Recall (§7.9)

Substrate (real FSRS/SM-2/IRT per audit):
`libs/v9/{aletheia,atlas,chiron,theia,prometheus,lesson-gates,...}`.

- [x] Read the V9 scheduler APIs (where FSRS state lives, how reviews are
      requested/answered, the ≤5s first-truth SLO from the review) and write the
      integration note. _Audited 2026-07-17: the
      [integration note](RA6_V9_WONDER_RECALL_CHANNEL_INTEGRATION.md) maps the
      real FSRS transition, due/ranking helpers, immutable lesson schedule, and
      distinct SM-2 gate path. FSRS traces are currently caller-owned values:
      there is no durable player store, runtime request/answer transport, or
      grounded scorer. The Rail must persist exact `nextReviewAt` alongside the
      reduced trace, filter due cards before ranking, and commit answers with
      revision/idempotency protection through `applyRetrievalCheckpoint`. The
      source queue defaults to 15 seconds/card (no audited 40-second behavior),
      while the review's ≤5s first-truth item is an unimplemented progressive
      wonder-answer recommendation; the Rail adopts it as a measured cached
      activation-to-grounded-card render budget._
- [x] Channel adapter `libs/v10/rail-channel-wonder-recall`: _Parent rollup
      verified 2026-07-18 against the current tree: every capability below is
      complete, the package remains registered in the production directory and
      Phase A registry, all 27 adapter/service tests and all 8 Phase A invariant
      tests pass, and standalone typecheck plus graph-aware Nx lint are green._
  - [x] Daily Wonder in the morning brief (drip event + tile spotlight); source
        it from the real V9 content path — if the Daily Wonder selection job
        doesn't exist yet, implement it in `libs/v9/*` (real selection logic
        over the atlas/kernel content, not a hardcoded pick). _Implemented
        2026-07-17: V9 now owns an idempotent publish-if-absent selection job
        that rotates deterministically across proof-anchored Atlas/kernel
        concepts, retains source/kernel anchors, and binds both the Atlas
        snapshot and selection policy by SHA-256. The V10 adapter emits one
        exact `wonder.published` morning-brief event and restores the same
        immutable edition as a calm cold-cache spotlight. Contract, selector,
        repository/job, adapter, timeline/daypart, deep-link, component, axe,
        overflow, desktop Chromium, and mobile Chromium coverage are green._
  - [x] Micro-reviews as break filler: at break dayparts, pull due cards from
        the real scheduler; each review is a micro-act (≤30s honored — the
        scheduler already wants 40-second interactions; split to two cards per
        act if needed to stay in budget); answers write back to FSRS state.
        _Implemented 2026-07-17: the adapter gates on the resolved break
        daypart, filters exact due traces before Mnemosyne's real urgency
        ranking, and budgets 30 seconds as at most two 15-second cards. Only
        prompts from publish-gated, checkpoint-bound V9 lessons enter the
        request; grounded truth stays server-side. Atomic revision CAS,
        batch/idempotency receipts, and `applyRetrievalCheckpoint` persist the
        exact FSRS state and `nextReviewAt`. Contract, scheduler, host, replay,
        failure-atomicity, axe, overflow, desktop, and mobile coverage pass._
  - [x] First-truth ≤5s: tile → first reviewable card render measured under 5s
        from cached state; make it a tested performance budget. _Implemented
        2026-07-17: a cache-declared review adapter measures due trace,
        publish-gated artifact, and immutable request reads against a strict
        `< 5,000 ms` contract; 4,999 ms passes and 5,000 ms fails closed without
        a prompt. The production Rail surface separately measures from tile
        activation through the first reviewable DOM render, keeps grounded truth
        hidden, and exposes an honest unavailable state on cache or budget
        failure. Unit, contract, axe, overflow, target-size, desktop, and mobile
        Chromium coverage pass._
  - [x] Kernel drops as drip events; fading-stars as the gentle tile state
        (due-decay visual, explicitly NOT a punishment mechanic — absence never
        loses anything, cards just wait). _Implemented 2026-07-17: each
        resolvable Daily Wonder kernel reference is recomputed through
        Aletheia's real Nyx/Kalika evaluator and emitted as a contract-valid,
        non-interrupting `wonder.kernel-drop` with exact value, unit, provenance
        hashes, and contextual handoff. The player tile projects real FSRS
        retrievability into silent star opacity while keeping persisted
        `nextReviewAt` authoritative; reads never mutate or remove traces and
        the copy states that cards wait safely. Contract, cold-cache, timeline,
        no-punishment, axe, overflow, desktop, and mobile coverage pass._
  - [x] Weekly Wonder Report as a wind-down scheduled moment. _Implemented
        2026-07-17: the adapter builds a deterministic private report from the
        complete, exact seven-day range of committed FSRS answer receipts,
        rejects cross-learner, duplicate, out-of-period, and malformed evidence,
        and emits only calm aggregate counts. A stable, rare Rail live-moment
        request declares wind-down affinity, preserves a 60-minute
        preannouncement, and elevates through the real arbitrator in the
        resolved wind-down daypart. Empty weeks report no recorded reviews
        without streak, penalty, missed-day, or loss language. Contract,
        idempotence, hostile-source, scheduling, timeline, axe, overflow,
        desktop, and mobile coverage pass._
  - [x] Faces: spectator = today's Wonder + a public explore taste; player =
        your due cards/stars. _Implemented 2026-07-17: the communal Daily Wonder
        spectator face derives a compact public taste only from the edition's
        proof anchors, recomputing supported Aletheia kernels and otherwise
        exposing an honest grounding-pin or declared-kernel path without
        inventing a result. Its payload and exact deep-link context contain no
        learner review state. The player face remains the separate private
        due-card projection with calm FSRS retrievability stars. Contract,
        fallback, cold-cache, text-only, axe, overflow, desktop, and mobile
        coverage pass._
- [x] Fold V1's Nisaba/Metis rooms into this channel rather than duplicating
      (§7.1): locate the room implementations (`libs/oshun/domain-metis`,
      `domain-nisaba`, mobile room content wiring) and route their Rail-facing
      presence through this one channel; document what was folded where.
      _Implemented 2026-07-17: the private player projection now reads the
      compatible V1 Metis and Nisaba shell adapter contracts with one learner
      identity, validates their canonical app/web launch pairs, and folds at
      most one latest real return per room into `v9.wonder-recall`. Source
      failures, future state, incompatible contracts, alternate origins, and
      path lookalikes fail closed without fixtures or invented progress. The
      full schoolroom, reading desk, mobile study workspaces, writes, and
      offline behavior remain V1-owned deep-link destinations; no duplicate
      `v1.metis` or `v1.nisaba` Rail channel exists. The audited source and
      ownership map is recorded in `V10/RA6_V1_NISABA_METIS_FOLDING.md`.
      Contract, canonical adapter, cold-cache, text-only, axe, overflow,
      desktop, and mobile coverage pass._
- [x] Tests: scheduler round-trip (answer updates real FSRS state and the next
      due time changes accordingly — assert against known FSRS outputs);
      break-daypart gating; 5s budget test; UI pass via Claude in Chrome.
      _Verified 2026-07-17: a real host-executed `good` answer advances the
      pinned New-card state to FSRS difficulty `7.2102`, stability `3.1262`,
      revision `1`, and exact next due time `2026-07-24T14:35:05.000Z`; the test
      directly proves that this differs from the persisted pre-answer due
      instant and removes the card from the current due query. The real daypart
      engine admits the `14:35` break and refuses the `14:50` deep-work window
      without creating a request. Cached trace, gated-artifact, and request
      reads pass at `4,999 ms` while `5,000 ms` fails closed. The requested
      Claude-in-Chrome connector is not available in this execution environment,
      so the repository's Playwright harness drove actual desktop and mobile
      Chromium instead; both due-review and first-truth flows pass target-size,
      hidden-truth, exact-next-due, overflow, and axe checks._

### RA.7 Pilot channel 3 — V3 Motion (audio; §7.3)

Substrate: V3 music stack (`libs/v3/*`, `libs/lilith/*` — locate the adaptive
work-music components at task start and record paths in the integration note).

- [x] Read the V3 music/motion stack and write the integration note: what can
      actually produce/select adaptive work-music today (engine, catalog,
      generation, or playlist logic), and what movement-break content exists.
      Choose the real path; if only building blocks exist, compose them into a
      real adaptive selector (energy/daypart-aware), not a shuffled playlist
      labeled "adaptive". _Audited 2026-07-17 in
      `V10/RA7_V3_MOTION_CHANNEL_INTEGRATION.md`: V3/Lilith have governed
      generation, durable catalog/scoring seams, playback-sync primitives, and
      real cue/count/asana content, but no playable adaptive work program or
      short break timelines. The chosen fail-closed path is a deterministic
      daypart + listener-energy selector over injected, rights-cleared playable
      rows; seed URLs, sample playlists, generated class inventory, and the
      still-proposed Mat Mode are explicitly excluded._
- [ ] `GATED: V3 must ship a canonical Mat Mode product launch target` Channel
      adapter `libs/v10/rail-channel-motion`: _All currently actionable adapter
      capabilities and verification are complete. Manifest publication remains
      intentionally unavailable because the shared contract requires a
      contextual deep link and V3 has not published the canonical Mat Mode
      launch target. The adapter now exposes the strict port that will unblock
      publication without accepting a generic substitute. Re-audited 2026-07-18:
      Quest 3 and Vision Pro profiles enable their underlying passthrough
      capabilities, but V3's product review still records Mat Mode as a gap and
      the tree contains no Mat Mode route, launch contract, resolver, or
      shippable product mode. A fabricated deep link would not satisfy this
      gate._ _2026-09-18, board tag: waits on V3 publishing a canonical Mat Mode
      launch target. No item in `V3/V3_TODOS.md` carries that (the registry
      lists V3 as closed); add one there when V3 reopens and cite it here._
      `blocked:upstream`
  - [x] Audio-lane holder: continuous work-music sessions with daypart-adaptive
        program (morning/deep-work/break energy targets); transport via the lane
        API only. _Implemented 2026-07-17 in `@oshun/v10-rail-channel-motion`:
        strict catalog parsing requires rights-cleared delivery plus current
        playback verification; a deterministic daypart, listener-energy, mood,
        BPM, continuity, and recency score composes the exact requested horizon
        with no shuffle or fallback. The service prepares that program and can
        only offer it through its channel-bound `AudioLaneChannelPort`; it
        cannot accept its own offer or control the holder. Focused verification
        passes 14 Motion tests and the kernel's 9 audio-lane arbitration tests._
  - [x] Micro-acts: stretch break, posture reset, 90-second dance break — each a
        real guided act (timed steps + the audio bed), with completion quality
        reporting. _Implemented 2026-07-17 as three immutable, source-traced
        timelines with contiguous step offsets, safety exits, and low-impact
        modifications. Stretch and posture each occupy one 30-second Rail phase;
        the exact 90-second dance timeline composes three contiguous 30-second
        phases, preserving the kernel's hard micro-act budget instead of
        weakening it. Each act requests an exact break-energy program through
        the lane-only audio service. Completion reports validate wall-clock
        elapsed time against the registered act; partition completed, skipped,
        and unreached steps; distinguish early exits; require real matching
        holder observations before claiming an audio bed; and explicitly record
        sensor assessment as unobserved. The focused Motion suite passes 24
        tests._
  - [x] Live moments: class schedules (if V3 has real class/schedule data;
        otherwise the manifest omits live moments until it does — no fake
        schedule). _Implemented as the frozen, empty `MOTION_LIVE_MOMENT_SPECS`
        declaration. The boundary exposes no schedule injection seam that could
        admit the audited GA inventory, and unit coverage proves the omission
        remains empty and immutable until V3 owns a real runtime reader._
  - [x] Tile: now-playing + today's movement minutes (from completed
        micro-acts); text-only degradation. _Implemented 2026-07-17 with a
        strict 60-second lane observation and a bounded 500-report completion
        read. The renderer counts only completed, registered guided-act step
        durations on the user's explicit IANA-local day; stale, future,
        malformed, duplicate, oversized, or throwing evidence stays unavailable
        instead of becoming a false zero. The real payload leads with playback
        truth, then movement minutes, and preserves both in its exact text-only
        summary. Focused verification passes all 30 Motion tests and the V10
        web's 99 unit tests; desktop and mobile Chromium additionally pass the
        standard/text-only hierarchy, overflow, Axe, motion-off, no-media, and
        no-fabricated-live-or-deep-link checks._
  - [x] Deep link: passthrough Mat Mode as the immersion end of the funnel.
        _Implemented as a strict canonical-launch port: only the versioned
        `mat-mode` capability envelope with a contract-valid contextual V3 link
        is accepted, and that link is cloned without rewriting its route or
        context. Missing, throwing, malformed, generic, product-root, and non-V3
        evidence all resolve to no link; the package invents no fallback._
- [x] Tests: adaptive selection is input-sensitive (different daypart/energy →
      different program, asserted on real selector outputs); lane handoff
      correctness; micro-act timing; UI/audio pass via Claude in Chrome.
      _Verified 2026-07-17: all 34 Motion tests cover input-sensitive adaptive
      programs, deterministic catalog scoring, fail-closed eligibility,
      lane-only offers and handoffs, exact guided timelines and reports,
      current/local-day tile truth, immutable live omission, and strict Mat
      passthrough. The kernel's 9 audio-arbitration tests and the V10 web's 99
      unit tests also pass. Claude-in-Chrome is not exposed in this environment,
      so the repository's Playwright harness exercised the real Motion payload
      in desktop and mobile Chromium instead; all four standard/text-only cases
      pass Axe, overflow, hierarchy, motion-off, no-media, and
      no-fabricated-live or deep-link assertions._

### RA.8 Pilot channel 4 — V3 Stage (video; legacy Saraswati tenant; §7.3)

Substrate: `libs/v3/saraswati-stage`, Calliope stage/performance libs
(`libs/calliope/*`); consolidation audit found Calliope's stage spec
substantially complete and uncited by V3.

- [x] Resolve the two flagged bookkeeping items first (they gate honest
      naming/citation):
  - [x] Citation: read `libs/v3/saraswati-stage` and the Calliope stage spec;
        record the relationship (what V3 uses, what it should cite) and fix the
        citation in the relevant docs/specs. _Resolved 2026-07-17 in
        `RA8_V3_STAGE_CHANNEL_INTEGRATION.md`: V3 owns the tenant persistence,
        rights/provenance, recorded-evidence authoring gates, quality gates, and
        Unreal binding contract; Calliope's 30-service, cross-validated Stage
        model is the normative concept/setlist/venue/camera/streaming/VOD-plan
        specification but is not a current V3 runtime dependency. The V3
        descriptor and feature/architecture/review docs now cite
        `@calliope/stage` explicitly. Neither stack is mislabeled as a renderer:
        no playable concert VOD or delivery URI exists yet._
  - [x] Naming collision: `saraswati` (V3 stage) vs `libs/saraswati` (the other
        domain — inspect it to confirm what it is). Propose and apply the
        rename/disambiguation with the smallest blast radius (likely: the
        channel id becomes `v3.stage` or similar while brand naming is listed as
        HG-7); update the source doc's §12.9 note with the resolution. _Resolved
        2026-07-17: the Rail channel and cross-product technical name are **V3
        Stage**, id `v3.stage`, and the adapter home is
        `libs/v10/rail-channel-stage`. Existing V3 package, Prisma, contract,
        and Unreal Saraswati identifiers stay in place; the separate
        `@saraswati/*` namespace remains the industrial-technology domain for
        manufacturing, energy, mobility, robotics, IoT, telecom, and health
        hardware. The source doc's §12.9 risk now records the resolution; final
        public branding remains HG-7._
- [x] Channel adapter `libs/v10/rail-channel-stage`:
  - [x] Video-lane programming: a scheduled program of stage performances/music
        videos/concerts from real rendered assets produced by the V3/Calliope
        stage pipeline. Build the **programming loop** (playlist compiler over
        available performances with daypart-aware pacing) and a cook job that
        renders/refreshes program items via the real stage pipeline. **Human
        gate HG-2** covers licensed third-party content; first-party/generated
        performances are agent-actionable and are the Phase A content.
        _Implemented 2026-07-17 in `libs/v10/rail-channel-stage`: the bounded,
        stable-id compiler rejects malformed/duplicate rows, ineligible rights,
        declared drills, failed V3 export evidence, future/stale playback
        checks, and items that cannot fit the horizon; explicit daypart
        energy/set-section/camera/cut-density profiles drive scoring, while
        follows/favorites affect only the player face. The cook job composes
        injected V3 release, render, immutable-store, delivery-verifier, and
        catalog-writer ports; it hashes actual returned video/audio/artwork
        bytes and publishes only when every receipt observes the exact size and
        SHA-256. It contains no seed catalog or media URL fallback. Package
        typecheck and 19 focused tests pass._
  - [x] Playback: VOD/progressive playback in the video lane (no live substrate
        dependency in Phase A); concerts as scheduled live moments once RB.4
        gives a live path — until then concerts are premiere-style scheduled VOD
        events, labeled as premieres (honest, not fake-live). _Implemented
        2026-07-17: `first-party-vod` is a distinct admitted video class while
        genuine `first-party-live` remains gated. The Stage publisher reads the
        bounded verified catalog, compiles it, and submits the exact progressive
        video/audio pair through an offer-only coupled lane; it cannot
        self-acquire, invent delivery, or accept a forged receipt. The kernel
        rolls back partial offers, rejects desynchronized halves, and commits or
        releases both lanes at one prevalidated Rail instant, yielding one
        effective audio holder. Concert slots create preannounced scheduled V3
        Stage premiere moments whose title, glance copy, and payload all say
        `premiere`. All 28 Stage tests, 136 kernel tests, contract tests, and
        focused typechecks pass._
  - [x] Tile: now-playing artwork/title + up-next; audio pairs with the audio
        lane (video as optional garnish on music — the lane coupling where video
        holder may feed the audio lane as one holder, not two). _Implemented
        2026-07-17: the strict Stage renderer resolves one current item from a
        continuous compiled schedule and projects its delivery-verified artwork,
        title, artist, and up-next item. The shared PresenceTile renders one
        silent artwork-led setlist with no tile motion or media, while the web
        video panel mounts the selected exact progressive URI paused and muted
        behind explicit Play/Pause and Mute controls. The already-delivered
        coupled arbiter keeps the matching video/audio identity to one effective
        audio holder._
  - [x] Faces: spectator = the program; player = follows/favorites shaping the
        program. _Implemented 2026-07-17: the manifest publishes separate calm
        faces. Spectator compilation ignores and its published schema rejects
        preference signals; player compilation may order by favorite or followed
        artist and exposes only that bounded signal. Both faces have exact
        state-derived text-only degradation and contextual V3 Stage links._
- [x] Tests: programming loop determinism given a catalog fixture of real
      rendered items; lane coupling (one effective audio holder); UI playback
      pass via Claude in Chrome. _Verified 2026-07-17: all 34 Stage tests cover
      deterministic programming, render/store/playback evidence, strict schedule
      and face validation, coupled publishing, truthful premieres, manifests,
      and tile projection. Coupled-kernel tests prove synchronized transactions
      and one effective audio holder. Claude-in-Chrome is unavailable in this
      environment, so the repository's Playwright equivalent ran both real Stage
      face projections, text-only degradation, and a native progressive player
      against actual encoded test-only WebM bytes in desktop and mobile
      Chromium; all eight focused scenarios passed Axe, overflow, hierarchy,
      exact-source, paused-start, user-only play, mute, and no-autoplay
      assertions. The WebM is browser-test evidence, not a production V3 catalog
      artifact._

### RA.9 Rail invariant test suite + Phase A hardening

- [x] Cross-channel invariant suite (runs against all registered channels,
      pilots + test-channel):
  - [x] No absence punishment anywhere (manifest + runtime probes).
  - [x] No autoplay motion/sound at effective loudness ≤2 (drive the UI and
        assert).
  - [x] Elevation budgets enforced per channel per day; unspent don't
        accumulate.
  - [x] Metric exports equal the allowed calm set exactly.
  - [x] Per-surface availability matrix honored (adult ring absent from
        non-web/desktop payloads — testable now even with no adult channel
        registered, via a fixture manifest). _Implemented and verified
        2026-07-17: `libs/v10/rail-phase-a` is the explicit invariant registry
        for the contract-ready Case Files, Wonder & Recall, and Stage pilots
        plus the deterministic clock test channel; Motion remains truthfully
        deferred until V3 supplies its canonical Mat Mode deep link. The
        registry suite registers every manifest through the real host, probes
        hostile manifest/drip/tile/micro-act runtime values, spends every rate
        class independently for every channel across rollover, locks the four
        calm metric exports, and checks every surface against both declared
        matrices and an adult fixture. Hardening found and closed two runtime
        gaps: the host now applies absence policy to drips, tiles, caches, and
        micro-act values and rejects undeclared drip types; recommendations now
        filter by the requested surface. Desktop/mobile Playwright drives all
        four channels at effective loudness 0–2 and the encoded progressive
        Stage player, asserting zero autoplay elements or `play()` calls, no
        autonomous entry motion, muted/paused media, no overflow, and no Axe
        violations. All 139 kernel tests, 7 registry invariants, 104 web tests,
        12 focused Playwright scenarios, targeted lint, and all three typechecks
        pass._
- [x] Adversarial pass per CLAUDE.md over every `rail-*` library and both apps
      (mandatory grep + silent-stub scan + delegation-chain read) before
      declaring Phase A code-complete. _Completed and verified 2026-07-17: every
      production file, public entry point, delegated private helper, and test
      contract in the six `rail-*` libraries plus the web and Tauri apps was
      read in confirmatory and adversarial passes (performed inline because the
      active execution policy prohibited spawning review subagents). The review
      shipped the three contract-ready pilots in the real app directory and
      closed fail-open edges in manifest faces, scheduled elevation timing and
      local-day budgets, coupled audio/video chronology, tile-cache chronology,
      BFF authority parsing, third-party player providers, StrictMode
      settlement, recoverable Wonder activation, and out-of-order user-state
      writes. The exact mandatory grep has zero actionable hits (the five
      matches explicitly promise that unsupported browser capabilities are not
      simulated); the full and staged silent-stub scans have zero hits; the
      empty-body scan resolves only to parameter-property constructors,
      default-object parameters, and a third-party SDK test double. All 275
      library tests (kernel 155, Case Files 18, Motion 34, Stage 34, Wonder 27,
      Phase A 7), 119 web tests, 34 Rust tests, seven TypeScript typechecks, web
      lint, Cargo fmt/check/Clippy, the Linux Xvfb launch/state-persistence
      probe, 44 comprehensive desktop/mobile Playwright cases, and the final
      eight-case connected-state Playwright rerun pass._
- [x] Dogfood instrumentation for the exit test: local docked-hours readout + a
      `rail dogfood-report` command summarizing the week (hours docked,
      micro-acts, elevations). The exit test itself — the author leaves it
      docked for a week — is `(HUMAN GATE HG-1)`. _Implemented and verified
      2026-07-17: the kernel now owns a strict 35-day local journal,
      visible-only docked sessions with stale-crash recovery and multi-tab
      ownership, the exact calm metric event union, and overlap-failing rolling
      seven-day reports by face/channel. The web surface records locally,
      mirrors only metrics already accepted by the authoritative aggregator,
      shows a compact `hours / 7d` footer readout, exports the journal, and
      queues the same private snapshot to the Tauri app-data store. The native
      command enforces the schema, a 2 MiB bound, and private atomic
      persistence. `pnpm rail     dogfood-report` reads that file or an explicit
      export and emits human or JSON hours, micro-act outcomes, and elevation
      decisions for a chosen IANA week boundary. Kernel (147), web (108), CLI
      (5), contract (2), native (34), and Wonder regression (27) tests pass with
      targeted typechecks, lint, Cargo fmt/check/clippy, desktop/mobile
      Playwright for the full recorder/export flow, and six desktop/mobile real
      micro-act outcome regressions. The one-week author observation remains
      solely HG-1._

---

## Phase RB — the flagship and the voice (P1, §11 Phase B)

### RB.1 Veritas Live — overlay/second-screen mode first (§7.1, D4)

Substrate: Veritas trust stack (`libs/veritas/*`, `libs/oshun/domain-veritas`),
9-factor source scoring, `@oshun/content-signing` for receipts.

- [x] Read the Veritas claim-extraction/verification pipeline as it exists and
      write the integration note: what can extract claims from a live transcript
      today, what the 9-factor scoring consumes, latency characteristics.
      _Audited 2026-07-17 in
      [`RB1_VERITAS_LIVE_INTEGRATION.md`](RB1_VERITAS_LIVE_INTEGRATION.md): the
      rich in-process extractor, the separate NLP HTTP service, the
      fact-checking agent, and the unimplemented live STT interface are mapped
      without treating any of them as an incremental transcript pipeline. The
      note records every nine-factor input and override, proves the composite is
      not wired into current verdict or claim-confidence paths, and derives the
      bounded caption-window / asynchronous verification adapter with honest
      timeout gaps. Domain Veritas (331), NLP, fact-checking, and fact-checking
      agent tests pass; the claim extractor and its dependencies compile._
- [x] Overlay mode (rights-light — ships first per risk 2):
  - [x] Live claim ticker as the video-lane overlay slot's first consumer
        (RA.4): given a transcript stream of an external video (start with real
        captions/transcript sources where available — e.g. user-provided stream
        captions — and a local speech-to-text seam that is fail-loud when no
        engine is configured), extract claims, score/verify against the Veritas
        pipeline, render verdict + confidence + source receipts in the ticker as
        they resolve. _Implemented and verified 2026-07-17: the browser-safe
        [`rail-channel-veritas-live`](../libs/v10/rail-channel-veritas-live/README.md)
        adapter consumes ordered final captions or a configured local-STT seam,
        bounds and deduplicates transcript windows, preserves claim locators,
        and exposes detected → checking → terminal state with fail-loud missing
        engines and verifier timeouts. Verification now sends canonical,
        reviewer-attested sources through the real nine-factor composite and
        Veritas fact scorer, then returns linkable stance, citation, factor,
        rationale, confidence, and verdict receipts. The restrained lower-third
        [`VeritasLiveClaimTickerCue`](../apps/v10/web/src/components/VeritasLiveClaimTickerCue.tsx)
        is bound as `v1.veritas-live`, with a production-style caption/evidence
        harness and desktop/mobile accessibility coverage. Adapter (22),
        fact-checking (7), claims (1), Domain Veritas (331), and web (121)
        tests, targeted lint/typechecks/builds, and the complete V10 Playwright
        suite (124 passed, 2 intentionally skipped) pass._
  - [x] Trust meter: rolling verified/unverified/contradicted tally for the
        session, C2PA/provenance receipts linkable per claim
        (`@oshun/content-signing` — the one canonical signer). _Implemented and
        verified 2026-07-17: every session snapshot now derives one exhaustive
        meter whose pending, verified, unverified, and contradicted buckets
        reconcile to the claim total; disputed and unavailable checks remain
        conservatively unverified. Every terminal verdict requires a linkable,
        C2PA-aligned Ed25519 provenance envelope binding the exact claim,
        transcript locator, verdict, source-quality assertions, and timestamps.
        Service-side issuance delegates exclusively to the canonical
        [`@oshun/content-signing`](../libs/shared/content-signing/src/index.ts)
        signer, while the Rail verifies canonical claim bytes locally against a
        separately supplied trusted-key registry and fails closed on tampering,
        unknown keys, invalid envelopes, or unavailable crypto. The quiet
        lower-third meter and per-claim receipt link are covered through the
        production-style harness on desktop and mobile. Content signing (6),
        adapter (22), and web (121) tests, affected lint/typechecks, the signer
        build, targeted trust-meter Playwright (4), and the full V10 matrix (124
        passed, 2 intentionally skipped) pass._
  - [x] Sync controls: manual offset + pause-tolerant re-sync (RA.4's clock
        model). _Implemented and verified 2026-07-17: the RA.4 companion clock
        accepts an explicit external time and playback state, exposes bounded
        one-second correction steps and offset reset, and preserves paused
        anchors across re-sync. Successful user pause/resume actions now mirror
        their applied state into the next re-sync selection, preventing a stale
        pre-toggle value from accidentally resuming a paused clock; rejected
        actions leave the form unchanged. The generic overlay and production-
        style Veritas flows prove exact clock/offset behavior, paused re-sync,
        and cue progression on desktop and mobile. Rail kernel (155) and web
        (121) tests, web lint/typecheck, targeted Playwright (8), and the full
        V10 matrix (124 passed, 2 intentionally skipped) pass._
- [x] Channel adapter `libs/v10/rail-channel-veritas-live`: _Parent rollup
      verified 2026-07-18 against the current tree: the tile/briefing, followed
      claim delivery/live moments, and separate spectator/player faces below
      remain complete; all 84 channel and integration tests, the two-test
      production-directory registration check, standalone typecheck, and
      graph-aware Nx lint pass._
  - [x] Tile: current event being tracked + trust meter state; morning audio
        **Veritas briefing** slots into the Thread daypart via the audio lane
        (the V1-review §5.8 briefing — generate from the real Veritas daily
        pipeline). _Evidence (2026-07-17): the production directory now
        registers the public `v1.veritas-live` spectator face. Its
        cold-cache/text-only tile projects the current source event, uses an
        exact event deep link, and re-derives the four-bucket trust meter from
        the published claims. Terminal claim state is accepted only with a
        provenance receipt bound to the session, exact claim/transcript locator,
        verdict, sources, and timestamps; unavailable and pending states also
        fail closed on contradictory payloads. The cardless mono evidence strip
        is silent, motionless, responsive, and axe-clean. The morning service
        reads one through six grounded stories from a host-bound
        published-daily-edition port, invokes Domain Veritas's real narration
        composer/synthesizer with confidence, source, correction/retraction, and
        synthetic-voice disclosure truth, rejects both estimated and synthesized
        audio beyond 180 seconds, validates delivered media, and can only create
        a channel-bound offer. The existing Thread daypart policy acquires that
        offer paused; the channel cannot accept or play it. The Node-authority
        service is isolated behind the `/morning-briefing` export so the tile's
        browser root stays portable. Channel tests (31), Domain Veritas tests
        (331), Rail kernel tests (155), web tests (122), channel/web lint and
        typecheck, focused desktop/mobile Playwright (6), Veritas browser-
        boundary Playwright (4), and the full V10 matrix (128 passed, 2
        intentionally skipped) pass._
  - [x] Drip: claim-verified events for followed topics; breaking events as
        emergent live-moment requests (rate-limited class). _Implemented
        2026-07-18: a strict delivery adapter consumes the canonical Veritas
        publication feed, canonical follow-recipient profile, and host trust
        verifier; it emits receipt-bound `claim.verified` drips only for exact
        active followed topics while honoring tenant, in-app, mute, cadence, and
        priority-only controls. Positively verified breaking publications derive
        stable rare emergent requests without granting themselves elevation; the
        real Rail arbitrator enforces daypart, loudness, ring policy, and the
        one-per-day channel budget. Malformed, duplicate, cross-tenant,
        untrusted, unreconciled, and hostile inputs fail closed. Channel tests
        (36), Domain Veritas tests (331), Rail kernel tests (155), contracts
        tests (18), web tests (122), channel/web lint and typecheck, focused
        desktop/mobile Playwright (2), and the full V10 Playwright matrix (130
        passed, 2 intentionally skipped) pass._
  - [x] Faces: spectator IS the product here (front-door audience); player face
        = your followed topics/sources. _Implemented 2026-07-18: the spectator
        remains the public current-event front door and never reads private
        follow state. The separate player face requests one canonical read-only
        snapshot through an explicit authenticated user/tenant binding, then
        rejects missing, cross-audience, future, duplicate, oversized,
        malformed, or schema-expanded topic/source records. Its cold-cache and
        text-only projections expose exact derived totals with bounded labels;
        empty state stays honest, and user/tenant identities never enter the
        cached payload or contextual link. Conversely, public event, claim,
        session, and trust state never enter the player payload. Both faces are
        cardless, silent, motionless, responsive, and axe-clean. Channel tests
        (43), V10 contract tests (18), Rail kernel tests (155), web tests (124),
        focused desktop/mobile face Playwright (8), expanded Phase A invariant
        Playwright (12), and the full V10 Playwright matrix (134 passed, 2
        intentionally skipped) pass._
- First-party produced coverage: rights and operations are human gate **HG-3**,
  tracked once in §HG below (this line was a second box for it until
  2026-09-18).
  - [x] Agent-actionable production-side pipeline skeleton: program schedule,
        studio overlay graphics package, and ingest via the RB.3 substrate seam,
        built against a test stream and clearly gated so it cannot be mistaken
        for a rights answer. _Implemented 2026-07-18: a strict, immutable
        rehearsal compiler accepts only contiguous bounded schedules whose
        segments all reference one declared synthetic MPEG-TS stream; callers
        cannot supply or elevate rights, operations, environment, or publication
        state. A streamed ingest adapter binds the exact Veritas tenant,
        channel, program, request time, byte count, and SHA-256 to the future
        shared-media port, rejects partial consumption or mutated/cross-bound
        receipts, and accepts only credential-free HLS + DASH manifests on test
        hosts. The derived 16:9 studio graphics package uses fixed safe areas, a
        restrained no-crawl visual system, bound accessible copy, and a
        permanent `TEST     SIGNAL · NOT FOR AIR` mark. The rehearsal has no
        publish/go-live method, returns HG-3 as required, and surfaces the
        existing live kernel's `not_configured` media gate; the parent remains
        open solely for the human rights/ops proposal and real RB.3 media
        extraction. Focused contract and pipeline tests (38 of 81 channel
        tests), Rail kernel tests (155), web tests (130), channel/web lint and
        typechecks, desktop/mobile axe and reduced-motion Playwright (4), visual
        inspection at 1440 × 900 and 393 × 851, and the full V10 Playwright
        matrix (138 passed, 2 intentionally skipped) pass._
- [x] Tests: claim extraction → ticker latency budget; scoring integration
      asserts real 9-factor outputs on fixture transcripts with known-correct
      verdicts; receipt signature verification; UI pass. _Done 2026-07-18:
      `VeritasLiveClaimSession` now records final-caption → synchronous
      ticker-publication observations against an explicit 250 ms budget,
      including bound overlay listeners. A production-path integration fixture
      drives real heuristic extraction, the governed scorer, exact nine-factor
      vectors and versions, known supporting/contradicting verdicts, RA.4 cue
      publication, and real Ed25519 verification plus tamper rejection. The web
      ticker now fails closed while a receipt is checking or invalid: terminal
      copy, confidence, trust credit, and source assertions remain withheld
      while the receipt diagnostic stays inspectable. Unit and desktop/mobile
      Playwright coverage exercise verified, contradicted, unverified, and
      tampered states, the latency budget, axe, reduced-motion, no-media, and
      overflow invariants. Channel tests (84), web tests (131), channel/web lint
      and typechecks, focused Playwright (6), visual inspection at 1440 × 900
      and Pixel 5, the full matrix (134 passed, 2 intentionally skipped), and
      its renderer-heavy Phase A retry at one worker (12 passed) pass._

### RB.2 Ori Presence believability beta (§7.6, behind a flag)

Substrate: V6 consent architecture + Ori continuity
(`libs/v6/{ori-model,moirai-kernel,cognition-stack,...}`), V6 consent/grief
architecture as governance.

- [x] Read the V6 Ori/consent stack and write the integration note: what the
      ori-model can actually do today, where LLM wiring stands (the review
      flagged it unproven), what the consent grammar looks like. _Done
      2026-07-18: `RB2_ORI_PRESENCE_INTEGRATION.md` audits the TypeScript and
      Rust continuity/runtime boundaries, proves the real governed gateway
      exists but has no non-test V6 host/provider composition, distinguishes
      user grants from Aye agent consent and Ori memory autonomy, and fixes the
      exact default-deny Rail awareness grammar plus input-firewall,
      remembrance, storage, grounding, and test boundaries. Verification:
      Prettier/link/diff checks, 46 Vitest files/591 tests, 8 focused canonical
      consent tests, and 28 Rust service tests all pass._
- [x] Narrator/concierge behind a feature flag (default OFF; the Rail must be
      whole without it — enforced by RA.9 suite running with the flag off):
  - [x] Cross-channel recap generation: consume the user's timeline
        (post-batching) and produce the "while you were away" recap ("your ghost
        won both bouts; the third witness contradicts the first — want the
        40-second recap?") via the real LLM path with the V6 model; adult-ring
        events are structurally absent from its input (R0.6 wall).
  - [x] Consent-gated daypart awareness: Ori sees dayparts/presence only per V6
        consent grants; every awareness scope is a recorded consent.
  - [x] Thread greeting: a morning one-liner woven into the morning brief.
  - [x] Voice: brief audio-lane ducking overlays (RA.3 model), never a holder
        grab; TTS through the repo's real voice path (locate it; fail-loud if
        unconfigured).
  - [x] Remembrance/ritual moments on meaningful dates via V6's grief/ritual
        architecture, gentle scheduled moments only.
- [x] Cost ceiling (risk 6): hard per-user-day inference budget with
      degrade-to-silent behavior + cost telemetry; believability beta gate =
      flag + cohort config, documented.
- [x] Tests: recap correctness on fixture timelines (asserts real content
      coverage, not truthiness); consent gating (no grant → no awareness, and
      the prompt assembly provably excludes ungranted scopes); budget exhaustion
      degrades silently; flag-off leaves zero Ori surface. _Implemented and
      verified 2026-07-18: the new private `v6.ori-presence` channel is absent
      from the default Phase A directory and remains silent unless the
      default-off flag, exact V1 user cohort, subscription, discretion/crisis,
      and durable exact-scope consent gates all agree. The BFF composes the real
      assistant provider through Iris `AgentRunManager` and the Moirai gateway;
      the bounded Clio writer/verifier output must then pass Clio source
      membership and entailment, Sophia grounding, Isis behavior policy, and the
      Iris quality gate. The server-side firewall accepts only post-batch,
      subscribed, non-adult channel summaries and omits ungranted daypart,
      coarse-presence, and continuity bytes before either provider prompt.
      Read-only recap and Thread generation never write Ori or Iris memory.
      Morning Thread, explicit-press ElevenLabs voice ducking, and user-selected
      memorial dates remain independently consented; crisis and screen-share
      frames suppress them before generation/playback. PostgreSQL stores the
      append-only fingerprinted consent chain, narration cache, meaningful
      dates, daily usage, and inference reservations; failed or crash-uncertain
      dispatches conservatively charge their full reservation. Privacy-admin
      revocation remains available while the beta is off, account deletion
      erases every Ori table, and the staged rollout/telemetry/rollback contract
      is documented in `RB2_ORI_PRESENCE_BETA_RUNBOOK.md`. Direct contract tests
      (5), channel tests (10), BFF consent/store/adapter/runtime/route/deletion
      tests (45), a real PostgreSQL migration-and-restart integration test (1),
      Phase A invariants (8), Iris agents-core (208), Moirai (15), Sophia (5),
      Isis (7), Clio (14), assistant provider (9), voice synthesis (59), web
      tests (149), and desktop/mobile Playwright (12) pass. Affected lint,
      contract/channel/governance/persistence/web typechecks, Prisma validation,
      environment ownership/split checks, BFF production bundling, V10 web
      production build, and `git diff --check` also pass. The monolithic BFF
      typecheck was additionally attempted with an 8 GiB heap and remains
      blocked by the repository's broad pre-existing errors in unrelated
      Arete/Yemaya/Iris surfaces; focused RB.2 diagnostics report no Ori errors
      and the production bundle is green._

### RB.3 Streaming substrate extraction from Aphrodite (§7.10a, §10)

Substrate:
`apps/aphrodite/{streaming,broadcaster,viewer,chat,cdn,notifications,payment,...}`
(17 services), plus `libs/aphrodite/*` streaming-adjacent libs.

- [x] Audit pass over the 17 services: for each, record (in a substrate
      extraction doc next to this file or in `docs/`) its role, its
      tenant-specific vs generic parts, and its reuse verdict for the video
      lane. Sequential read, one service at a time — no agent fan-out beyond
      one. _Evidence: `RB3_APHRODITE_STREAMING_SUBSTRATE_AUDIT.md` records all
      17 deployables in sequential order, a source-level map of 36 directly
      adjacent Aphrodite libraries, existing shared/Neith stack boundaries, the
      `libs/shared/live-media` canonical-home decision, and the incremental
      tenant-equivalence order. The audit explicitly leaves extraction and all
      implementation/E2E checkboxes open._
- [ ] Extract the generic streaming substrate (the consolidation move — built
      ONCE):
  - [x] `libs/shared/streaming` (or repo-conventional home — decide from the
        audit): ingest, transcode/delivery orchestration, viewer session, live
        chat, presence/viewer-count, notifications hooks — as
        tenant-parameterized services with Aphrodite as tenant #1 (its services
        become thin tenant configs over the substrate, NOT a fork). _Completed
        in the audit-selected repo-conventional home `libs/shared/live-media`.
        The canonical package owns each listed organ; Aphrodite's production
        services retain product policy as tenant-fixed SQL/provider adapters
        rather than a fork. Detailed organ-by-organ evidence and release gates
        are recorded in `RB3_APHRODITE_STREAMING_SUBSTRATE_AUDIT.md`._
  - [x] Migration is incremental and behind equivalence tests: each extracted
        organ gets a test proving Aphrodite's behavior is unchanged (contract
        tests against the pre-extraction service behavior). _Completed through
        increments 1–8ak. Existing Aphrodite route/store suites remained the
        behavior oracle throughout extraction; shared contract/unit, forced-RLS
        integration, real provider/media, and final four-product equivalence
        suites now cover the migrated organs. The final 2026-07-22 release run
        passed 333 shared and 199 Aphrodite-adapter tests plus the product and
        supervised local ingest-to-Rail gates recorded below._
  - [ ] Veritas (RB.1 first-party seam) and V3 Stage (concert live moments)
        become tenants #2/#3; RA.4's `first-party-live` class flips from
        `not_configured` to real HLS/DASH playback against this substrate,
        exercised end-to-end with a test stream on this box (mind memory — one
        service set at a time, teardown after). _Progress through increment 6
        plus increments 7b–7m's real content-analysis, recording, AES-128 HLS
        segment-encryption, visible-watermark, browser-HLS/DASH player,
        browser-WHIP publisher, native HLS/DASH player, and native-SRT publisher
        providers (including the increment 7a extension-contract foundation),
        verified 2026-07-19: the canonical `@oshun/live-media` organ now owns
        tenant/resource contracts, durable publisher grants and edge
        reconciliation, real Neith/FFmpeg transcode execution, immutable
        HLS/DASH publication, durable leased/fenced pipeline jobs, signed
        playback grants, entitlement-bounded leased viewer sessions, exact
        multi-node presence, immutable QoE/lifecycle ledgers, and exact-object
        origin authorization bound to an active viewer lease. It now also owns
        tenant/resource live-chat memberships, leased presence, durable bounded
        history, idempotency/rate limits, ordered events, room clears, and
        server-only tip/system publication. Aphrodite's streaming, viewer, and
        chat apps are thin production compositions over forced-RLS PostgreSQL
        adapters and fail closed when configuration, identity, entitlement,
        media, session, or moderation state is absent. The shared organ now also
        owns a strict tenant/resource operational-event and metric envelope,
        resource-exact telemetry authorization, an idempotent durable event
        ledger, and leased notification/moderation/audit hook delivery with
        explicit retry, provider-error, lost-lease, and dead-letter outcomes.
        Migration `00012` adds a forced-RLS warehouse and atomic hook outbox
        before production composition; Aphrodite supplies only tenant-fixed SQL
        storage plus thin notification/moderation mappings. Publisher, viewer,
        QoE, chat, and moderation production paths emit bounded metadata without
        copying chat bodies; refresh and duplicate paths replay stable semantic
        identities without inflating counts, and durable Chat polling reprojects
        committed events after restart. The unauthenticated tenantless legacy
        analytics taxonomy remains product-owned. Supervised digest-pinned
        MediaMTX/PostgreSQL gates apply migrations `00005`–`00012`, exercise
        restart/recovery, concurrent claim/fencing, SQL tenant isolation,
        duplicate joins, two-store presence/fanout, QoE, expiry, reconnect,
        revocation, policy/moderation denial, advisory-lock contention, and
        invalid-tip rejection; prove exactly-once concurrent hook claiming,
        retry/dead-letter persistence, content non-disclosure, and cross-tenant
        telemetry denial; decode protected HLS and DASH; prove immediate
        session/publication revocation; and tear down cleanly. The parent item
        remains open: the remaining optional media/client adapters,
        Veritas/V3/Rail tenants, the consolidation guard, equivalence suite, and
        final ingest-to-Rail flow remain actionable. The shared contract now
        also names immersive, encryption, DRM, watermark, analysis, recording,
        publisher/player, guest, and composition adapters while requiring exact
        active authority, dependency-complete readiness, measured kind-specific
        conformance, and teardown before success. No simulated Aphrodite package
        is registered. The real `aphrodite.content-analysis.v1` provider now
        binds one exact ready publication object, performs checksum-bounded
        reads and real FFmpeg sampling, invokes the audited OpenAI-compatible
        analyzer with automatic action disabled, and persists privacy-bounded
        immutable evidence in migration `00013`'s forced-RLS, database-clock,
        heartbeat-renewed operation ledger. The supervised MediaMTX/PostgreSQL
        gate proves real-segment analysis, restart replay without reexecution,
        concurrent claim and stale-writer fencing, cross-tenant denial, and
        teardown. The real `aphrodite.recording.v1` provider binds a fresh exact
        publisher connection across durable and live MediaMTX state, performs
        cancellation-aware bounded FFmpeg stream-copy capture, FFprobes and
        hashes the container, and persists it through the shared streaming-safe
        create-only object store. Migration `00014` adds its forced-RLS,
        database-clock queue with semantic idempotency, renewable fenced leases,
        backoff, staged object recovery, and exact terminal evidence. The same
        supervised gate captures and independently probes real H.264/AAC MP4
        bytes, reconstructs the provider for no-recapture replay, recovers an
        expired lease, fences the stale worker, denies another tenant, and tears
        down. The real `aphrodite.segment-encryption.v1` provider accepts only
        one exact ready HLS VOD publication, validates its complete
        authoritative MPEG-TS graph, encrypts every segment with AES-128-CBC and
        media-sequence IVs, and publishes create-only manifests plus a key-free
        measured descriptor. Migration `00015` adds its forced-RLS,
        publication-bound, database-clock queue with semantic idempotency,
        renewable fenced leases, durable wrapped-key custody, staged-publication
        restart recovery, and exact terminal evidence. A PKCS#11 backend wraps
        the random data key under an existing nonextractable RSA-3072 HSM KEK;
        PostgreSQL and object descriptors never receive plaintext key bytes.
        Internal authenticated routes queue/read operations and deliver exactly
        128 recovered bits only from a succeeded durable record with no-store
        headers. The supervised PostgreSQL/SoftHSM/FFmpeg gate independently
        decodes the protected H.264/AAC HLS, reconstructs provider and custody
        state for exact replay, recovers an expired lease, fences the stale
        worker, and denies another tenant. Increment 7m now completes the
        bounded AES-128 viewer/client and destructive-cleanup path. A forced-RLS
        protected-publication lookup selects only the newest active succeeded
        operation for the exact ready source publication; HLS grants sign its
        immutable operation prefix and exact external key URI, while DASH stays
        on the clear source publication and no unsupported protected DASH URL is
        invented. Browser HLS.js and the native credential proxy admit the
        Bearer only for the exact protected ledger or signed key URI. The public
        key route revalidates the active viewer lease, source publication,
        protected operation, virtual key object, and custody before returning
        exactly 16 uncached bytes; wrong, stale, releasing, and released access
        is an indistinguishable empty `401`. Migration `00023` adds a
        database-clock `active` → `releasing` → `released` lifecycle, durable
        exact deletion plan, reclaimable release lease, custody digest, and an
        active-publication index. Release fences grants before deleting the
        exact protected objects, preserves every source object, shreds wrapped
        custody only after deletion succeeds, replays the same release time, and
        rejects operation resurrection. Real Chromium AES-128 decoding and
        sibling-key non-disclosure coverage plus the supervised
        PostgreSQL/SoftHSM/FFmpeg/native gate prove the complete path across
        reconstruction and cleanup. CENC/CBCS and external vendor DRM/CDM
        licensing remain explicitly open. The real `aphrodite.watermark.v1`
        provider accepts one exact ready H.264/AAC MPEG-TS publication object
        and applies only the tenant-fixed `aphrodite.visible-grid.v1` profile.
        Its payload identity is derived from the publication or an exact active,
        entitled viewer session; callers cannot choose the profile, key, token,
        output, or worker. A random data key is wrapped by the existing
        nonextractable RSA-3072 PKCS#11 KEK, while a domain-separated HMAC
        derives the 64-bit visible-grid token; plaintext key/token material is
        never durable. Real FFmpeg output is decoded to extract all 64 cells and
        measure luma PSNR outside the grid. Migration `00016` adds the
        forced-RLS, publication-bound, database-clock queue with fenced
        renewable leases, staged artifact recovery, exact replay, and a durable
        release fence after both output objects are deleted. The supervised
        PostgreSQL/SoftHSM/FFmpeg gate proves real transform evidence, restart
        replay without re-encoding, expired-lease recovery, stale-worker
        fencing, tenant denial, and destructive cleanup. This is explicitly a
        visible marker, not an invisible or forensically robust watermark. The
        real `aphrodite.player-client.v1` path now registers one credential-free
        operation for the exact ready publication, viewer session, playback
        grant, client instance, and exact HLS or DASH protocol. Migration
        `00017` adds its forced-RLS, database-clock, leased/reclaimable,
        QoE-foreign-keyed ledger; only a persisted playing sample with the exact
        grant and positive decoded frames can create success, and
        refresh/leave/failure release the operation. `@oshun/live-media/browser`
        contains the Bearer to the exact publication prefix through HLS.js or
        dash.js/MSE, reports ready only after a real decoded frame and matching
        durable heartbeat, and supplies an accessible protocol-neutral
        full-stage surface. FFmpeg-backed Chromium automation covers both
        protocols' repeated heartbeats, prefix escape, authorization loss,
        release, axe, mobile, and reduced motion; the supervised
        MediaMTX/PostgreSQL gate proves durable DASH proof, browser-device
        binding, refresh release, secret non-disclosure, and tenant isolation. A
        real `aphrodite.publisher-client.v1` path now gives browser publishers
        one exact grant-backed WHIP operation. The same-origin client contains
        the Bearer to the exact MediaMTX WHIP endpoint, sends supplied
        audio/video tracks over WebRTC, reports only monotonic outbound RTP
        counters, and becomes ready only when a durable heartbeat corroborates
        those counters with positive ingress from the exact authenticated edge
        connection. Migration `00018` adds the composite grant/resource-bound,
        forced-RLS, database-clock, leased/reclaimable ledger with one active
        publisher per stream and repeat-safe release. Unit, route, migration,
        real MediaMTX/PostgreSQL, and FFmpeg/Chromium automation prove OPTIONS
        versus source binding, secret containment, live encoded-video ingress,
        restart replay, tenant denial, authorization failure, and teardown.
        Increment 7i adds an explicit browser/native runtime discriminator to
        both client contracts and migration `00019`'s durable ledgers. Native
        publishers receive a credential-free SRT URL and, for remote endpoints,
        a required AES-256 passphrase; an isolated Rust process accepts secrets
        over standard input, keeps them out of FFmpeg arguments, and sends real
        MPEG-TS with a pure-Rust SRT 1.4.4 implementation. Native HLS/DASH
        playback keeps its Bearer in an exact-publication-prefix loopback proxy,
        constrains redirects and playable manifest references, drives real
        FFmpeg decode and ffplay rendering, and persists measured QoE. The
        supervised gate proves native encrypted SRT ingress, durable runtime
        binding, protected HLS/DASH decode, and non-black Xvfb rendering against
        real MediaMTX/PostgreSQL. This is a Linux native execution-component
        claim, not a complete desktop or mobile product UI. Increment 7j retires
        Aphrodite's public process-local VR simulation behind an explicit
        no-store 410 gateway and adds a real bounded browser immersive path.
        `@oshun/live-media/browser` now projects protected decoded
        equirectangular 180°/360° video through WebGL for flat/cardboard
        presentation, renders two cardboard eyes from mono/SBS/top-bottom
        sources, accepts pointer/keyboard/permission-backed device orientation,
        and measures Web Audio plus non-black and changed-view proof. Aphrodite
        Viewer exposes authenticated immersive register/evidence/release under
        the existing viewer lease. `aphrodite.immersive.v1` derives its exact
        operation/player/publication/session/client binding from the succeeded
        browser-player operation, while migration `00020` supplies forced RLS,
        database-clock lifecycle and worker fences, restart replay,
        expired-lease recovery, immutable privacy-bounded evidence, and release.
        Generated 1920×960 H.264/AAC stereo HLS and DASH pass single-worker
        Chromium coverage for real decoded pixels in two distinct eye buffers,
        360° device-orientation and 180° pointer view changes on paused source
        frames, positive audio, axe, mobile/reduced motion, Bearer/raw-tracking
        non-disclosure, and ordered teardown. The digest-pinned real
        MediaMTX/PostgreSQL gate proves migration, replay after reconstruction,
        stale-fence rejection, tenant denial, reconnect release, and explicit
        teardown. Cubemap/EAC, ambisonics, physical headsets, WebXR/OpenXR/
        visionOS, and capture/stitching remain explicit non-claims. Increment 7k
        retires Aphrodite's unsafe token-in-query, tenantless, schema-free
        remote-guest network authority behind a compatibility facade and adds a
        real bounded one-host/one-guest browser path. `@oshun/live-media` now
        owns strict registration, provision, signaling, evidence, and release
        contracts plus the two-person `RTCPeerConnection` client and accessible
        full-bleed studio surface. Aphrodite Broadcaster supplies only the
        authenticated tenant composition, no-store routes, and exact-path
        single-node WebSocket gateway. One-use invitation and signaling
        capabilities never enter URLs, SDP/ICE remain transient, and success
        requires reciprocal RTP evidence whose guest-outbound and host-inbound
        video flow is linked by a SHA-256 SSRC digest. Migration `00021` and
        `aphrodite.remote-guest.v1` supply exact publisher-grant binding, one
        active guest per stream, digest-only secret custody, forced RLS,
        database-clock expiry, semantic idempotency, restart replay,
        reclaimable/fenced execution, and repeat-safe release. Two-context
        single-worker Chromium coverage proves real reciprocal audio/video,
        third-participant rejection, URL/DOM/durable credential non-disclosure,
        invite-fragment scrubbing, proof and teardown states, axe, keyboard,
        mobile, and reduced motion. The supervised real PostgreSQL/MediaMTX gate
        proves secret rotation/one-use denial, durable SDP/ICE and raw-secret
        absence, restart replay, RLS isolation, database-clock expiry,
        abandoned-lease recovery, stale-fence rejection, release, and cleanup.
        SFU/MCU, TURN availability, multi-party, screen share, end-to-end media
        encryption, native/mobile clients, and multi-node signaling remain
        explicit non-claims. Increment 7l adds the bounded real browser
        composition path. `@oshun/live-media/browser` owns a Canvas 2D/Web Audio
        compositor and accessible full-stage surface for one to four exact live
        sources, deterministic single/grid/two-source picture-in-picture
        layouts, 640–1920-wide 16:9 output at 15–60 fps, optional audio mixing,
        and publication through the existing credential-contained WHIP client.
        Only source references, layout/output declarations, changed/non-black
        frame counts, bounded source-region hashes, and aggregate audio evidence
        reach the server. Aphrodite registers evidence only against the exact
        succeeded browser/WebRTC grant-backed publisher and connected edge with
        positive ingress. Migration `00022` supplies the forced-RLS,
        database-clock, replay-safe, leased/fenced lifecycle. Full single-worker
        Chromium coverage proves two changing Canvas sources, a real oscillator,
        distinct non-black regions, positive audio and MediaMTX RTP, axe,
        keyboard, mobile/reduced motion, denial, privacy, and ownership-correct
        teardown. The supervised PostgreSQL/MediaMTX gate proves migration,
        exact joins, reconstruction replay, abandoned-lease recovery,
        stale-fence rejection, tenant isolation, non-disclosure, repeat-safe
        release, and edge cleanup. Custom layouts, switching/transitions,
        GPU/OBS/native composition, SFU/MCU mixing, and multi-node orchestration
        remain explicit non-claims. Increment 8a establishes the SQL identity
        prerequisite for tenant onboarding. `@oshun/live-media` now owns an
        immutable, idempotent mapping between a tenant/resource UUID and its
        product-owned external identity, with memory and forced-RLS PostgreSQL
        stores. Migration `00024` backfills Aphrodite and any deployed shared
        ledger rows, normalizes the early telemetry UUID column, and replaces
        all 13 root shared-ledger `streams(id)` references with composite
        `(tenant_id, stream_id)` references to the substrate registry. New
        Aphrodite publisher-grant issuance registers the exact canonical stream
        mapping before writing the grant. A digest-pinned real PostgreSQL gate
        applies migrations `00005`–`00024`, uses the same substrate stream UUID
        independently for Aphrodite, Veritas, V3 Stage, and the V10 Rail, issues
        and authenticates durable grants after reconstruction, proves forced-RLS
        visibility and the complete constraint catalog, rejects conflicting
        mappings, and rejects a grant for an unregistered resource. This is
        identity/credential equivalence only, not completed tenant composition.
        Increment 8b removes Aphrodite-only assumptions from the canonical
        browser/native client API. Playback, publisher, immersive, remote-guest,
        and composition descriptors admit only kind-correct tenant-qualified
        adapter IDs; the browser controls bind that identity across their full
        lifecycle and reject swaps. Canonical functions, types, mounts, and DOM
        roots now use live-media names, while all prior `Aphrodite*` exports are
        deprecated exact aliases. Contract tests exercise Veritas playback and
        immersive plus V3 Stage publisher, composition, remote-guest, and native
        publisher identities, with non-Aphrodite native playback and negative
        wrong-kind/swap cases. All 243 shared tests, 19 Chromium scenarios, 14
        V10 guard cases, affected Aphrodite suites and typechecks, package lint,
        and the shared production build pass. This proves a portable client
        contract and Aphrodite equivalence, not real Veritas/V3/Rail provider
        composition or a Rail playback lane. The parent remains open for broader
        composition, remote-guest, and immersive runtimes, CENC/CBCS and vendor
        DRM, remaining conformance/recovery automation, real Veritas/V3/Rail
        adapters, the full tenant-equivalence suite, and final ingest-to-Rail
        flow. Increment 8c now extracts the media-pipeline command/query façade
        as `LiveMediaTenantPipelineJobControl`: a product fixes one validated
        tenant and its operate/manage principals once, while callers can supply
        only stream-local job inputs. Aphrodite's former façade is an exact thin
        tenant-#1 subclass with full-result enqueue/replay/get/list/cancel
        equivalence coverage. The Veritas Rail package supplies the first
        production-shaped tenant-#2 subclass, and tests prove runtime options
        cannot replace its tenant or principals. Shared-pipeline coverage uses
        the same stream UUID and idempotency key for Aphrodite and Veritas while
        proving independent records, cross-tenant query isolation, replay,
        cancellation, and invalid-configuration rejection. All 246 shared, 191
        passing plus one intentionally skipped Aphrodite adapter, 86 Veritas
        channel, and 14 V10 Phase A/consolidation tests pass, together with
        source/spec typechecks, targeted lint, dependency-inclusive builds, and
        frozen-lockfile validation. This closes a real control-plane extraction
        slice only: Veritas rehearsal bytes are not yet connected to the shared
        ingest/publication/viewer path, `first-party-live` remains
        `not_configured`, and V3/Rail production compositions plus the full
        ingest-to-playback equivalence gate remain open. Detailed evidence is in
        `RB3_APHRODITE_STREAMING_SUBSTRATE_AUDIT.md`. Increment 8d extracts the
        complete durable PostgreSQL pipeline-job store into the canonical
        server-only substrate. `SqlLiveMediaPipelineJobStore` receives an
        injected canonical database transaction port and fixes one tenant at
        construction while preserving forced RLS, advisory idempotency,
        `SKIP LOCKED` claims, database-clock leases, fencing, recovery,
        cancellation, and settlement. Aphrodite's prior store is now a thin
        constructor-compatible tenant-#1 wrapper that retains its default
        database and exact legacy tenant-mismatch error. Veritas control →
        shared service → shared SQL-store coverage proves tenant/RLS/advisory
        bindings, while negative coverage rejects Aphrodite cross-tenant
        enqueue/list calls before opening a transaction. All 248 shared tests,
        191 passing plus one intentionally skipped Aphrodite adapter test, 86
        Veritas channel tests, and 14 V10 Phase A/consolidation tests pass,
        together with five typechecks, targeted lint, dependency-inclusive
        builds, frozen-lockfile validation, and the digest-pinned real
        PostgreSQL plus MediaMTX persistence E2E. This is durable control-plane
        persistence progress, not a deployed Veritas database composition,
        Veritas ingest/publication/HLS flow, or V3/Rail completion;
        `first-party-live` remains `not_configured`. Increment 8e extracts the
        remaining durable identity/credential prerequisite into the canonical
        server-only substrate. `SqlLiveMediaResourceRegistryStore` preserves
        database-time immutable registration, tenant-wide advisory
        serialization, exact replay, and crossed-uniqueness rejection;
        `SqlLiveMediaPublisherGrantStore` preserves resource-local advisory
        serialization, atomic rotation, monotonic generations, digest-only
        lookup, and expected-grant revocation. Both fix a validated tenant,
        establish transaction-local forced-RLS context, and reject cross-tenant
        access before SQL while allowing thin product error translation.
        Aphrodite's former stores are now constructor-compatible tenant-#1
        subclasses with the exact legacy mismatch errors. Shared unit coverage
        exercises Veritas registry and grant service → SQL behavior. The
        digest-pinned PostgreSQL gate now uses the canonical stores directly for
        Aphrodite, Veritas, V3 Stage, and V10 Rail, proving same-UUID isolation,
        immutable mappings, grant issuance/authentication after reconstruction,
        the composite-FK catalog, RLS visibility, conflict/unregistered denial,
        and teardown. All 254 shared tests and 191 passing plus one
        intentionally skipped Aphrodite adapter test pass, along with 86 Veritas
        channel tests, all 14 V10 Phase A/consolidation tests, four source/spec
        typechecks, Nx-aware shared/adapter lint, dependency-inclusive builds,
        formatting, diff checks, and the real PostgreSQL gate. This removes an
        Aphrodite-named persistence dependency; it does not yet deploy a
        Veritas/V3/Rail publisher, connect rehearsal bytes to
        edge/publication/viewer/Rail playback, or flip `first-party-live`.
        Increment 8f extracts the durable publisher-edge and media-publication
        stores into the canonical server-only substrate.
        `SqlLiveMediaPublisherEdgeSessionStore` preserves resource-local
        advisory serialization, exact-connection refresh without revision
        inflation, atomic replacement, stale-disconnect rejection, and
        tenant-scoped connected-session listing. `SqlLiveMediaPublicationStore`
        preserves publication-local advisory serialization, exact-prefix
        reservation, durable source metadata, compare-and-swap lifecycle
        transitions, and exact terminal replay. Both fix a validated tenant,
        establish transaction-local forced-RLS context, and reject cross-tenant
        work before SQL; Aphrodite now retains only thin constructor-compatible
        tenant-#1 wrappers with its exact legacy mismatch errors. Direct shared
        coverage exercises Veritas behavior, while the digest-pinned PostgreSQL
        gate uses the canonical stores for Aphrodite, Veritas, V3 Stage, and V10
        Rail to persist an isolated grant, SRT edge connection, and publication
        reservation for the same stream UUID. Per-tenant forced-RLS visibility
        and recovery of all three authorities after reconstruction pass. All 260
        shared tests, 192 passing plus one intentionally skipped Aphrodite
        adapter test, 86 Veritas channel tests, and all 14 V10 Phase
        A/consolidation tests pass, along with four strict source/spec
        typechecks, Nx-aware lint, dependency-inclusive builds, and the real
        PostgreSQL gate. This does not yet send real non-Aphrodite bytes through
        MediaMTX, publish a ready HLS/DASH ledger, deploy a Veritas
        worker/viewer, complete Rail playback, or flip `first-party-live`.
        Increment 8g extracts the complete durable viewer-session, QoE, and
        presence state machine as `SqlLiveMediaViewerSessionStore`. The
        canonical server-only store fixes a validated tenant, establishes
        transaction-local forced-RLS context, serializes each resource, uses the
        database clock, expires stale leases/entitlements, preserves
        join/refresh/reconnect idempotency, fences heartbeat/leave by
        digest-only lease identity, commits lifecycle events and monotonic QoE,
        and derives active-session/unique-viewer presence atomically. Its former
        direct `streams` dependency is now an optional transactional projection
        port: the canonical default owns no product counter, while Aphrodite's
        thin tenant-#1 wrapper retains the exact current/peak/total projection,
        constructor, and legacy mismatch error. Direct Veritas tests and all
        existing Aphrodite store tests pass. The digest-pinned PostgreSQL gate
        now persists an isolated active viewer lease for Aphrodite, Veritas, V3
        Stage, and V10 Rail beside each tenant's resource, grant, edge, and
        publication, proves per-tenant RLS visibility, then reconstructs each
        active session and one-session/one-viewer presence snapshot. Its minimal
        Aphrodite product table has no viewer-counter columns, proving the
        canonical authority no longer depends on them. All 264 shared tests, 192
        passing plus one intentionally skipped Aphrodite adapter test, 86
        Veritas channel tests, and all 14 V10 Phase A/consolidation tests pass,
        along with four strict source/spec typechecks, Nx-aware lint,
        dependency-inclusive builds, formatting/diff checks, and the real
        PostgreSQL gate. The publications remain `publishing`: no real
        non-Aphrodite bytes, ready HLS/DASH ledger, playback grant, decoded Rail
        player, deployed non-Aphrodite worker/viewer, or `first-party-live` flip
        is claimed. Increment 8h extracts the complete durable live-chat
        persistence state machine as `SqlLiveMediaChatStore`. The canonical
        server-only store fixes a validated tenant, establishes
        transaction-local forced-RLS context, uses PostgreSQL time and advisory
        serialization, and preserves viewer-session/entitlement-bound
        membership, digest-only leases,
        join/heartbeat/reconnect/leave/expiry/revocation, presence, rate limits,
        immutable message idempotency, moderation-bound text, server messages,
        deletion/clearing, history, and the ordered event outbox/poll cursor.
        Aphrodite's store is now a thin tenant-#1 wrapper retaining its exact
        constructor, default database, mismatch error, and product-owned
        filter/policy configuration. Four direct Veritas tests and all ten
        Aphrodite SQL-behavior tests pass. The digest-pinned PostgreSQL gate now
        creates one isolated membership, message, and two ordered events for
        Aphrodite, Veritas, V3 Stage, and V10 Rail; forced RLS exposes only the
        current tenant, and reconstructed stores recover digest-authenticated
        history, one-member/one-participant presence, and ordered event polling
        after restart. The dedicated live-chat PostgreSQL concurrency/replay/
        expiry/moderation/recovery gate also passes. All 268 shared tests, 192
        passing plus one intentionally skipped Aphrodite adapter test, 59
        passing plus one intentionally skipped Aphrodite chat test, 86 Veritas
        channel tests, and all 14 V10 Phase A/consolidation tests pass, together
        with five strict typechecks, shared/adapter/chat lint,
        dependency-inclusive builds, formatting/diff checks, and both real
        PostgreSQL gates. The publications remain `publishing`; no real
        Veritas/V3/Rail bytes, ready HLS/DASH ledger, playback grant, decoded
        Rail player, deployed non-Aphrodite chat composition, final
        tenant-equivalence gate, or `first-party-live` flip is claimed.
        Increment 8i extracts the complete durable operational event ledger and
        hook outbox as `SqlLiveMediaOperationalTelemetryStore`. The canonical
        server-only store fixes a validated tenant, establishes
        transaction-local forced-RLS context, atomically persists each event and
        its selected configured deliveries, and preserves advisory-lock semantic
        idempotency, conflict fingerprints, a monotonic database sequence, exact
        resource queries, database-clock `SKIP LOCKED` claim/reclaim,
        final-expiry dead-lettering, and lease-fenced complete/fail/retry
        transitions. Aphrodite's store is now a thin tenant-#1 wrapper retaining
        its default database, positional constructor, and exact mismatch error;
        its hook registrations/providers and legacy analytics remain
        product-owned. The extraction also corrects the stale UUID casts left
        after migration 00024 normalized registry stream keys to text, with
        direct regression assertions and real restart reads covering the fix.
        Five direct Veritas tests and all five Aphrodite SQL-behavior tests
        pass. The digest-pinned PostgreSQL gate now commits one isolated
        operational event and pending `rail.audit` delivery for Aphrodite,
        Veritas, V3 Stage, and V10 Rail, proves exact forced-RLS visibility,
        then reconstructs each store to query the event, claim the delivery, and
        complete it with a provider reference. The dedicated chat gate
        additionally proves concurrent hook claims, retry/dead-letter behavior,
        bounded body-free content, and cross-tenant rejection. All 273 shared
        tests, 192 passing plus one intentionally skipped Aphrodite adapter
        test, 59 passing plus one intentionally skipped Aphrodite chat test, 86
        Veritas channel tests, and all 14 V10 Phase A/consolidation tests pass,
        together with five strict typechecks, shared/adapter/chat lint,
        dependency-inclusive builds, formatting/diff checks, and both real
        PostgreSQL gates. Hook-provider deployment for Veritas/V3/Rail, real
        non-Aphrodite bytes, a ready HLS/DASH ledger, playback grants, decoded
        Rail playback, the final tenant-equivalence gate, and `first-party-live`
        remain open. Increment 8j extracts the remaining viewer-session,
        operational-telemetry, and playback-grant authority facades as
        `LiveMediaTenantViewerSessionControl`,
        `LiveMediaTenantOperationalTelemetryControl`, and the server-only
        `LiveMediaTenantPlaybackGrantControl`. Each validates and fixes one
        tenant/principal at construction, mints its request scope internally,
        validates exact stream/publication identities, and exposes no caller
        tenant or capability override. Aphrodite's former controls are now thin
        constructor-compatible tenant-#1 wrappers retaining its exact
        principals, timing/ID seams, SQL default, product hook registrations,
        and playback-service injection. Direct shared tests prove same-stream
        tenant isolation, viewer/QoE/telemetry behavior, idempotent hook
        creation, invalid fixed authority, and Veritas/V3/Rail grant delegation;
        existing operational, protected-playback, and all 105 viewer integration
        tests remain green. The four-tenant PostgreSQL gate now enters viewer
        join plus restart active/presence through tenant-fixed viewer controls
        and operational writes through tenant-fixed telemetry controls for all
        four tenants. All 279 shared tests, 192 passing plus one intentionally
        skipped Aphrodite adapter test, 59 passing plus one intentionally
        skipped Aphrodite chat test, 105 viewer integration tests, 86 Veritas
        channel tests, and all 14 V10 Phase A/consolidation tests pass, together
        with eight strict typechecks, graph-aware shared/adapter lint,
        dependency-inclusive shared/adapter builds, the direct viewer production
        bundle, formatting/diff checks, and both real PostgreSQL gates. The
        publications remain `publishing`; deployed Veritas/V3/Rail viewer/grant/
        hook compositions, real non-Aphrodite bytes, a ready HLS/DASH ledger,
        decoded Rail playback, final tenant equivalence, and `first-party-live`
        remain open. Increment 8k extracts publisher-grant issuance/registration
        and transcode execution authority as the server-only
        `LiveMediaTenantPublisherGrantControl` and
        `LiveMediaTenantTranscodeExecutionControl`. Each fixes and validates a
        tenant at construction and accepts no runtime tenant or capability. The
        publisher control also fixes the owner-product mapping, registers the
        immutable resource before issuing a secret, and binds authenticate,
        rotation, and revocation to the same tenant. The transcode control fixes
        its worker principal and absolute output root, then mints exact operate
        scopes, execution identities, resources, and tenant-namespaced output
        URIs internally. Aphrodite's prior controls are now thin constructor-
        compatible tenant-#1 wrappers retaining their SQL defaults, optional
        registry behavior, product mapping, principal, error text, timing, and
        random-ID seams. Seven direct tests prove Veritas/V3 same-stream grant
        isolation, mapping, V10 management authority, invalid configuration, and
        Veritas/V3/Rail transcode delegation. The four-tenant PostgreSQL gate
        now enters registration, grant issuance, and restart authentication
        through the publisher control for all four tenants, while the real
        digest-pinned MediaMTX/PostgreSQL gate passes through the transcode
        wrapper and worker path. All 286 shared tests, 192 passing plus one
        intentionally skipped Aphrodite adapter test, the full Aphrodite
        streaming and broadcaster test targets, 86 Veritas channel tests, and
        all 14 V10 Phase A/consolidation tests pass, together with six strict
        typechecks, graph-aware shared/adapter lint, dependency-inclusive
        shared/adapter builds, direct streaming/broadcaster production bundles,
        formatting/diff checks, and both real container gates. The publications
        remain `publishing`; deployed Veritas/V3/Rail ingest/worker
        compositions, real non-Aphrodite bytes, a ready HLS/DASH ledger,
        playback grants, decoded Rail playback, final tenant equivalence, and
        `first-party-live` remain open. Increment 8l extracts publisher-edge
        callback and reconciliation authority as the canonical
        `LiveMediaTenantPublisherEdgeControl`. It validates and fixes one tenant
        and edge principal at construction, parses every stream, creates operate
        scopes internally, binds provider reconciliation to that tenant, and
        preserves stable publisher/live and disconnected/ended telemetry from
        durable connection revisions. Aphrodite's former implementation is now a
        thin tenant-#1 constructor wrapper retaining its default forced-RLS
        store, default telemetry, injection opt-out, principal, clock,
        request-ID seam, routes, and errors. Three canonical tests prove
        Veritas/V3 same-stream isolation, duplicate event identity, V10 Rail
        reconciliation, and invalid fixed authority; all 289 shared tests and
        192 passing plus one intentionally skipped adapter test pass, together
        with the full Streaming target, 86 Veritas tests, all 14 Phase A tests,
        six strict typechecks, graph-aware shared/adapter lint, dependency-
        inclusive shared/adapter builds, the direct Streaming bundle,
        formatting/diff checks, and both digest-pinned real container gates. The
        four-tenant PostgreSQL gate now enters publisher observation through the
        fixed-tenant edge control. This does not claim deployed non-Aphrodite
        edges, real non-Aphrodite ingress, ready HLS/DASH, playback grants,
        decoded Rail playback, final tenant equivalence, or a `first-party-live`
        flip. Increment 8m extracts the remaining media-publication publish/get/
        revoke authority as `LiveMediaTenantMediaPublicationControl`. It fixes
        and validates one tenant plus worker/reader/manager principals, mints
        request/publication identities and exact scopes internally, and accepts
        no caller tenant, resource, timestamp, or capability. Aphrodite's prior
        class is now a tenant-#1 wrapper retaining its constructor, timing/ID
        seams, and deprecated legacy grant compatibility method; current
        protocol-aware viewer grants remain in `AphroditePlaybackGrantControl`.
        Three direct canonical tests prove same-stream/same-publication-ID
        Veritas/V3 isolation through ready in-process object ledgers, fixed V10
        Rail authority, caller-authority replacement, tenant-local revocation,
        and invalid fixed configuration. All 292 shared tests and 192 passing
        plus one intentionally skipped adapter test pass, together with the full
        Streaming target, 86 Veritas tests, all 14 Phase A tests, six strict
        typechecks, graph-aware shared/adapter lint, dependency-inclusive
        builds, the direct Streaming bundle, formatting/diff checks, and both
        digest-pinned real container gates. This does not claim deployed
        non-Aphrodite publication workers, real non-Aphrodite bytes, ready
        non-Aphrodite HLS/DASH, issued playback grants, decoded Rail playback,
        final tenant equivalence, or a `first-party-live` flip. Increment 8n
        extracts the remaining live-chat runtime authority as
        `LiveMediaTenantLiveChatControl`. It fixes one validated tenant plus
        presence/system/payment/fanout principals, creates exact scopes
        internally, validates every resource identity, and binds join,
        viewer-resolution, membership, moderation, messages, presence, system/
        tip publication, event polling, and content-free operational telemetry
        to that tenant. Aphrodite's former class is now a thin tenant-#1 wrapper
        retaining its constructor, exact error identity/codes, SQL participant/
        entitlement/moderation policies, filter and service tuning, telemetry,
        routes, and socket runtime. Five direct shared tests prove same-stream/
        session/message-key Veritas/V3 isolation over one store, tenant-local
        moderation/presence/events, fixed V10 Rail system/tip principals, fixed
        scopes, content-free telemetry, and fail-closed authority; an Aphrodite
        runtime assertion proves exact compatibility errors. All 297 shared
        tests, 192 passing plus one intentionally skipped adapter test, 60
        passing plus one intentionally skipped Chat test, 86 Veritas tests, and
        all 14 Phase A tests pass, together with six strict typechecks, graph-
        aware shared/adapter/Chat lint, dependency-inclusive shared/adapter/Chat
        builds, formatting/diff checks, the real Chat/PostgreSQL policy/store
        gate, and the four-tenant durable PostgreSQL gate. This does not claim
        deployed Veritas/V3/Rail chat policy/socket/hook compositions, real
        non-Aphrodite chat use or media bytes, ready HLS/DASH, playback grants,
        decoded Rail playback, final tenant equivalence, or a `first-party-live`
        flip. Increment 8o extracts content-analysis probe/analyze/teardown
        authority as `LiveMediaTenantContentAnalysisControl`. It fixes and
        validates one tenant plus one adapter ID, creates exact operate scopes
        and resources internally, and reconstructs the strict `content-analysis`
        request so callers cannot replace tenant, adapter, kind, capability, or
        resource authority. Aphrodite's prior class is now a tenant-#1 wrapper
        fixing `aphrodite.content-analysis.v1` while retaining its constructor,
        schema/type exports, timing/ID seams, publication binding, advisory
        policy, provider, forced-RLS queue, worker, and Streaming routes. Three
        direct shared tests drive one real optional-adapter service with
        independent in-process Veritas/V3 providers and equal
        stream/publication/operation/idempotency identities, proving fixed
        provider/binding/scope/result/teardown isolation plus V10
        caller-override and malformed-authority rejection. All 300 shared tests,
        192 passing plus one intentionally skipped adapter test, 108 passing
        plus one intentionally skipped Streaming test, 86 Veritas tests, and all
        14 Phase A tests pass, together with six strict typechecks, graph-aware
        shared/adapter/Streaming lint, dependency-inclusive shared (+6), adapter
        (+13), and Streaming (+14) builds, formatting/diff checks, and the
        digest-pinned real MediaMTX/PostgreSQL/FFmpeg content-analysis gate.
        This does not claim deployed or real Veritas/V3/Rail analyzers,
        policies, queues, workers, or analysis; non-Aphrodite media, ready
        HLS/DASH, playback grants, decoded Rail playback, final tenant
        equivalence, and a `first-party-live` flip remain open. Increment 8p
        extracts durable recording admission/query and worker authority as
        `LiveMediaTenantRecordingControl` and `LiveMediaTenantRecordingWorker`.
        They fix one validated tenant and adapter at construction; own strict
        inputs, exact operate scopes, publisher-connection binding, readiness,
        semantic fingerprinting, queue reservation/read, and worker execution;
        and reject mismatched durable tenant/adapter authority before provider
        access. Aphrodite's control and worker are now thin tenant-#1 wrappers
        retaining their constructors, schema/type exports, forced-RLS queue and
        record validation, MediaMTX binding/source authority, retention policy,
        FFmpeg executor, create-only object store, scheduler/routes, clocks/IDs,
        and shutdown cancellation. Its legacy fingerprint delegates to the
        shared canonical implementation. Three direct shared tests drive one
        real optional-adapter service with independent Veritas/V3 providers and
        equal recording identities, proving queue, fingerprint, binding, scope,
        provider, and result isolation plus caller-override,
        malformed-authority, and durable mismatch rejection. All 303 shared
        tests, 192 passing plus one intentionally skipped adapter test, 108
        passing plus one intentionally skipped Streaming test, 86 Veritas tests,
        and all 14 Phase A tests pass, together with six strict typechecks,
        graph-aware shared, adapter, and Streaming lint, dependency-inclusive
        shared (+6), adapter (+13), and Streaming (+14) builds, formatting/diff
        checks, and the digest-pinned MediaMTX/PostgreSQL/FFmpeg gate, which now
        admits and executes the real Aphrodite recording through the wrappers
        before probing its H.264/AAC MP4 while preserving replay, recovery,
        fencing, tenant denial, and teardown. This does not claim deployed
        Veritas/V3/Rail recording sources, policies, stores, workers, or real
        capture; ready non-Aphrodite HLS/DASH, playback grants, decoded Rail
        playback, final tenant equivalence, and a `first-party-live` flip remain
        open. Increment 8q extracts segment-encryption probe/admission/query,
        protected-key delivery, repeat-safe release, and worker authority as
        `LiveMediaTenantSegmentEncryptionControl` and
        `LiveMediaTenantSegmentEncryptionWorker`. They validate and fix one
        tenant plus adapter at construction; own the strict input and canonical
        fingerprint, exact operate scopes/resources, policy/binding/readiness
        checks, bounded queue reservation/read, custody recovery gate, signed
        optional-adapter teardown, and worker execution; and reject a durable
        operation, resource, adapter, tenant, or fingerprint mismatch before
        custody or provider access. Aphrodite's control and worker are now thin
        tenant-#1 wrappers retaining their constructors, schema/type exports,
        exact product error class/codes, static key policy, PKCS#11 custody,
        forced-RLS queue, AES-128 provider, routes, scheduler, and timing/ID
        seams. Its legacy fingerprint delegates to the shared canonical
        implementation. Three direct shared tests drive one real optional-
        adapter service with independent Veritas/V3 providers and equal
        encryption identities, proving queue/fingerprint/binding/scope/provider,
        128-bit key URI/custody, result, and release isolation plus caller-
        override, malformed-authority, policy, and durable-mismatch rejection.
        All 306 shared tests, 192 passing plus one intentionally skipped adapter
        test, 108 passing plus one intentionally skipped Streaming test, 86
        Veritas tests, and all 14 Phase A tests pass, together with six strict
        typechecks, graph-aware shared/adapter/Streaming lint, dependency-
        inclusive shared (+6), adapter (+13), and Streaming (+14) builds,
        formatting/diff checks, and the digest-pinned MediaMTX/PostgreSQL/
        SoftHSM/FFmpeg/Chromium gate. The real ready Aphrodite HLS publication
        is now admitted through the wrapper and encrypted through its worker
        before independent protected H.264/AAC decode; restart replay, exact key
        authorization/non-disclosure, sibling denial, lease recovery, stale-
        writer fencing, tenant denial, destructive release, source preservation,
        custody shredding, and teardown remain green. This does not claim
        deployed Veritas/V3/Rail key policies, custody, queues, workers, or real
        encryption; CENC/CBCS/vendor DRM, ready non-Aphrodite HLS/DASH, playback
        grants, decoded Rail playback, final tenant equivalence, and a
        `first-party-live` flip remain open. Increment 8r extracts visible-
        watermark probe/admission/query, repeat-safe release, and worker
        authority as `LiveMediaTenantWatermarkControl` and
        `LiveMediaTenantWatermarkWorker`. They validate and fix one tenant plus
        adapter at construction; own the strict input and canonical semantic
        fingerprint, exact operate scopes/resources, policy-derived profile,
        payload, and key references, publication/viewer binding and readiness
        checks, bounded queue reservation/read, durable-authority validation,
        signed optional-adapter teardown, and worker execution; and reject a
        durable operation, resource, adapter, tenant, or fingerprint mismatch
        before release or provider access. Aphrodite's control and worker are
        now thin tenant-#1 wrappers retaining their constructors, schema/type
        exports, exact product error class/codes, visible-grid policy, PKCS#11
        custody, forced-RLS queue, FFmpeg provider, routes, scheduler, and
        timing/ID seams. Its legacy fingerprint delegates to the shared
        canonical implementation. Three direct shared tests drive one real
        optional-adapter service with independent Veritas/V3 providers and equal
        stream/operation/publication/viewer/source/idempotency identities,
        proving queue/fingerprint/binding/scope/provider/result and release
        isolation plus caller-override, malformed-authority, policy, and
        durable-mismatch rejection. All 309 shared tests, 193 passing plus one
        intentionally skipped adapter test, 108 passing plus one intentionally
        skipped Streaming test, 86 Veritas tests, and all 14 Phase A tests pass,
        together with six strict typechecks, graph-aware shared/adapter/
        Streaming lint, dependency-inclusive shared (+6), adapter (+13), and
        Streaming (+14) builds, formatting/diff checks, and the supervised real
        MediaMTX/PostgreSQL/SoftHSM/FFmpeg gate. The real Aphrodite watermark is
        now admitted and transformed through the wrappers and released through
        the reconstructed control while real 64-cell extraction, luma PSNR,
        restart replay, lease recovery, stale-writer fencing, token/custody
        non-disclosure, RLS tenant denial, exact artifact deletion, resurrection
        denial, and teardown remain green. This does not claim deployed
        Veritas/V3/Rail watermark policies, custody, queues, workers, or real
        transforms; the visible-grid marker is not invisible or forensically
        robust, and ready non-Aphrodite HLS/DASH, playback grants, decoded Rail
        playback, final tenant equivalence, and a `first-party-live` flip remain
        open. Increment 8s extracts player-grant registration, decoded-media
        observation, synchronous provider execution, and release authority as
        `LiveMediaTenantPlayerClientControl`. It validates and fixes one tenant,
        adapter, and service principal; binds the grant to an active leased
        viewer session by tenant, stream, session ID, and subject before probe;
        owns runtime selection, readiness, canonical exact-issuance
        fingerprinting, reservation, positive playing/decoded-frame QoE staging,
        execution, durable success, and teardown/released validation; and
        rejects a mismatched durable resource, adapter, operation, session,
        grant, or fingerprint before provider access.
        `AphroditePlayerClientControl` is now a thin tenant-#1 wrapper retaining
        its constructor, operation alias, product errors, forced-RLS PostgreSQL
        queue/parser, lease/fencing provider, browser/native HLS/DASH
        references, protected-playback composition, and routes. It fixes the
        Aphrodite service principal after caller options are spread, and its
        legacy fingerprint delegates to the shared canonical implementation.
        Three direct shared tests drive one real optional-adapter service with
        independent Veritas/V3 providers and equal
        stream/publication/session/grant/QoE/operation identities, proving
        queue, fingerprint, binding, scope, provider, evidence, result, and
        release isolation plus caller-override, malformed-authority, unsupported
        cast, durable-mismatch, and stale-fingerprint rejection. An adversarial
        Aphrodite compatibility case additionally proves runtime-only tenant,
        adapter, principal, parser, and descriptor overrides cannot weaken the
        wrapper. All 312 shared tests, 194 passing plus one intentionally
        skipped adapter test, 108 passing plus one intentionally skipped
        Streaming test, 86 Veritas tests, and all 14 Phase A tests pass,
        together with six strict typechecks, graph-aware
        shared/adapter/Streaming lint, dependency-inclusive shared (+6), adapter
        (+13), and Streaming (+14) builds, formatting/diff checks, and the
        supervised real MediaMTX/PostgreSQL/SoftHSM/FFmpeg/Chromium gate. The
        real protected-playback path exercises the reconstructed wrapper from
        grant registration through positive decoded DASH QoE, durable proof,
        replacement/RLS isolation, and final release. This does not claim
        deployed Veritas/V3/Rail player providers, stores, policies, or decoded
        runtimes; ready non-Aphrodite HLS/DASH and playback grants, decoded Rail
        playback, final tenant equivalence, and a `first-party-live` flip remain
        open. Increment 8t extracts active publisher-grant registration,
        independently authenticated edge binding, positive publisher-runtime
        evidence staging, synchronous provider execution, query, and repeat-safe
        release authority as `LiveMediaTenantPublisherClientControl`. It
        validates and fixes one tenant, adapter, and service principal; reparses
        the active non-revoked, unexpired grant before readiness access; owns
        strict runtime/protocol and edge-identity input, exact-issuance
        fingerprinting, reservation, legacy unregistered-grant compatibility,
        protocol and timestamp binding, durable two-sided evidence admission,
        success validation, and teardown; and rejects a mismatched durable
        tenant, stream, adapter, operation/grant identity, or fingerprint before
        binding, provider execution, query, or release.
        `AphroditePublisherClientControl` is now a thin tenant-#1 wrapper
        retaining its constructor and operation alias, exact product errors,
        forced-RLS PostgreSQL queue/parser, active-grant and authenticated
        MediaMTX edge checks, leasing/fencing provider, browser WHIP and native
        SRT runtime references, production runtime composition, and ingest and
        broadcaster flows. It fixes the Aphrodite tenant, adapter, principal,
        parser, descriptor, and error factory after caller options are spread;
        its legacy fingerprint delegates to the shared canonical implementation.
        Three direct shared tests drive one real optional-adapter service with
        independent Veritas/V3 providers and tenant queue views over one record
        map using equal stream/grant/client/edge/connection/evidence identities.
        They prove queue, fingerprint, scope, verifier, provider, evidence,
        result, query, and release isolation plus inactive/cross-tenant grants,
        malformed edge/fixed authority, runtime/protocol mismatch, wrong durable
        tenant/adapter, and stale-fingerprint rejection before protected access.
        An Aphrodite compatibility case additionally proves runtime-only tenant,
        adapter, principal, parser, descriptor, and error-factory overrides
        cannot weaken the wrapper while registration replay, durable
        active-grant revalidation, product errors, and repeat-safe release
        remain compatible. All 315 shared tests, 195 passing plus one
        intentionally skipped adapter test, 108 passing plus one intentionally
        skipped Streaming test, 86 Broadcaster tests, 86 Veritas tests, and all
        14 Phase A tests pass, together with eight strict source/spec/consumer
        typechecks, graph-aware lint for all six affected/guard projects,
        dependency-inclusive shared (+6), adapter (+13), Streaming (+14), and
        Broadcaster (+16) builds, formatting/diff checks, and the supervised
        real MediaMTX/PostgreSQL/SoftHSM/FFmpeg/Chromium gate. The real
        native-SRT publisher path exercises the reconstructed wrapper from
        registration through exact authenticated edge binding, positive
        client/ingress evidence, execution, restart replay, forced-RLS sibling
        denial, and final release; the same gate retains the browser-WHIP
        publisher and broader protected-media assertions. This does not claim
        deployed Veritas/V3/Rail publisher providers, stores, edge integrations,
        or client runtimes; ready non-Aphrodite HLS/DASH, playback grants,
        decoded Rail playback, final tenant equivalence, and a
        `first-party-live` flip remain open. Increment 8u extracts host
        registration, one-use invitation exchange, signaling authority,
        reciprocal transport-evidence admission, synchronous provider execution,
        query, and repeat-safe release as `LiveMediaTenantRemoteGuestControl`.
        It validates and fixes one tenant, adapter, service principal, and
        credential-free secure WebSocket base; generates operation/session
        identities and raw capabilities internally; owns the compatible
        canonical registration and exchange fingerprints, readiness scope,
        digest-only queue boundary, two-sided role-correct evidence gate,
        durable success/release checks, and tenant-fixed signaling claims; and
        reparses every returned record to reject a wrong tenant, stream,
        adapter, operation/session/grant/client identity, or fingerprint before
        returning a descriptor or invoking downstream authority.
        `AphroditeRemoteGuestControl` is now a thin tenant-#1 wrapper retaining
        its constructor and session aliases, exact product errors, forced-RLS
        PostgreSQL queue, active publisher-grant binding, one-use secret
        rotation, WebSocket hub, leasing/fencing provider, Broadcaster routes,
        and two-browser WebRTC runtime. It fixes the Aphrodite tenant, adapter,
        principal, parser, descriptor, and error factory after caller options
        are spread; both legacy fingerprints delegate to the shared canonical
        implementations. Three direct shared tests drive one real
        optional-adapter service with independent Veritas/V3 providers and
        tenant queue views over one record map using equal stream, grant,
        operation, session, host/guest client, invitation, signaling, evidence,
        and request identities. They prove queue, fingerprint, scope, verifier,
        provider, signaling, evidence, result, query, and release isolation plus
        replay rotation, malformed fixed authority, role mismatch, cross-tenant
        signaling, wrong durable authority, and stale-fingerprint rejection. An
        Aphrodite compatibility case additionally proves runtime-only tenant,
        adapter, principal, parser, descriptor, and error-factory overrides
        cannot weaken the wrapper while the exact product error survives. All
        318 shared tests, 196 passing plus one intentionally skipped adapter
        test, 6 remote-guest compatibility tests, 108 passing plus one
        intentionally skipped Streaming test, 86 Broadcaster tests, 86 Veritas
        tests, and all 14 Phase A tests pass, together with eight strict
        source/spec/consumer typechecks, graph-aware lint for all seven affected
        and guard projects, dependency-inclusive shared (+6), adapter (+13),
        remote-guest compatibility (+7), Streaming (+14), and Broadcaster (+16)
        builds, formatting/diff checks, two single-worker Chromium desktop/
        mobile scenarios, and the supervised real MediaMTX/PostgreSQL/SoftHSM/
        FFmpeg/Chromium gate. The real gate exercises reconstructed Aphrodite
        registration replay and capability rotation, invitation exchange, exact
        signaling, reciprocal proof, restart replay, forced-RLS sibling denial,
        durable SDP/ICE/raw-secret non-disclosure, lease recovery and stale
        fencing, and repeat-safe release; the browser gate independently proves
        reciprocal media, accessibility, mobile/reduced motion, third-
        participant denial, credential containment, and teardown. This does not
        claim deployed Veritas/V3/Rail guest providers, stores, publisher-grant
        integrations, signaling gateways, or browser/native runtimes; SFU/MCU,
        TURN availability, multi-node signaling, ready non-Aphrodite HLS/DASH,
        playback grants, decoded Rail playback, final tenant equivalence, and a
        `first-party-live` flip remain open. Increment 8v extracts protected-
        browser-player registration, descriptor/client admission, privacy-
        bounded render-evidence observation, synchronous optional-provider
        execution, and repeat-safe release as
        `LiveMediaTenantImmersiveSessionControl`. It validates and fixes one
        tenant, immersive adapter, and service principal; reparses the active
        player request and its canonical fingerprint; binds exact tenant,
        stream, viewer session, grant/operation, publication, browser client,
        lifecycle, descriptor, and capabilities before readiness or queue
        access; owns the compatible canonical immersive fingerprint and exact
        evidence-to-request gate; and rejects a mismatched durable resource,
        adapter, operation/session/grant identity, or fingerprint before
        provider execution or teardown. `AphroditeImmersiveSessionControl` is
        now a thin tenant-#1 wrapper retaining its constructor and operation
        alias, exact product errors, forced-RLS PostgreSQL player/immersive
        stores, lease/fencing provider, Viewer routes/runtime, timing/ID seams,
        and bounded browser renderer. It fixes Aphrodite tenant, adapter,
        principal, parser, descriptor, and error authority after caller options
        are spread; its legacy fingerprint delegates to the shared canonical
        implementation. Three direct shared tests drive one real optional-
        adapter service with independent Veritas/V3 providers and tenant queue
        views over one record map using equal stream, publication, session,
        grant/operation, client, evidence, and request identities. They prove
        player, queue, fingerprint, scope, verifier, provider, evidence, result,
        and release isolation plus malformed fixed authority, cross-tenant and
        stale player records, unsupported native runtimes, capability mismatch,
        evidence mismatch, wrong durable authority, and stale-fingerprint
        rejection before protected access. An Aphrodite compatibility case
        additionally proves runtime-only tenant, adapter, principal, parser,
        descriptor, and error-factory overrides cannot weaken the wrapper while
        wrong-operation and released-replay product errors remain exact. All 321
        shared tests, 197 passing plus one intentionally skipped adapter test,
        the full Viewer target, 108 passing plus one intentionally skipped
        Streaming test, 86 Veritas tests, and all 14 Phase A tests pass,
        together with eight strict source/spec/consumer typechecks, graph-aware
        lint for all six affected and guard projects, dependency-inclusive
        shared (+6), adapter (+13), and Streaming (+14) builds, the direct
        Viewer production build, formatting/diff checks, two single-worker real
        Chromium immersive scenarios, and the supervised MediaMTX/PostgreSQL/
        SoftHSM/FFmpeg/Chromium gate. The real gate exercises the reconstructed
        Aphrodite wrapper from the exact succeeded protected player through
        compatible registration, privacy-bounded render/audio/orientation
        evidence, execution, restart replay, recovery/fencing, forced-RLS
        sibling denial, and release while retaining the wider protected-media
        assertions. This does not claim deployed Veritas/V3/Rail immersive
        providers, stores, player integrations, or client runtimes; native
        OpenXR/visionOS and real-headset WebXR conformance, ready non-Aphrodite
        HLS/DASH, playback grants, decoded Rail playback, final tenant
        equivalence, and a `first-party-live` flip remain open. Increment 8w
        extracts exact browser-publisher composition registration, bounded
        render-evidence admission, synchronous optional-provider execution,
        query, publisher-cascade release, and repeat-safe direct release as
        `LiveMediaTenantCompositionControl`. It validates and fixes one tenant,
        composition adapter, publisher-client adapter, and service principal;
        requires the exact unexpired succeeded browser/WebRTC publisher request
        and canonical fingerprint before readiness or reservation; owns the
        compatible one-to-four-source registration schema and canonical
        composition fingerprint; and reparses every reserved, staged, queried,
        publisher-selected, succeeded, and released record. Evidence must match
        the exact composition/client/runtime/layout/ordered sources/output
        before queue mutation, while provider results and teardown responses
        must name the fixed tenant/resource, adapter, kind, operation, and
        provider reference before a matching durable terminal record is
        accepted. `AphroditeCompositionControl` is now a thin tenant-#1 wrapper
        retaining its constructor, schema/type exports, exact product errors,
        forced-RLS PostgreSQL composition and publisher stores, independent
        edge-evidence join, leasing/fencing provider, Broadcaster
        routes/runtime, timing/ID seams, and Canvas/Web Audio compositor. It
        fixes Aphrodite's tenant, both adapters, principal, parser, descriptor,
        and error factory after caller options are spread; its legacy
        fingerprint delegates to the shared canonical implementation. Three
        direct shared tests drive one real optional-adapter service with
        independent Veritas/V3 providers and tenant queue views over one record
        map using equal stream, grant, operation/composition, client, evidence,
        and request identities. They prove publisher, queue, fingerprint, scope,
        verifier, provider, evidence, result, query, and release isolation plus
        malformed fixed authority, cross-tenant/stale/expired/inactive publisher
        records, evidence mismatch, wrong durable authority, stale fingerprints,
        and wrong provider/teardown identity rejection. An Aphrodite
        compatibility case additionally proves runtime-only tenant, adapters,
        principal, parser, descriptor, and error-factory overrides cannot weaken
        the wrapper while released replay retains the exact product error. All
        324 shared tests, 198 passing plus one intentionally skipped adapter
        test, the complete Broadcaster and Streaming targets, 86 Veritas tests,
        and all 14 Phase A tests pass, together with eight strict source/spec/
        consumer typechecks, graph-aware lint for all six affected and guard
        projects, dependency-inclusive shared (+6), adapter (+13), Streaming
        (+14), and Broadcaster (+16) builds, formatting/diff checks, three
        single-worker real Chromium composition scenarios, and the supervised
        MediaMTX/PostgreSQL/SoftHSM/FFmpeg/Chromium gate. The real gate
        exercises the reconstructed Aphrodite wrapper from the exact succeeded
        WHIP publisher through compatible registration, independently joined
        edge proof, privacy-bounded render/audio evidence, execution, restart
        replay, recovery/fencing, forced-RLS sibling denial, and repeat-safe
        release while retaining the wider protected-media assertions. This
        establishes reusable composition lifecycle authority, not deployed
        Veritas/V3/Rail composition providers, stores, publisher integrations,
        or client runtimes. Custom layouts, transitions/switching,
        GPU/OBS/native or distributed mixing, ready non-Aphrodite HLS/DASH,
        playback grants, decoded Rail playback, final tenant equivalence, and a
        `first-party-live` flip remain open. Increment 8x extracts entitlement-
        to-lease-to-grant orchestration, authenticated viewer mutations,
        optional player/immersive lifecycle sequencing, presence validation, and
        compensating lease cleanup as `LiveMediaTenantProtectedPlaybackControl`.
        It validates and fixes one tenant, player adapter, immersive adapter,
        and identity-denial result; parses bounded join inputs and
        product-supplied entitlement decisions; requires exact
        tenant/stream/subject/decision/client authority from joined and
        heartbeated viewer leases; and requires exact tenant, stream,
        publication, subject, and session authority from issued grants before
        optional client access. Player and immersive results must retain the
        fixed adapter, grant/operation identity, runtime/protocol or render
        geometry, and lifecycle status; leave and presence results must retain
        the authenticated fixed resource. Downstream grant or lifecycle failure
        compensates the already joined lease without replacing product policy.
        `AphroditeProtectedPlaybackControl` is now a thin tenant-#1 wrapper that
        preserves its positional constructor, public result/input/lifecycle
        types, methods, denial reasons, entitlement and identity policies,
        viewer and playback services, optional providers, Viewer routes, and
        Streaming real-edge composition while fixing Aphrodite and both adapter
        identities. Three direct shared tests use independent Veritas/V3
        policies, sessions, issuers, and lifecycle ports with equal user,
        stream, publication, decision, session, grant, and evidence identities.
        They prove issue/heartbeat/immersive/leave/presence isolation plus
        malformed entitlement, cross-tenant session/grant, wrong player or
        immersive adapter, missing principal, mismatched heartbeat/presence,
        downstream-access ordering, compensation, and optional-adapter denial.
        An Aphrodite compatibility case proves the positional wrapper rejects a
        sibling-tenant grant or player result and retains compensating cleanup.
        All 327 shared tests, 199 passing plus one intentionally skipped adapter
        test, the complete Viewer target, 108 passing plus one intentionally
        skipped Streaming test, 86 Veritas tests, and all 14 Phase A tests pass,
        together with strict source/spec/consumer typechecks, graph-aware lint
        for all six affected and guard projects, dependency-inclusive shared
        (+6), adapter (+13), and Streaming (+14) builds, the direct Viewer
        production build, formatting/diff checks, 12 single-worker Chromium
        HLS/DASH player and immersive scenarios, and the supervised MediaMTX/
        PostgreSQL/SoftHSM/FFmpeg/Chromium gate. The real gate exercises the
        reconstructed Aphrodite wrapper from SQL entitlement through exact
        leased session and protected grant, player registration/QoE, immersive
        registration/evidence, restart/recovery and RLS assertions, and final
        release while retaining the broader protected-media suite. This
        establishes reusable protected-playback orchestration, not shared
        product entitlement rules or deployed Veritas/V3/Rail policies, issuers,
        sessions, providers, ready HLS/DASH, decoded Rail playback, final tenant
        equivalence, or a `first-party-live` flip. Increment 8y closes the next
        edge-identity prerequisite exposed by the Veritas tenant audit. The
        shared SQL authority was already `(tenant, stream UUID)`, but MediaMTX
        path discovery still treated a bare stream UUID as globally unique.
        `@oshun/live-media` now owns the versioned
        `live-media.v1/<tenant>/<stream UUID>` codec, and the MediaMTX provider
        defaults to that canonical tenant/resource path. It filters a sibling
        tenant even when both tenants use the same stream UUID, rejects
        malformed paths inside its owned namespace, and accepts bare UUIDs only
        through an explicit `legacy-stream-id` compatibility mode. Every current
        Aphrodite provider composition opts into that legacy mode rather than
        receiving it implicitly; external-auth and lifecycle-hook routes
        dual-read canonical Aphrodite paths plus legacy UUIDs while rejecting a
        canonical sibling tenant path before durable state access. Veritas
        rehearsal contracts are versioned to `.2` and separate the product
        source ID from the substrate resource UUID; request/receipt authority
        now binds the exact Veritas resource, canonical media path, publication
        UUID, and canonical publication-specific HLS/DASH manifest paths.
        Equal-ID cross-tenant, legacy opt-in, malformed namespace,
        cross-resource, cross-path, and cross-publication adversarial coverage
        passes. All 328 shared tests, 108 passing plus one intentionally skipped
        Streaming test, 92 Veritas tests, and all 14 Phase A/consolidation tests
        pass, together with strict shared, shared-spec, Streaming, and Veritas
        typechecks; lint for all three affected projects; dependency-inclusive
        shared (+6) and Streaming (+14) builds; formatting/diff and stub checks;
        and the supervised real MediaMTX/PostgreSQL/SoftHSM/FFmpeg/Chromium
        gate. The real gate confirms the explicitly selected Aphrodite legacy
        path remains compatible; this increment does not claim that Aphrodite
        publishing has migrated to the canonical path or that Veritas/V3/Rail
        publishers, ready media, playback grants, decoded Rail playback, final
        tenant equivalence, or the `first-party-live` flip exist. Increment 8z
        extracts the production pipeline assembly itself. The server-only
        `createLiveMediaPipelineRuntime` fixes one tenant and constructs the
        durable job service, execution service, publication service, attempt
        executor, and fenced worker once from product-supplied stores and media
        adapters. Aphrodite production and real-gate restart compositions now
        use that shared factory without changing their public controls or
        deployment adapters. Direct tests run the same factory for Aphrodite,
        Veritas, and V3 Stage with an equal stream UUID and idempotency key,
        proving isolated ready HLS/DASH publications and immutable prefixes;
        hostile worker options cannot replace the fixed tenant. The supervised
        gate simultaneously publishes the equal UUID through Aphrodite's
        explicit legacy path and Veritas's canonical tenant path, proves
        provider isolation and decodes canonical Veritas edge HLS, durably
        registers the Veritas resource in PostgreSQL, and uses shared forced-RLS
        SQL stores plus the generic worker and real Neith/FFmpeg adapter to
        transcode that live RTSP source, persist a ready Veritas HLS/DASH
        publication, and independently decode both stored manifests. All 330
        shared tests, 108 passing plus one intentionally skipped Streaming test,
        92 Veritas tests, all 14 Phase A tests, focused typechecks/lint/builds,
        formatting/diff checks, and the real MediaMTX/PostgreSQL/SoftHSM/FFmpeg/
        Chromium gate pass. This establishes one reusable production-shaped
        assembly and canonical Veritas ingest-to-ready-media evidence, not the
        rehearsal-to-runtime wiring, deployed durable Veritas publisher grants,
        Veritas viewer/playback grants, decoded Rail playback, V3 production
        composition, Aphrodite canonical-path migration, final equivalence, or
        the `first-party-live` flip. Increment 8aa connects the audited Veritas
        rehearsal byte port to that shared runtime. A strict root contract and
        server-only `LiveMediaTestIngestRuntime` bind exact tenant/resource,
        length, SHA-256, one-MiB chunks, and a 64-MiB ceiling; fsync and retain
        a read-only content-addressed MPEG-TS input; drive only an isolated
        queue for the fixed tenant; and return its exact successful durable
        publication. Replays reuse the durable job/publication, while tenant,
        path, integrity, or queue violations fail closed. A thin Veritas adapter
        reparses the v2 request, binds the canonical Veritas path, fixes the
        bounded H.264/AAC 360p job, and maps only exact HLS/DASH keys at a
        credential-free test HTTPS origin into the existing frozen v2 receipt.
        The supervised gate generates real MPEG-TS bars/audio, passes them
        through the actual rehearsal pipeline and shared SQL Veritas runtime,
        runs real Neith and FFmpeg transcode plus HLS/DASH publication, and
        independently probes both stored manifests for H.264/AAC 640x360 media
        and positive duration. All 332 shared tests, 108 passing plus one
        intentionally skipped Streaming test, 94 Veritas tests, and all 14 Phase
        A tests pass with affected typecheck, lint, builds, frozen-lockfile
        validation, and the real MediaMTX/PostgreSQL/SoftHSM/FFmpeg/Chromium
        gate. This closes the rehearsal-to-runtime byte wiring only: the bridge
        remains synchronous, test-only, and isolated-queue-only. Deployed
        Veritas publisher grants and scheduling, viewer/playback grants, decoded
        Rail playback, V3 production composition, Aphrodite canonical-path
        migration, final equivalence, HG-3, and the `first-party-live` flip
        remain open. Increment 8ab replaces the real gate's process-local
        Veritas publisher credential with product-composed durable authority.
        The canonical root now exposes the injected tenant-fixed grant control
        without exposing server stores; `VeritasProductionPublisherGrantControl`
        fixes tenant `veritas`, owner `veritas`, and the immutable
        `v1.veritas-live` registry identity after all caller options. Its API
        accepts only principal and stream UUID while create/manage scopes,
        registration, authentication, rotation, and revocation remain inside the
        shared control. Direct Veritas tests prove exact delegation and reject
        hostile tenant/product/mapping options plus malformed stream identity.
        The supervised MediaMTX gate now issues through the Veritas wrapper into
        the forced-RLS PostgreSQL registry and publisher-grant stores,
        reconstructs the wrapper before publishing, rejects an unknown
        valid-shaped secret, authenticates a real FFmpeg SRT publisher on the
        canonical tenant path, decodes its edge HLS, and reconstructs the
        database client, stores, service, and wrapper while retaining exact
        grant authentication. All 332 shared tests, 108 passing plus one
        intentionally skipped Streaming test, 96 Veritas tests, and all 14 Phase
        A tests pass with affected typechecks, lint, builds, frozen-lockfile
        validation, formatting/diff checks, and the real
        MediaMTX/PostgreSQL/SoftHSM/FFmpeg/Chromium gate. This closes durable
        Veritas publisher-grant composition and real edge authentication at the
        code and local release-gate boundary, not a deployed long-running
        publisher/scheduler host. Scheduling, viewer/playback grants, decoded
        Rail playback, V3 production composition, Aphrodite canonical-path
        migration, final equivalence, HG-3, and the `first-party-live` flip
        remain open. Increment 8ac adds tenant-fixed Veritas viewer-session,
        playback-grant, and protected-playback controls; fixed authority fields
        include tenant/service principals, `veritas.player-client.v1`,
        `veritas.immersive.v1`, and bounded identity denial. The Rail gate can
        now accept exact HLS/DASH behind one explicit shared-media authority
        while its exported default stays fail-closed. Channel registration, lane
        admission, and the web player use that same authority ID, and the
        canonical browser player revalidates tenant, stream, protocol, API base,
        and manifest before credentialed playback. The supervised gate carries
        generated rehearsal bytes through the real Veritas SQL publication,
        signs a viewer-bound grant, mounts the actual Rail panel in
        Playwright-controlled Chromium, decodes both HLS and DASH with positive
        QoE, and proves presence, explicit lane release, zero presence, and
        immediate `VIEWER_SESSION_INACTIVE` token denial without placing the
        token in the DOM. This closes a local product-composed
        ingest-to-decoded-Rail slice, not deployment: the gate's player
        lifecycle remains test-only and in-memory; the default Rail composition
        has no authority; and no durable player adapter, playback-route host,
        long-running scheduler, V3 composition, Aphrodite canonical migration,
        final equivalence, HG-3, or production `first-party-live` flip is
        claimed. Increment 8ad migrates Aphrodite's production MediaMTX boundary
        from bare stream UUIDs to the canonical
        `live-media.v1/aphrodite/<stream UUID>` namespace. Broadcaster WHIP and
        native-SRT provisioning now carry that exact path; the shared browser
        policy binds authorization to the full tenant/resource WHIP suffix; the
        native TypeScript/Rust boundary validates and sends the canonical path;
        edge reconciliation, lifecycle callbacks, recording RTSP sources, and
        pipeline runtime composition agree on it. Separately shaped legacy RTMP
        and lifecycle callback bodies remain compatibility inputs, but a bare
        UUID in a MediaMTX `path` is rejected before grant lookup. Equal-ID
        sibling-tenant and bare-path adversarial coverage passes. The supervised
        real gate rejects a valid Aphrodite grant on a bare SRT path, then
        publishes, transcodes, records, composes, protects, and decodes
        Aphrodite and Veritas traffic through canonical tenant-qualified paths
        on the same edge. Affected shared, Aphrodite adapter, Streaming, and
        Broadcaster tests, four strict typechecks and lints, the Rust native
        publisher tests/build, dependency-inclusive builds, the 19-scenario
        single-worker Chromium gate, formatting/diff checks, and the supervised
        real-media gate pass. This closes Aphrodite's canonical-path migration,
        not deployment scheduling, durable Veritas player hosting, V3 production
        composition, final tenant equivalence, HG-3, or the production
        `first-party-live` flip. The parent RB.3 and equivalence-test checkboxes
        remain open. Increment 8ae adds the missing V3 Stage tenant-#3 product
        composition over the canonical shared-media controls. Pipeline jobs,
        publisher grants/resource mapping, leased viewer sessions, signed
        playback grants, and protected playback now fix tenant `v3-stage`,
        product-owned principals, the `v3.stage:<stream UUID>` external
        identity, Stage player/immersive adapters, and bounded identity denial
        after all injected options. Contract tests prove equal stream, job,
        publication, entitlement, and session identities remain isolated from a
        sibling Veritas tenant and hostile authority options cannot replace
        Stage ownership. The full Stage suite, strict typecheck, lint,
        dependency-inclusive build, Streaming regression checks, frozen-lockfile
        validation, formatting/diff checks, and the supervised real
        PostgreSQL/MediaMTX gate pass; the gate proves equal-ID durable
        Stage/Veritas resource and grant isolation plus reciprocal secret
        denial. This closes the V3 tenant-fixed authority composition only: no
        rendered artifact/catalog row, cook-to-Unreal binding, deployed
        scheduler/publisher/player host, final equivalence, or production
        `first-party-live` flip is claimed. The parent RB.3 and equivalence-test
        checkboxes remain open. Increment 8af now closes the cook's
        immutable-storage and public-delivery-verification portion. The
        tenant-fixed adapter writes only below
        `live-media.v1/v3-stage/catalog/v1` through the canonical shared
        create-only object-store contract, admits a closed role/MIME matrix,
        applies bounded role sizes and immutable caching, and accepts an exact
        existing object only as an idempotent replay. It rechecks storage and
        then retrieves the exact credential-free HTTPS object with redirects
        disabled; HTTP status, content type, length, and SHA-256 must all match
        before a private transient-file ffprobe pass proves a positive-duration
        video/audio stream or decodable artwork dimensions. Unit coverage binds
        all three roles through the full cook and rejects changed-key bytes,
        role/MIME substitution, credentialed origins, and escaped receipts. A
        focused Streaming release gate generates real H.264/AAC MP4, AAC M4A,
        and PNG bytes with FFmpeg, persists them through the canonical local
        create-only store, retrieves their exact delivery bytes, decodes all
        three with real ffprobe, and publishes only to an in-memory test
        catalog. Those generated bytes are release-gate evidence, not a rendered
        V3 artifact. Increment 8ag now closes the cook's authoritative V3
        release-evidence port. The dedicated
        `@oshun/v10-rail-channel-stage/release` entry point keeps V3
        authoring/export dependencies out of the browser-facing channel root.
        `V3StageRecordedReleaseGateAdapter` consumes the actual Saraswati
        recorded-authoring editor state and V3 concert-export readiness types,
        fixes item/version/concert identity, and requires every recorded
        authoring gate, the published Sequencer receipt, full provenance
        attachment, and GA cadence to agree. Ready export reports must be fresh
        and retain unique exact-subject canonical proofs plus matching verdicts
        for every non-human gate. A suite that declares human signoff
        additionally requires the exact fresh promotion and canonical
        `human_approval` proof; drill evidence, stale/future reports, duplicate,
        expired, substituted, detached, or contradictory proof state fails
        closed. Contract coverage uses the real recorded Saraswati state builder
        and exercises drill denial, identity substitution, stale export, proof
        substitution, missing/hostile promotion, and forged readiness. This is a
        release adapter, not deployed content. Increment 8ah now closes the
        durable candidate/Calliope source code boundary. The canonical OSHUN
        PostgreSQL schema stores immutable, SHA-256-bound candidate revisions
        and admits only one current `ready` version through a partial unique
        index. Transactional publication accepts exact idempotent replay,
        requires increasing versions, supersedes the prior revision, and makes
        withdrawal terminal for that version; bounded reads revalidate every
        indexed identity and the full projection hash. The projection consumes
        the owning V3 persona/concert/setlist/track and Calliope
        setlist/camera/streaming schemas, requires recording authority, exact V3
        track coverage and duration, a bijective title-preserving slot binding,
        shared Calliope identities, and a programming anchor present in all
        selected plans. Energy, section, and perspective derive from those plan
        values; numeric cut density requires a separately cited editorial
        measurement rather than parsing Calliope's prose cadence. Adversarial
        tests plus a disposable real-PostgreSQL full-migration, restart,
        supersession, and withdrawal gate pass. No production candidate row is
        seeded. Increment 8ai now closes the durable rendered-catalog
        writer/reader code boundary. Canonical OSHUN migration
        `20260721230000_v10_stage_rendered_catalog` stores immutable,
        SHA-256-bound catalog revisions, admits only one active version, and
        fences identity or payload mutation in PostgreSQL. Transactional
        publication accepts exact replay, requires increasing version and
        publication time, supersedes the former active row, and makes explicit
        withdrawal terminal; bounded playback reads return only due active rows
        after rebinding every indexed identity and recomputing the full item
        hash. Unit/adversarial coverage plus a disposable full-migration,
        restart, direct-tamper, concurrent-retry, supersession, and withdrawal
        PostgreSQL gate pass. No production catalog row is seeded. An Unreal
        renderer code boundary and real local UE5.5 release gate are now closed
        by increment 8aj. The minimal headless worker loads the exact persisted
        level, published LevelSequence, and uniquely labeled CineCamera; a
        native compilation barrier waits for assets/material shaders and flushes
        rendering commands so black placeholder frames or shader-cancellation
        shutdown cannot pass. The server-only adapter rebinds candidate/version,
        concert, export hash, and Sequencer identity; supervises Unreal without
        a shell; verifies the exact contiguous PNG manifest, dimensions, hashes,
        variation, and declared file set; enforces pixel-frame and scratch-space
        budgets; copies digest-authorized audio into a private job; and requires
        real FFmpeg/FFprobe H.264/AAC geometry, rate, frame-count, stream, and
        duration evidence. Sixteen adversarial tests, the 79-test Stage suite,
        typecheck, and lint pass. On this box the editor module builds, an
        isolated test-only fixture renders 24 distinct 640x360 RGBA frames
        through UE5.5/Lavapipe with exit 0, and the full adapter's real
        FFmpeg/FFprobe gate passes in 12.79 seconds with cleanup. No production
        binding or inventory is seeded. Increment 8ak now closes final local
        four-tenant equivalence without creating a second media stack. The Oshun
        BFF owns thin tenant-#4 Rail pipeline, publisher-grant, viewer-session,
        playback-grant, and protected-playback controls over
        `@oshun/live-media`; hostile constructor options cannot replace the
        fixed tenant, principals, product mapping, player/immersive adapters, or
        bounded identity denial. One cross-product suite exercises Aphrodite,
        Veritas, V3 Stage, and Rail with equal stream/job identities, proves
        exact tenant-local pipeline scopes, reciprocal publisher-secret denial,
        independent leased presence, cross-tenant lease rejection, and isolated
        teardown. The 333 shared, 199 Aphrodite-adapter, 79 Stage, 98 Veritas,
        21 Phase A, and four new BFF tests pass, as do the focused strict
        typecheck, lint, formatting, BFF production build, and the supervised
        real PostgreSQL/MediaMTX/SoftHSM/FFmpeg/Chromium Veritas-ingest-to-Rail
        HLS/DASH decode gate. A real first-party candidate, production binding
        and rendered artifact/catalog row, deployed hosts, and the production
        `first-party-live` default flip remain open. Increment 8al adds the
        actual Rail-app deployment composition: one credential-free public
        manifest binds exact source/tenant/stream/media/API authority, absence
        retains `not_configured`, hostile configuration fails closed, and the
        supervised real-media browser fixture now uses this production path. A
        focused desktop/mobile Playwright flow proves admission, authority
        identity, no autoplay, and release cleanup without fabricating decoded
        media. The production Next/PWA build and freshly rerun supervised real
        PostgreSQL/MediaMTX/SoftHSM/FFmpeg/Chromium ingest-to-decoded-Rail gate
        also pass with clean teardown. This closes client deployment wiring, not
        content or server deployment. Detailed evidence is in
        `RB3_APHRODITE_STREAMING_SUBSTRATE_AUDIT.md`._
- [x] Consolidation guard: a dependency-check test (repo lint or a custom check)
      asserting no second streaming stack appears under `libs/v10/*` or
      `apps/v10/*` — the Rail consumes the substrate only. _Implemented
      2026-07-19 in the existing `@oshun/v10-rail-phase-a` invariant project.
      The real-workspace gate walks both V10 ownership roots without following
      symlinks or generated directories; parses package dependencies plus
      static, re-exported, import-equals, type, `require`, and dynamic imports;
      and inspects target-specific, renamed, and table-form Cargo dependencies.
      It permits only the `@oshun/live-media` contract and its browser/native
      client subpaths. V10-owned live-media/streaming/ingest/transcode package
      roots, canonical server/private subpaths, direct Aphrodite or Neith media
      control, direct browser media engines, `@oshun/streaming`, and native
      FFmpeg/GStreamer/WebRTC/SRT stacks fail with deterministic diagnostics.
      Six adversarial focused cases, all fourteen Phase A tests, strict
      typecheck, and the project lint gate pass._
- [x] Tests: substrate unit/integration per organ; tenant equivalence suite; one
      full local end-to-end (test ingest → viewer playback in the Rail video
      lane). _Completed locally 2026-07-22 by increment 8ak. The final
      cross-product suite covers all four tenant-fixed compositions and the
      supervised real-media gate carries generated Veritas MPEG-TS through the
      canonical durable HLS/DASH pipeline into decoded playback in the actual
      Rail panel, including viewer heartbeat/presence/QoE, credential
      containment, release, revocation, and teardown. The parent extraction
      remains open for deployment and production-content requirements, not for
      missing automated equivalence or local ingest-to-viewer coverage._

### RB.4 Browser side-panel / PWA fallback surface (P1, §3.1)

- [x] Ship `apps/v10/web` standalone: PWA manifest + service worker (cold-cache
      tile rendering doubles as offline behavior), install flow, and a browser
      side-panel build target if the repo's extension patterns support it (there
      is an `apps/oshun/clipper-extension` — read it and reuse its side-panel
      approach if present). _Completed and verified 2026-07-21: the static
      export now owns a standalone manifest, install UI driven only by a real
      browser prompt, revisioned same-origin shell precache with a 32 MiB build
      budget, and network-first offline navigation without caching or
      fabricating BFF account state. The existing Clipper extension has no
      `side_panel` pattern, so the supported narrow browser fallback is the PWA
      rather than a second extension surface. The production export is 2.95 MB
      across 37 cached assets; Chromium reports zero installability errors._
  - [x] Honest capability matrix in-product: no tray, no always-on-top, no
        system screen-share detection — settings show these as shell-only with
        an install pointer (fail-loud, not silently absent). _Startup now
        carries the cardless browser/desktop capability ledger, including
        service-worker registration state and an honest browser-menu fallback
        when no install event exists._
  - [x] Keystroke discretion hide still works in-tab; `getDisplayMedia`
        self-share signal wired where available. _The Privacy surface can start
        and stop its own display-media capture; only that Rail-initiated track
        is observed, its end keeps protection active pending explicit restore,
        and Escape remains immediate online and offline._
- [ ] Claude-in-Chrome pass over the PWA build (install, offline cold-cache,
      discretion). _The named connector is unavailable in this environment, so
      this human/tool-specific sign-off remains open. Automated production
      Playwright covers the same installability, cache/offline, discretion, and
      self-share paths on desktop and mobile Chromium with accessibility checks
      (6/6 passing on 2026-07-21)._ _2026-09-18, reworded by the board audit: as
      for RA.4, the named connector is retired by CLAUDE.md in favour of
      Playwright. The 6/6 production Playwright run the note records is the
      sign-off; a second reader confirms it covers install, offline cold cache
      and discretion, and checks the box on that evidence._

### RB.5 Mobile surface (P1, §3.1)

- [x] Read the existing mobile app structure (`apps/oshun/mobile`) and its BFF
      wiring conventions (the 2026-07-04 memory notes the composer pattern).
      _Audited 2026-07-21: the implementation reuses the Expo Router shell,
      authenticated `OshunBffClient`, session/dev-token selection, domain route
      builder, web-anchor parity guard, channel manifests, `RingPolicy`,
      `DaypartEngine`, and `MergedTimeline`; no second mobile app or timeline
      composer was introduced._
- [ ] Rail-on-mobile inside the existing V1 mobile app (not a new app):
  - [x] Timeline as a feed screen (batched drips, rollups, deep links into the
        products' mobile surfaces where they exist). _Completed and verified
        2026-07-22: the cardless native feed, runtime-validated mobile
        projection, humane daypart batching/rollups, V1/V3 internal routes, web
        fallbacks, auth, retry behavior, and bounded server-side time window now
        have a deployed BFF composition. `server.ts` resolves a fixed,
        bearer-authenticated channel-runtime read model for exact user/window
        drips; all-or-none boot configuration, strict versioned envelopes,
        cross-user/window rejection, a 2,000-event response bound, HTTP timeout,
        and route-side manifest/time filtering keep the boundary fail-closed.
        Unconfigured environments remain honestly quiet rather than fabricating
        a feed. Adapter plus route coverage passes 11/11, the focused strict
        TypeScript gate passes, and the production BFF bundle builds._
  - [ ] Micro-acts on the go (case pin, review cards, tendencies) reusing the
        act schemas. _Quick acts are projected directly from canonical
        `MicroActSpec` manifests and Case Files pin plus Wonder Recall review
        launch through their declared deep-link fallbacks. Tendencies has no
        current channel manifest and is still owned by RC.2; executable native
        act handlers also remain open._
  - [x] Second-screen mode for TV: the overlay companion (Veritas ticker)
        rendered full-screen against an external broadcast. _Completed and
        verified 2026-07-22: the reduced-motion full-screen companion, live/idle
        states, trust meter, bounded claims, polling, and explicit exit consume
        the deployed BFF's configured Veritas runtime authority. The authority
        response is bearer-authenticated, schema/version validated through the
        canonical tracked-event parser, observation-time bound, and rejected if
        malformed or future-dated; an explicit null event alone produces the
        honest idle state. The mobile route still caps the rendered claim list
        at 24. Adapter plus route coverage passes 11/11, the focused strict
        TypeScript gate passes, and the production BFF bundle builds._
  - [x] Per-surface availability enforced from the manifest matrix (adult ring
        structurally absent — R0.1 schema + payload filtering server-side in the
        BFF, not client-side hiding). _The authenticated BFF projection applies
        `RingPolicy` to canonical manifests before serialization, then rejects
        malformed, non-mobile, adult, stale, and future drips. Contract
        refinement prevents timeline and second-screen channel escape; route
        tests prove the adult manifest and payload are structurally absent._
- [x] Maestro flows for the new screens per repo e2e conventions (guard suites
      exist for route parity — extend them). _Added to both core and regression
      suites with Home launch, feed, case pin, review, second-screen enter/exit,
      and accessibility selectors; Expo/web route parity guards cover both Rail
      routes. Maestro syntax and the platform command matrix pass. Native flow
      execution could not run on 2026-07-21 because this host exposes only Web
      Chromium (`adb devices` is empty and no iOS runtime is installed)._

---

## Phase RC — the game broadcast wave (P2, §11 Phase C)

### RC.1 Director cut profiles (§6.2 — developed against RB streams, lands here)

Substrate: V4 broadcast/commentary pipeline and V5 broadcast-director +
highlight ranker. Verify exact lib paths at task start (candidates found
2026-07-16: `libs/neith/broadcast`, `libs/neith/vp-broadcast`,
`libs/calliope/match-commentary`, `libs/uzume/broadcast`; the 2026-07-14 V4/V5
audits are the ground truth for which pipelines are real).

- [x] Locate and read the real director pipelines (V4 and V5); write the
      integration note mapping their cut-decision inputs/outputs.
- [x] Implement the two cut grammars as data-driven profiles in the owning
      pipelines (same pipeline, two profiles — not a fork):
  - [x] **Ambient cut**: wide shots, slow cut cadence, low-motion shot selection
        bias, commentary at murmur level or off.
  - [x] **Highlight cut**: fast cadence, replay insertion, full commentary.
  - [x] Profile switching by daypart transition (R0.3 events) and by user
        action; commentary loudness rides the audio-lane rules.
- [x] Exercise against Phase B streams (Veritas/V3 Stage program content) before
      any game channel exists — a profile-switch demo over a real stream,
      verified visually.
- [x] Tests: profile parameters demonstrably change cut decisions on a fixture
      match/event timeline (assert specific cut-cadence/shot-class deltas, not
      just "different").

  _Evidence (2026-07-21):
  [`RC1_DIRECTOR_CUT_PROFILE_INTEGRATION.md`](./RC1_DIRECTOR_CUT_PROFILE_INTEGRATION.md)
  records the source-level V4 replay/live-commentary and V5 live-director/
  highlight-ranker inputs, decisions, outputs, trust gates, adapter mapping, and
  honest non-goals. `@uzume/broadcast` now owns one validated
  `BroadcastDirectorCutProfileEngine` and one physical
  `BroadcastDirectorExecutionPipeline`; the ambient/highlight records alter
  cadence, shot/motion scoring, transition, replay eligibility, and commentary
  targets without forking execution. Its full suite passes 12 files / 45 tests,
  including exact same-timeline deltas (ambient cuts at 0/12 s and selects only
  low-motion wides; highlight cuts every 3 s and selects tight/tracking/replay/
  detail), real R0.3 `DaypartEngine` transitions, explicit user authority,
  registered replay playback, acknowledged switcher cuts, and commentary gain
  derived from a real `AudioLaneArbiter` holder/effective-loudness/user-volume
  state. The V10 web Stage exercise keeps the existing encoded progressive WebM
  mounted and playing while the real engine switches profiles; a sparse program
  monitor cue makes the selected wide/replay decision visible without claiming
  extra camera bytes. Playwright passes both cases on desktop and mobile
  Chromium (4/4), covering decode, exact profile/cadence/shot/commentary state,
  user switching, visual captures, accessibility, 44 px controls, overflow, no
  autoplay, and reduced motion. The full V10 web Vitest suite passes 35 files /
  158 tests; both affected lint scopes, both source typechecks, and the Uzume
  library compile pass. The Uzume all-spec `tsc` remains stopped by four
  pre-existing union-narrowing errors in
  `broadcast-switcher-integration-engine.spec.ts:107-110`; Vitest compiles and
  executes that full suite successfully. Per the repository's <32 GiB hard gate,
  the Next production build was not run on this 15 GiB host without user
  approval._

### RC.2 V2 Ghost Dojo League (§7.2 — announced destination, never gates the Rail)

Substrate: `libs/shakti/fighting-ruleset-bridge` (the one working cross-domain
game bridge). `GATED: V2 cooked content` — the review found zero cooked content;
build the league so it is real the day fighters are, and do not register the
channel until bouts are real.

- [x] Read the fighting-ruleset-bridge and the V2 fight-sim state; write the
      integration note: what can actually simulate a bout headlessly today.
- [ ] **RC.2.P1** _(added 2026-09-18: the prerequisite
      `RC2_GHOST_DOJO_HEADLESS_BOUT_INTEGRATION.md` names and no tracker
      carried)_ Build the headless, tendency-driven bout in V2 that the league
      needs. In `V2/ue` (Unreal 5.5 is on the executing machine; run the editor
      as `ueagent`): a commandlet or headless target that loads two real cooked
      fighters and a legal bout environment, a deterministic ghost policy that
      turns persisted tendencies into both fighters' frame inputs for
      `FV2SimWorld`, and the normal move, collision and round authorities run to
      a match outcome with nothing injected or preselected. **Verify:** the same
      seed, content version and tendencies reproduce the same result hash twice;
      changing one tendency changes a measured behaviour by a tested delta; the
      run is recorded with the exact Unreal command. If no fighter is cooked
      yet, the first step is to cook two — that is work, not a blocker. The
      cooked fighters, the stage and the headless bout are tasks V2.VS.2 to
      V2.VS.5 of `V2/V2_TODOS.md` section 0; this item adds the tendency-driven
      ghost policy on top of them.
- [ ] Persistent league service (progresses without you — the property is the
      product): _2026-09-18, board tag: waits on RC.2.P1, the headless
      tendency-driven bout._ `blocked:upstream`
  - [ ] League model: ladders, seasons, seeding, scheduling of bouts across the
        day; ghosts fight via the real ruleset bridge simulation (no canned
        results — if headless bout simulation isn't runnable yet, the league
        stays unshipped; that is the gate). _2026-09-18, board tag: waits on
        RC.2.P1, the headless tendency-driven bout._ `blocked:upstream`
  - [ ] Ghost tendency model: user-tunable parameters that demonstrably alter
        simulated bout behavior (assert in tests). _2026-09-18, board tag: waits
        on RC.2.P1, the headless tendency-driven bout._ `blocked:upstream`
  - [ ] Rival/upset detection over real results for drip generation.
        _2026-09-18, board tag: waits on RC.2.P1, the headless tendency-driven
        bout._ `blocked:upstream`
- [ ] Channel adapter `libs/v10/rail-channel-ghost-dojo`: _2026-09-18, board
      tag: waits on RC.2.P1, the headless tendency-driven bout._
      `blocked:upstream`
  - [ ] Tile: record, rank, next bout. Drip: results, upsets, rival callouts.
        _2026-09-18, board tag: waits on RC.2.P1, the headless tendency-driven
        bout._ `blocked:upstream`
  - [ ] Micro-acts: adjust tendencies, scout next opponent, call the outcome —
        `stakes: 'points-only'` enforced by R0.6's guard. _2026-09-18, board
        tag: waits on RC.2.P1, the headless tendency-driven bout._
        `blocked:upstream`
  - [ ] Video lane: auto-commentated bouts through RC.1 profiles (ambient cut
        during work). Live moment: your ghost's final. Spectator face: the
        featured league. _2026-09-18, board tag: waits on RC.2.P1, the headless
        tendency-driven bout._ `blocked:upstream`
- [ ] Tests: league progression determinism from a seed; tendency sensitivity;
      points-only guard on the prediction act; drip generation from real result
      streams. _2026-09-18, board tag: waits on RC.2.P1, the headless
      tendency-driven bout._ `blocked:upstream`
- Marketing it from Phase A is human gate **HG-4**, tracked once in §HG below
  (this line was a second box for it until 2026-09-18).

  _Gate evidence (2026-07-22):
  [`RC2_GHOST_DOJO_HEADLESS_BOUT_INTEGRATION.md`](./RC2_GHOST_DOJO_HEADLESS_BOUT_INTEGRATION.md)
  records the source-level audit. The Shakti bridge is an authoring-time
  frame-data transform, not a runtime simulator. V2's real `FV2SimWorld` can
  deterministically step supplied inputs, resolve supplied collision events,
  snapshot, hash, and replay the 200-manifest golden corpus. No current path
  turns tendencies into both fighters' inputs, derives runtime collisions, runs
  rounds to an authoritative winner, or loads real fighter/stage content. The
  named BotHarness only validates and hashes scripted action records, while
  CombatBot computes authored damage-minus-armor arithmetic without invoking
  `FV2SimWorld`; their referenced map, pawn, scripts, models, and input files
  are absent. `V2/ue/Content` has eight regional data assets, zero maps, and no
  cooked packages. The local UE 5.5 focused golden-corpus run was attempted as
  `ueagent`, but test discovery is blocked by an installed editor/EOS module
  build-ID mismatch documented in the note. Per the explicit no-canned-results
  rule, the league, channel registration, tests premised on real results, and
  mobile tendency act remain unchecked until the note's reopen criteria are
  met._

### RC.3 V7 Realm Surf + My Realm (§7.7 — creator tile first)

Substrate: `libs/maya/crucible-*` incl. `crucible-live`; Mawu economy sim (real
per 2026-07-14 audit). `GATED: network runtime` for public realm broadcast; the
creator face is NOT gated and leads.

- [x] Read the Mawu economy sim + crucible-live APIs; integration note: what
      overnight economy simulation actually produces per realm.
- [ ] **RC.3.P1** _(added 2026-09-18: the prerequisite
      `RC3_MY_REALM_ECONOMY_INTEGRATION.md` names and no tracker carried)_ Give
      V7 the realm-overnight authority My Realm reads: a versioned projection
      built from the authoritative Moremi, Nephthys and Abundantia event
      sequences (visitors, sales, inventory effects, incidents) with stable
      cursor and window reads; creator ownership and entitlement checks; and
      idempotent, persisted collaboration, price and governed-patch commands
      with optimistic concurrency and receipts. **Verify:** a harness advances a
      known realm night, reads the projection, runs each command, restarts the
      authority and observes the committed changes.
- [ ] **My Realm** (creator/player face — the shopkeeper's back-office glance):
      _2026-09-18, board tag: waits on RC.3.P1, the V7 realm-overnight
      authority._ `blocked:upstream`
  - [ ] Tile: your realm's overnight ticker (visitors, sales, sim events) from
        real economy-sim output. _2026-09-18, board tag: waits on RC.3.P1, the
        V7 realm-overnight authority._ `blocked:upstream`
  - [ ] Drip: notable sim events (sell-outs, visitor spikes, incident flags).
        _2026-09-18, board tag: waits on RC.3.P1, the V7 realm-overnight
        authority._ `blocked:upstream`
  - [ ] Micro-acts: approve a collab, adjust a price, greenlight a patch — each
        writing back to the real realm state through the governed crucible
        paths. _2026-09-18, board tag: waits on RC.3.P1, the V7 realm-overnight
        authority._ `blocked:upstream`
- [ ] **Realm Surf** (spectator face) —
      `GATED: network runtime + vendor-wired     safety`: channel-surfing live
      windows into UGC realms via crucible-live once the runtime exists; safety
      wall: vendor-wired moderation precedes any executable UGC in the video
      lane (fail-closed — no safety config, no surf). _2026-09-18, board tag:
      waits on RC.3.P1 and the crucible-live network runtime, and on a
      moderation vendor being contracted and configured, which is the owner's to
      arrange._ `blocked:upstream` `blocked:external`
- [ ] Tests: ticker reflects real sim deltas (assert against a simulated night's
      known outputs); micro-act writebacks round-trip; surf path fail-closed
      without safety config.

  _Gate evidence (2026-07-22):
  [`RC3_MY_REALM_ECONOMY_INTEGRATION.md`](./RC3_MY_REALM_ECONOMY_INTEGRATION.md)
  records the source-level Crucible and adjacent V7 authority audit. The real
  Crucible core currently produces deterministic game-balance outcomes, agent
  stats, generic team resource snapshots, event logs, and state hashes; its
  economy loop emits equal `resource_tick` gains and does not model realms,
  visitors, listings, sales, inventory depletion, incidents, or overnight
  windows. `crucible-live` analyzes supplied balance telemetry rather than
  streaming or simulating realms. Moremi, Nephthys, Abundantia, Eunomia, and the
  Mawu gateway contain substantial ledger, persistence, commerce, governance,
  gateway, and safety primitives, but the runnable Abundantia and Eunomia
  services expose only health routes, Nephthys is an in-process API, and no
  authenticated realm projection or persisted collaboration/price/patch command
  contract exists. Per the no-canned-data and round-trip requirements, My Realm
  and Realm Surf remain unregistered and their dependent items stay unchecked
  until the note's explicit reopen criteria are met._ _2026-09-18, board tag:
  waits on RC.3.P1, the V7 realm-overnight authority._ `blocked:upstream`

### RC.4 V5 Period Channel (§7.5 — newspaper + radio before world windows)

Substrate: V5 persona/daily systems + broadcast-director (real per audit;
`libs/uzume/*` — verify at task start), V8 case engine for the Mind Palace
layer.

- [x] Read the V5 simulation/persona/daily systems; integration note: what the
      world-sim actually produces daily that a newspaper can be compiled from.
- [ ] **RC.4.P1** _(added 2026-09-18: the prerequisite
      `RC4_PERIOD_DAILY_SIM_INTEGRATION.md` names and no tracker carried)_ Give
      V5 the daily event stream the newspaper compiles from: a persisted,
      versioned, per-save stream of committed outcomes with a cursor and state
      hash; a read boundary that returns a complete in-game day or fails loud;
      editorial eligibility and public-safety metadata per event class; and a
      TTS render receipt for sim-derived bulletins. Radio cue ids must resolve
      to playable, rights-cleared assets, which is the one part an agent cannot
      supply. **Verify:** an integration fixture advances a known period day and
      proves the exact events, their order and the issue-to-state provenance.
- [ ] **Daily newspaper**: procedurally real — compiled from what actually
      happened in the simulation (sim event log → editorial selection → layout),
      as drip (headlines) + a readable issue (tile deep-link). No Lorem-ipsum,
      no canned stories: if the sim isn't producing events, the paper doesn't
      print (fail-loud). _2026-09-18, board tag: waits on RC.4.P1, the V5 daily
      event stream._ `blocked:upstream`
- [ ] **Diegetic period radio** in the audio lane: program compiled from the
      period-audio assets + sim-derived interstitials (news bulletins read from
      the newspaper pipeline via the real TTS path); an audio-lane holder like
      Motion. _2026-09-18, board tag: waits on RC.4.P1, and its cue ids must
      resolve to rights-cleared period audio that does not exist yet._
      `blocked:upstream` `blocked:corpus`
- [x] **Mind Palace slow-drip case**: a V5-flavored case cooked on the V8 engine
      (RA.5 pipeline parameterized by V5 setting/cast data) dripping over days
      instead of hours. _Implemented 2026-07-22 in the existing governed
      [`@oshun/v10-case-files-cook`](../apps/v10/case-files-cook/README.md): a
      strict V5 snapshot contract binds real cast and setting records into the
      V8 canon/spec before Clew generation, and required geography now reaches
      ground truth. The unchanged Minos + DPLL + finite-domain CSP + G4–G8 +
      Daedalus + Ed25519 path emits a signed 3–14-day schedule. End-to-end and
      file-backed CLI tests prove six source cast members, four source
      locations, multi-day evidence, DST-stable local accusation time, eight
      green gates, and receipt verification._
- [ ] **World windows** (slow TV): `GATED: the world shipping` — streets/
      harbor/trains ambient-cut windows via RC.1 + RB.3 when render/runtime
      exists. _2026-09-18, board tag: waits on the V5 world runtime and render
      source the gate document names; no V5 tracker item produces it yet._
      `blocked:upstream`
- [ ] Channel adapter + tests: newspaper compiles deterministically from a
      fixture sim-day with correct editorial selection; radio program validity;
      case drip pacing.

  _Gate evidence (2026-07-22):
  [`RC4_PERIOD_DAILY_SIM_INTEGRATION.md`](./RC4_PERIOD_DAILY_SIM_INTEGRATION.md)
  records the source-level V5 audit. V5's real systems can advance the day
  clock, resolve an NPC schedule at a supplied time, evaluate a route crossing,
  close a period case with one deterministic headline, describe twelve planned
  Year-1 world events, and select descriptor-only radio segments. They do not
  persist or expose a complete per-save daily outcome log: schedule state is
  caller-supplied, the world-event records are authored plans rather than
  settlements, and a case headline is not an issue. Radio cue IDs have no
  checked-in audio media, the 18 station loops remain open in the V5 ledger, and
  bulletin injection accepts text but does not produce a TTS/audio receipt. Per
  the fail-loud/no-canned-story rule, the newspaper, derived radio, channel, and
  source-dependent tests remain unchecked until the note's reopen criteria are
  met. The independent V5-to-V8 slow-case adapter is now complete; world windows
  retain their explicit shipping gate._ _2026-09-18, board tag: waits on
  RC.4.P1, the V5 daily event stream._ `blocked:upstream`

### RC.5 V4 Match Channel (§7.4)

`GATED: V4 game launch`. Substrate: V4 commentary/broadcast pipeline with its
consent/bias gates evidence-gated fail-closed (audit 2026-07-14) — those gates
are a feature for public broadcast and must stay in the path.

- [ ] Channel adapter for the 24/7 auto-directed match channel: RC.1 profiles ×
      RB.3 substrate × the V4 pipeline; esports events as scheduled live
      moments + watch parties (RD.2).
- [ ] Player face: your squad's persistent campaign ticking between sessions
      (tile + drip from the real campaign sim).
- [x] Tests: the consent/bias gates remain in the broadcast path (a gate-removed
      configuration must fail closed); profile switching on daypart.

  _Gate evidence (2026-07-22):
  [`RC5_V4_MATCH_CHANNEL_INTEGRATION.md`](./RC5_V4_MATCH_CHANNEL_INTEGRATION.md)
  records the source-level launch, spectator, commentary, consent, and campaign
  audit. The new
  [`@oshun/v10-rail-channel-v4-match`](../libs/v10/rail-channel-v4-match/README.md)
  activation boundary has no permissive gate defaults: missing/failed consent or
  Calliope bias/quality authority, partial/stale participant review, any
  opt-out, incomplete personal-voice receipts, contradictory clearance, absent
  launch evidence, and non-live/cross-tenant media all fail closed before a
  manifest exists. Ten focused tests exercise those failures and real R0.3
  daypart profile switching. The 24/7 channel remains unchecked because V4's
  launch is 2026-10-01, its checked-in spectator portal synthesizes fixture
  telemetry and has no media segments, and no `v4-match` RB.3 tenant exists. The
  player face also remains unchecked: current V4 persistence saves supplied
  state and campaign completion, but no authority advances a squad between
  sessions. The note lists exact reopen criteria._

---

## Phase RD — rings and satellites (P3, §11 Phase D)

### RD.1 Watch surface (§3.1)

- [x] Read the existing watch companions (2026-07-03 memory: native watchOS +
      WearOS with phone bridge) and extend: ONE tile (the user's chosen
      channel) + haptic-gentle live-moment alerts (grant-3 moments only),
      honoring the availability matrix (no adult ring, structurally).
- [x] Text-only tile payloads reuse `textOnlyDegradation` verbatim.
- [x] Tests per existing watch test conventions; bridge payload contract test.
      _Implemented in the canonical `v10.watch-rail.1` contract, existing phone
      bridge, native watchOS/Wear OS codecs, cached one-channel surfaces, and
      the single Wear OS Rail tile. The ring type is structurally wellness or
      games only; alert payloads are structurally granted/effective-3 only and
      native haptics deduplicate while respecting disabled haptics and quiet
      hours. Contract/bridge/native parity coverage and host constraints are
      recorded in `V10/RD1_WATCH_SURFACE_INTEGRATION.md`._

### RD.2 TV / cast surface + watch parties (§3.1, §6.2)

- [x] Video lane full-screen on TV/cast (second-screen pairing from mobile —
      RB.5's mode is the remote); read existing cast infrastructure if any
      before building.
- [x] Watch parties: shared sessions on the RB.3 substrate's chat organ (V3
      Stage concerts and V4 esports as the content); adult ring excluded (R0.6
      wall); synced playback state.
- Human gate **HG-5**, tracked once in §HG below (this line was a second box for
  it until 2026-09-18): legal review of the moderation boundary for our chat
  next to docked third-party streams — until reviewed, watch-party chat is
  enabled only for first-party content (fail-closed default, enforced in code).
  _The human review remains open. The pre-review boundary is now structural:
  third-party sessions contain no chat room, and the RB.3 bridge rejects them
  before resolving a tenant control._
- [x] Tests: party session sync; ring exclusion; fail-closed third-party chat.
      _Completed 2026-07-22. The full-screen progressive/HLS/DASH receiver,
      authenticated program authority, mobile pairing/remote, revisioned and
      idempotent shared playback, Stage/V4-only contract, pre-allocation adult
      exclusion, and exact-resource RB.3 chat bridge are documented in
      `V10/RD2_TV_CAST_WATCH_PARTY_INTEGRATION.md`. Focused contract/kernel/BFF,
      Stage, mobile, web, accessibility, Playwright, formatting, type, and
      production-bundle evidence is recorded there. HG-5 itself remains
      deliberately unchecked pending legal review._

### RD.3 Aphrodite adult content ring (§7.10b, §9.1 — walled tenant)

`(HUMAN GATE HG-6 — policy/legal sign-off before any user-visible launch; build behind the wall.)`

- [x] Integrate Aphrodite's own age-verification service
      (`libs/aphrodite/age-verification`, `apps/aphrodite/auth`) as the
      verification assertion R0.6's opt-in path requires; flip that path from
      `not_configured` to real. _Completed 2026-07-22: Aphrodite Auth now issues
      a strict, PII-free, short-lived assertion from its canonical
      age-verification decision table through a service-authenticated internal
      route. The BFF validates the shared contract, exact subject, HTTPS and
      bounded response before translating it into R0.6's V1 assertion; inactive
      decisions deny opt-in and configuration, storage, network,
      malformed-proof, and upstream failures all fail closed. The canonical
      service now requires bounded jurisdiction-adequate age evidence, a
      sufficient verification level, a single recorded-jurisdiction read, and
      correct webhook session lookup. Focused contract, age-service, Auth, BFF,
      kernel typechecks and 12 tests pass; the remaining channel/surface work
      stays behind HG-6._
- [x] The channel: Aphrodite live content as a tenant of the RB.3 substrate (its
      own services already speak it post-extraction) inside the ring: separate
      brand identity end-to-end (distinct name/visual tokens — brand naming
      itself is part of HG-6), web/desktop only, private/wind-down dayparts
      only, discretion mode interlock (ring content cannot render with
      discretion unsupported or off — hard requirement). _Completed behind the
      HG-6 wall 2026-07-22: `@oshun/v10-rail-channel-aphrodite` fixes the real
      RB.3 tenant, stream, publication, HTTPS HLS/DASH source, and exact
      `v10.aphrodite.rb3-playback.v1` authority over the one canonical
      `@oshun/live-media` player. Its strict activator withholds the manifest
      unless exact adult access, surface, daypart, discretion, consent,
      body-dignity, aftercare, and shared-live-media gates all clear. The
      protected web surface requires a fresh entry gesture, collapses and
      destroys media on interlock loss, and exposes actionable stigma-free
      aftercare. Distinct near-black/warm-neutral/muted-consent tokens and the
      `Private live` label are explicitly `hg6-pending`; production registration
      remains prohibited until human naming/policy approval. Full architecture
      and evidence: `RD3_APHRODITE_ADULT_RING_INTEGRATION.md`._
- [x] Verify every R0.6 wall clause against the real channel (directory,
      recommendations, Ori input exclusion, watch-party exclusion, cross-promo
      exclusion, surface matrix) — rerun the RA.9 fixture suite against the live
      manifest. _Completed 2026-07-22: RA.9 now constructs the canonical
      Aphrodite live manifest rather than a hand-authored adult fixture and has
      independently named passing tests for the surface matrix, recommendations,
      default directory, Ori input, watch-party, cross-promotion, and daypart
      walls. Production unit and desktop/mobile browser coverage separately
      proves the pre-HG-6 channel remains absent from the shipped directory._
- [x] Inherit and enforce Aphrodite's consent/aftercare/body-dignity constraints
      at the Rail surface (read those libs; surface their consent gates in the
      viewing flow, fail-closed). _Completed 2026-07-22: activation consumes the
      canonical `ViewerConsentManager` and `BodyDignity`, denies inactive or
      paused sessions, viewer mismatch, pending warnings, missing per-trigger
      opt-in, or unsafe frames, and requires a strict exact-viewer/stream,
      post-observation, PII-free aftercare-readiness proof. The viewing flow
      surfaces cleared protections before entry and provides real support and
      return actions after immediate media teardown._
- [x] Tests: one per wall clause against the real channel; age-verification
      round-trip; discretion interlock. _Completed 2026-07-22: 100 focused
      Vitest assertions across the channel, Phase-A, kernel, web, BFF, Auth, and
      age-verification boundaries pass, plus 4/4 desktop/mobile Chromium flows
      with axe. Coverage includes exact-subject age assertion translation, every
      named wall clause, absent/wrong RB.3 authority, unsupported/off and
      screen-share discretion, live ready→held teardown, consent warnings and
      trigger opt-out, dignity rejection, aftercare failure/actionability, and
      production non-exposure. TypeScript, ESLint, Prettier, and frozen-lockfile
      checks pass; see `RD3_APHRODITE_ADULT_RING_INTEGRATION.md`._

### RD.4 Calendar-aware dayparts (§6.3, §11 Phase D)

- [x] Implement the `CalendarSource` seam from R0.3 for real: calendar
      integration per repo conventions (locate existing calendar integrations in
      the monorepo first — read before building), meeting detection clamping to
      deep-work ceiling during events, focus-time respect, user-visible
      explanation of every automatic clamp.
- [x] Tests: fixture calendars produce the expected daypart overrides;
      no-calendar-configured stays fail-loud/manual. _Completed 2026-07-22: V1
      now composes the existing per-user OAuth store and shared Google transport
      into a PII-free `CalendarSource`; active busy and focus-time intervals
      enforce canonical Deep work (ceiling 1, adult ineligible), focus time wins
      overlaps, and every automatic clamp has a local-time explanation. The
      authenticated BFF and connected web surface fail loudly to an explained
      persisted-manual posture for absent or unavailable calendars and hold
      ambient media while checking. Kernel, adapter, route, client, React, and
      production-surface Playwright fixtures cover clamps and failure states;
      see `RD4_CALENDAR_AWARE_DAYPARTS_INTEGRATION.md`._

---

## Cross-cutting tasks (from §10 and §12)

- [x] **X-1 Orphan reuse audit (§10):** read the three flagged
      complete-but-uncited assets — `libs/aphrodite/*` game-bridge adapters, the
      Calliope stage spec (partly covered in RA.8), and Concordia
      (`libs/oshun/concordia-integration` and/or its own home — locate it) — and
      record a reuse verdict for each against Rail components; file follow-up
      tasks here for any adopted reuse.
  - [x] **X-1a Adopted reuse — Calliope Stage:** retain Calliope's canonical
        setlist, camera, and streaming-plan schemas at the V3 Stage durable
        candidate boundary; never treat a plan as rendered or playable media.
        Completed by RA.8's direct `@calliope/stage/contracts` composition and
        exact-identity candidate validation.

    Evidence (2026-07-22):
    [`X1_ORPHAN_REUSE_AUDIT.md`](X1_ORPHAN_REUSE_AUDIT.md) records the full
    source-backed inventory and verdicts. All six Aphrodite bridge packages are
    substantial but process-local Aphrodite game simulations, not production
    integrations, and are rejected for Rail reuse against their plausible
    Hathor/V5, Isis/media, Lilith/Tara, Maya/Realm, Nike/Motion, and Nyx/sky
    touchpoints. Calliope is the one adopted orphan and is already bound
    canonically by RA.8. Concordia's actual homes are
    `libs/contracts/concordia`, `apps/concordia/orchestrator`, the thin Oshun
    integration, and the existing workbench; its mediation authority does not
    overlap a current Rail component, so it is not adopted. The six bridge
    targets pass 679 tests total; `@calliope/stage` and
    `@oshun/concordia-integration` test targets also pass.

- [x] **X-2 Consolidation guards (§10):** automated checks (lint rule or
      dependency-check tests) that (a) only `@oshun/content-signing` is used for
      signing across all `rail-*` code, (b) no duplicate channel-contract types
      exist outside `libs/contracts/src/v10`, (c) RB.3's
      no-second-streaming-stack guard. The duplication census (7 matchmaking, 5
      rollback, ~6 battle-pass, 3 voice/SFU, 2 C2PA signers) is the cautionary
      tale.

      Evidence (2026-07-22): `@oshun/v10-rail-phase-a` now owns a bounded,
      deterministic consolidation guard over the real `apps/v10` and
      `libs/v10` trees. It rejects alternate JavaScript/package and Rust/Cargo
      signing dependencies, raw Node/WebCrypto signing (including aliased,
      namespace, element-access, `require`, dynamic-import, re-export, and
      type-import forms), duplicate canonical contract declarations, renamed
      structural contract clones, and copied closed-enum vocabularies outside
      `libs/contracts/src/v10`. A symbol-census test keeps the guard aligned
      with every exported V10 channel-contract schema/type; existing RB.3 live
      media consolidation coverage remains in the same project target. The
      browser signing surface and all affected V10 fixtures now use
      `@oshun/content-signing`. Verification: Phase A 21/21 tests, content
      signing 7/7 tests, affected web 7/7 tests, desktop Chromium Playwright
      3/3, targeted typechecks and lint for all affected projects, and the
      content-signing build all pass; both repository-owned Nx test targets
      pass.

- [x] **X-3 The Thread composition (§7.1, §10):** implement the morning daypart
      as the composed ritual the V1 review specified (wake → today's practice →
      Veritas briefing (audio) → case opens → Daily Wonder → Nyx sky/weather) —
      a daypart-scoped composition over the house channels' real content, in the
      kernel's daypart programming (verify against the V1 review §4.1/§5.1 text
      before building). _Evidence (2026-07-22): `@oshun/v10-rail-thread` now
      composes one exact, morning-only six-slot program over canonical Tara,
      Veritas Live, Case Files, Wonder & Recall, and Nyx material; the generic
      kernel contract rejects reordered, substituted, cross-date, future, or
      malformed editions. The authenticated private/no-store BFF route applies
      the persisted schedule and V1 calendar clamp, returns 204 outside morning,
      and fail-closes deploy-authority output. The cardless web ritual is hidden
      by discretion, obeys global text-only mode, exposes shell deep links only
      when mounted, and starts Veritas audio only on an explicit press through
      the single arbiter. Kernel 172/172, Thread 5/5, Phase A 33/33, focused BFF
      7/7, and full web 178/178 tests pass; affected typechecks and graph-aware
      lint, the BFF production bundle and disposable-migrated-database artifact
      smoke check, frozen filtered install, and Axe-enabled desktop/mobile
      Playwright 2/2 also pass. Integration detail:
      `V10/X3_THREAD_COMPOSITION_INTEGRATION.md`._
- [x] **X-4 V1 house channels not otherwise covered (§7.1):** one adapter task
      each, after their substrate read (`libs/nyx/*`, `libs/tara/*`,
      `libs/arete/*`, `libs/oshun/domain-*`):
  - [x] **Nyx** sky-and-awe: tonight's sky events tile (real ephemeris from
        `libs/nyx/ephemeris`/`sky-clock`), aurora/sky-event drips, live sky cams
        in the video lane where real feeds exist (docked-third-party class
        initially), wind-down affinity.

        Evidence (2026-07-22): `@oshun/v10-rail-channel-nyx` now projects
        real `@nyx/ephemeris` moon culmination and genuine visible planetary
        conjunction calculations through `@nyx/sky-clock`'s above-horizon,
        location-bucketed nightly materialiser. Its strict Nyx tile exposes no
        precise coordinates; bounded `nyx.sky-event` drips carry the same real
        event authority. A concrete `@nyx/events` NOAA SWPC adapter produces
        `nyx.aurora` only for overlapping, locally plausible geomagnetic
        forecasts. An explicitly configured real feed may enter only as a
        `docked-third-party` video source; none is declared when no verified
        feed is configured. The calm manifest has no autoplay/elevation, no
        absence punishment, and `wind-down` affinity 1. Nyx 11/11 tests,
        channel/web/Phase A typechecks and lint, V10 web 166/166 tests, Phase A
        29/29 tests with Nyx in the post-pilot invariant set, frozen filtered
        lock validation, and production-directory Playwright 4/4 across
        desktop/mobile Chromium pass. Integration detail:
        `V10/X4_NYX_RAIL_CHANNEL_INTEGRATION.md`.

  - [x] **Tara** presence micro-channel: hourly bell (gentle drip, never an
        elevation), one-breath micro-act with real breath pacing from the Tara
        stack; explicitly no guilt mechanics (invariant-suite covered).

        Evidence (2026-07-22): `@oshun/v10-rail-channel-tara` reads the canonical
        coherent-breath cadence, accessibility fallback, and safety note
        directly from `@tara/features`, then paces exactly one five-second-in,
        five-second-out cycle through a strict Rail micro-act. IANA-local hour
        boundaries, including fractional offsets and DST, produce bounded
        `tara.hourly-bell` drips with no priority, interruption, delivery
        instruction, autoplay, live moment, or elevation path. The manifest and
        completion vocabulary contain no score, streak, reward, penalty, or
        obligation state. Tara is shipped in the production directory and added
        to the post-pilot invariant set without retroactively becoming a Phase A
        pilot. Tara 12/12 tests, Tara taxonomy 5/5 tests, channel/source/web/Phase
        A lint and typechecks, web 166/166 tests, Phase A 30/30 tests, frozen
        filtered lock validation, and production-directory Playwright 4/4 with
        automatic Axe coverage across desktop/mobile Chromium pass. Integration
        detail: `V10/X4_TARA_RAIL_CHANNEL_INTEGRATION.md`.

  - [x] **Arete** gentle progress tile: humane-streak semantics
        (`done|partial|skip|decline|miss` from `libs/arete/habits`) rendered as
        the tile; its semantics feed the R0.2 no-absence-punishment vocabulary.

        Evidence (2026-07-22): `@arete/habits/check-in-status` now consolidates
        the exact ordered humane vocabulary and its engaged/grace/no-count
        meanings; the habits recovery and friction models consume that shared
        authority. `@oshun/v10-rail-channel-arete` renders every status from an
        explicit user-scoped persisted check-in, never infers `miss` from
        absence, publishes the exact tuple in its manifest, and exposes no user
        id, count, score, flame, countdown, urgency, autoplay, drip, micro-act,
        live moment, or elevation path. Arete is shipped in the production
        directory and included in the post-pilot invariant set. The full habits
        suite passes 252/252, Arete channel 12/12, Phase A 31/31, web 166/166,
        all affected typechecks and lint, frozen filtered lock validation, and
        production-directory Playwright 4/4 with automatic Axe coverage across
        desktop/mobile Chromium pass. Integration detail:
        `V10/X4_ARETE_RAIL_CHANNEL_INTEGRATION.md`.

- [x] **X-5 Naming (§12.9):** the product is **V10** (D8), so `v10` is the code
      namespace; "the Rail" stays the working product name and "the Thread"
      names the morning ritual. The V3 venue collision is resolved in RA.8 as
      technical name **V3 Stage**, id `v3.stage`, while legacy V3 Saraswati
      implementation names remain distinct from the `@saraswati/*` industrial
      domain; final brand naming is `(HUMAN GATE HG-7)`.
- [x] **X-6 Source-doc sync:** after Phase A ships, update
      `V_SERIES_AMBIENT_RAIL.md` status header from "Concept / design
      exploration" and record deviations discovered during implementation (e.g.
      the RA.8 naming resolution, RB.3 substrate home). _Completed 2026-07-22:
      the source now reports Phase A as code-complete without claiming the open
      human exit gate, and records the implemented V10/Tauri ownership split,
      `v3.stage` naming boundary, canonical `libs/shared/live-media` substrate
      home and still-open deployment edge, VOD/premiere Stage truth, Thread
      composition boundary, and release-wording discipline. The source links
      back to this requirement ledger as the evidence authority._
- [x] **X-7 Docs-center entry:** add the Rail to the docs center per its
      conventions (architecture page: kernel, contract, lanes, rings, surfaces;
      link the source doc and this TODOS file). _Done 2026-07-16: V10 product
      space registered in the docs-center generator (`v10-rail`), with
      `V10/V10_features.md` + `V10/V10_ARCHITECTURE.md` covering
      kernel/contract/lanes/rings/surfaces and linking both source docs; portal,
      capability matrix, search index, and repo map regenerated to ten products;
      17 generator tests green._
- [x] **X-8 V10 product registration (D8):** register the Rail as V10 in the
      V-series machinery: add a V10 entry to
      `scripts/audit/capability-truth-registry.json` per its schema
      (`V_SERIES.md` is generated from it — never hand-edit its status claims);
      create the `V10/` product directory when the first product-level doc
      lands; fold V10 into the V-series review/audit cadence (product review +
      autonomous-content audit) alongside V1–V9. _Implemented 2026-07-22: the
      capability-truth registry and schema now require the tenth product and
      publish its evidence-backed blocked status; the bounded canonical
      verification manifest credits all 19 V10 Vitest configurations; the
      coherence manifest samples each credited configuration; and the
      autonomous-content seed/inventory machinery now extracts V10 beside V1–V9.
      `V10_PRODUCT_REVIEW_2026-07-22.md` records the independent product review,
      while the canonical autonomous-content audit contains the V10 findings,
      composition algorithms, evidence, and acceptance slice. The legacy
      `evidence/v1-v9` and dated audit filename remain stable locators, but
      their generated scope is V1–V10._

---

## §HG — Human/business gates (NOT agent-actionable; tracked for completeness)

These stay `[ ]` until a human closes them; agent tasks blocked by them say so
inline above.

- [ ] **HG-1** Phase A exit test: the author actually leaves the Rail docked
      next to Claude Code for a full week (instrumented by RA.9's dogfood
      report). `blocked:human`
- [ ] **HG-2** V3 Stage content operations: licensing/rights for third-party
      music video/concert content; first-party/generated content is not gated.
      `blocked:governance`
- [ ] **HG-3** Veritas first-party live coverage: rights + ops business proposal
      (§12.2 — its own proposal, not a tech feature). `blocked:governance`
- [ ] **HG-4** Ghost Dojo League go-to-market: announce-as-destination marketing
      from Phase A. `blocked:governance`
- [ ] **HG-5** Legal review of the docked-third-party moderation boundary (embed
      hosting vs content responsibility; watch-party chat adjacency).
      `blocked:governance`
- [ ] **HG-6** Adult-ring policy sign-off: age-verification adequacy, separate
      brand identity, jurisdiction review — before any user-visible launch of
      RD.3. `blocked:governance`
- [ ] **HG-7** Final product naming ("the Rail", "the Thread", the V3 Stage
      brand disambiguation). `blocked:human`
- [ ] **HG-8** Ori default-on decision: after the believability beta + cost
      ceiling data (RB.2), a human decides whether/for whom the narrator flag
      defaults on (§12.6). `blocked:human`
- [ ] **HG-9** App-store review strategy for mobile/watch satellites given the
      ring model (the matrix is enforced in code from day one; store policy
      conversations are human work). `blocked:governance`

---

## Completion definition

The checklist is done when: every non-gated `[ ]` above is `[x]` with
task-by-task verification per the ground rules; every gated task is either `[x]`
(gate opened, work done) or carries a dated skip note naming its gate; and the
RA.9 invariant suite + X-2 consolidation guards run green in CI.