# V7 Planning-Corpus Remediation — 2026-06-12

This log records the 2026-06-12 adversarial remediation of the V7 planning
corpus (`V7/V7_TODOS.md`, `V7/V7_ARCHITECTURE.md`, `V7/V7_DEPENDENCIES.md`,
`V7/V7_GAP_ANALYSIS.md`, `V7/V7_features.md`, `V7/ADVERSARIAL_EVAL_GATES.md`,
`V7/release/*`). It is the change log referenced by the completion-state-audit
banner at the top of `V7/V7_TODOS.md` and by the correction notes in
`V7/release/`.

**Why.** The V7 backlog reached 110/110 `[x]` — and `V7/release/` recorded
"Decision: launch-ready" — on 2026-06-02, three days after the feature spec was
written and **before any adversarial verification of V7 had ever been run**. The
on-disk reality: the UE client is ~2.2k LOC of skeleton C++ across six modules
with no netcode, no creator web view, and no attestation; the
realm/mesh/persistence "services" are single-file in-memory model +
adversarial-eval implementations with no network stack, no databases, and no
cluster; none of the named safety vendors
(PhotoDNA/PDQ/CSAI-Match/Thorn/Lantern/StopNCII/EAC) is integrated; the staged
rollout was never executed. Separately, an earlier renumbering of `V7_TODOS.md`
(which inserted §3 Trust Boundary and §4 Determinism) had never been propagated
to the cross-referencing docs, several features-spec'd product surfaces had zero
backlog tasks, several TODOS Done-when evals were absent from the gate
inventory, and key economy/performance parameters were unquantified.

Every change below was made per the V3/V5 audit pattern: each task judged
individually against code read on disk, one inline dated reason per re-mark,
nothing marked `[x]`.

---

## 1. Section-renumbering propagation

`V7_TODOS.md` is the only V7 doc with numbered sections; bare `§N` cites it. The
DAG, ordering rules, and reuse/external-dependency tables in
`V7_DEPENDENCIES.md` and the `§N` citations in `V7_GAP_ANALYSIS.md` Parts A–D
and `V7_ARCHITECTURE.md` still used the pre-renumbering scheme (Part E of the
gap analysis was already current).

- **`V7_DEPENDENCIES.md`** — build-order DAG fully re-keyed (now §1–§32 with §3
  Trust Boundary / §4 Determinism explicit); critical path re-keyed (§1 → §2 →
  §9 → §10 → §6 → §7 → §8 → §11); all four hard ordering rules re-keyed (§20
  Sekhmet gates §17; §9 sandbox precedes executable resources; §7 precedes §8;
  §4 determinism precedes §5/§8/§30); cross-version reuse table (16 rows) and
  external-dependency table (13 rows) re-keyed; SPOF section re-keyed. A dated
  re-keying note was added under the DAG.
- **`V7_GAP_ANALYSIS.md`** — all `§N` citations in Parts A–D re-keyed (e.g.,
  Moremi §4→§6, Danu §6→§8, Ixchel sandbox §7→§9, Nàná §9→§11, Pheme §10→§12,
  Mawu Studio §12→§14, Abundantia §14→§17, Sekhmet §16→§20/§21, anti-cheat
  §17→§22, moderation §18→§23, incarnation §19→§25); a dated re-keying note
  added to the citation conventions.
- **`V7_ARCHITECTURE.md`** — substrate-table forge-\* row (§7–§8, §13 → §9–§10,
  §15) and the Ixchel-runtime paragraph (§13 → §15).
- **`V7_features.md`** — cross-reference-convention examples updated to real
  targets (`§40` → `§30`; `deps§14` → `deps§3`).

**Verification (this pass).** A scripted sweep built the section map from
`grep '^## ' V7_TODOS.md` and checked all **168** bare-`§N` citations across the
four docs against per-section topic keywords. All resolve to existing sections;
every keyword-flagged candidate was manually read and confirmed topically
correct (reuse-table rows, critical-path chains, GAP rows B12, E9, E10, E14).
**Intentionally left:** `arch§"…"`/`features§"…"`/`maya§"…"` anchor-style
references (not section numbers), and `deps§"Ixchel"` at
`V7_ARCHITECTURE.md:161` (an anchor-style reference into the deps reuse table,
not a stale number).

## 2. Untasked features-spec'd surfaces → new backlog sections/tasks

All added as **unchecked** tasks with Done-when clauses in house style:

- **§33 Web Entry — Pixel Streaming and Tier-2 Fallback** _(new section, [P1])_
  — `apps/v7/mawu-web/` (thin Pixel-Streaming player),
  `apps/v7/mawu-web-fallback/` (three.js + WebGPU spectate/browse/limited play),
  and extension of the `trust-boundary`/`webview-escape` gates to both web
  surfaces. (features:204-206, features:389-391 — neither app exists.)
- **§34 Mawu Companion App** _(new section, judged [P2]: auxiliary mobile
  surface, not launch-blocking)_ — `apps/oshun/mobile` subroute for realm browse
  / character status / crew management / comms with minor-protection parity.
  (features:218, features:405.)
- **§35 Mawu Operator Console** _(new section, judged [P1]: the launch
  safety/economy bars depend on operator tooling)_ —
  `apps/oshun/admin/src/app/mawu/` with Kuanyin moderation queues (evidence
  attached), Sekhmet scan-queue p95 visibility, payout-run audits, and
  realm-registry administration. (features:219.)
- **§16 (four added tasks, [P1] — core hosting promise):** Solo/Listen hosting
  tiers with sub-2s host migration (features:467-481); realm promotion along the
  continuum (Solo → Listen → Dedicated → Meshed, same lock file, persistence
  migrating to Nephthys on leaving Solo; features:477-481); `V7/ue`
  `Plugins/MawuMode_*` GameFeature mode gating (arch:172 — `V7/ue/Plugins/` does
  not exist); AI cost-and-fidelity tiering degradation behaviors with
  telemetry-visible degraded state (features:1207-1218).
- **§14 (one added task):** realm asset-budget declaration + Mawu Studio linter
  warning naming offending assets/sizes (features§"Asset Budget and Streaming").

Net: **10 new tasks** (110 → 120).

## 3. Eval reconciliation (`ADVERSARIAL_EVAL_GATES.md` ↔ TODOS Done-whens)

- **Pointed at covering gates** (no new rows, per the inventory's existing
  composition claims): `runaway-script` and `host-tamper` (§9) → covered by the
  `sandbox-escape` gate's runaway-fuel / frozen-host-mutation fixtures;
  `prediction`, `interp`, `lagcomp` (§5) → sub-evals composed into the
  `netcode-loss` gate. The §5/§9 TODOS lines now name the covering gate.
- **Nine real gate rows added** (owner, measurable threshold, adversarial
  fixture, CI command): `webview-escape`, `event-tamper`, `auth-tamper`,
  `capability-deny`, `ban-evasion`, `overload`, `character-deletion-limit`,
  `generation-policy`, `accessibility`. None was judged subsumed by an existing
  row. Eval code was verified on disk for every added gate **except
  `generation-policy`**, whose row is explicitly marked
  specified-ahead-of-implementation with a planned CI command (no §14
  AI-assisted-creation code exists).
- **Thresholds quantified** (previously unquantified): `malware-corpus` — 100%
  detection (0 misses) on ≥200 known-bad samples including fractureiser-class
  droppers, 0 clean-set false positives, with an honest note that the current
  fixture corpus is far smaller; `grooming` — ≥90% precision / ≥85% recall on
  the synthetic corpus, 100% of flags routed to human review; `conflict` — 0
  false positives / 0 missed contradictions on the seeded sets; `colocation` — 0
  seeded pairs split at any tick; `fraud-graph` — 100% of seeded
  rings/topologies flagged, 0 flags on the clean control cohort.
- **Honest CI state recorded:** `.github/workflows/v7-ci.yml` and
  `scripts/v7/verify-adversarial-eval-gates.mjs` register only the original 20
  gates (verified by reading the verifier's gate list); the inventory header and
  footer say so, the verifier intentionally fails against the revised inventory
  until reworked, and §30's task was re-marked `[ ]` with the expanded
  Done-when.

## 4. Economy defaults committed

Committed 2026-06-12, amendable via the Eunomia governance process; recorded in
`V7_features.md` (Creator Economy + Dependency-Revenue Chains) and
`V7_ARCHITECTURE.md` (Abundantia payout engine):

- **Engagement pool = 40% of eligible platform net revenue** (the Fortnite/UEFN
  benchmark already cited in the corpus).
- **Dependency revenue = 10% of an item's gross revenue by default**, routed
  pro-rata to declared dependencies, operator-configurable 0–25%, never reducing
  the original creator below the ≥70% direct-sale floor.

Also adopted (same date) in features + arch performance budgets: client 60 fps
target / 16.7 ms on the reference tier with a 30 fps floor on minimum spec;
authority handoff ≤250 ms p99; Collection install p95 ≤120 s for 5 GB at 100
Mbit/s; Sekhmet scan-queue p95 ≤15 min upload-to-verdict; and the Pheme voice
scale budget (≤40 audible streams per listener post-AoI-culling, ≤2 mixing cores
per 256 concurrent speakers per node, radio/phone +≤8 streams, p95 mouth-to-ear
≤250 ms at 1,000 inhabitants).

## 5. Launch-readiness honesty (`V7/release/`)

- **`launch-readiness-review.md`** — Decision revised to **NOT launch-ready**
  (2026-06-12) with a correction preamble; every signoff bullet re-labeled
  `fixture-passed` with what the fixture does and does not prove; the 10000 bp
  (100%) anti-cheat/moderation precision-recall figures annotated as fixture-toy
  signatures (6 seeded cases, 0 FP/FN), not measured classifier performance
  against the 95% bar; the note that `pnpm run verify:v7 launch-readiness`
  asserted the original decision and now intentionally fails until reworked.
- **`launch-readiness-review.json`** — `decision: "not-launch-ready"`; every
  signoff `status: "signed-off"` → `"fixture-passed"` with
  `evidenceBasis: "in-repo adversarial fixture; not a production measurement"`;
  top-level `revisedAt` + `correctionNote` added.
- **`staged-rollout.json`** — all five stages (`creator-alpha`, `rp-beta`,
  `meshing-beta`, `economy-launch`, `general-availability`) `status: "met"` →
  `"planned"`, `decision: "advance"` → `"pending"`, each with a `correctionNote`
  stating the stage was never executed and that the recorded IR "drills" were
  code-level simulations (`run_incident_response_drill`); top-level
  `correctedAt` + `correctionNote`.
- **`README.md`** — correction preamble: the stage narratives are stage _plans_,
  not records; `pnpm run verify:v7 staged-rollout` intentionally fails until
  reworked to assert the honest state.

## 6. Audit snapshot rewritten (`V7_TODOS.md`)

The snapshot claimed "No `apps/v7/`, `libs/v7/`, or `V7/ue/` exists yet" — false
since ~2026-06-01. Rewritten to current reality and verified against disk this
pass: 8 services + `dev-hygiene` in `apps/v7/` (Rust: moremi-realm-server ~14.5k
LOC, sekhmet-scanner ~6.0k, danu-mesh-cluster ~3.3k, nephthys ~2.7k,
mawu-gateway ~2.5k, hera ~1.1k; TS: abundantia, eunomia), all single-file
in-memory model + adversarial-eval implementations; `libs/v7/` four packages
(contracts, realm-protocol ~4.4k, substrate-bridge ~2.5k, nana 128 lines);
`libs/maya/forge-{resolver,conflict,sandbox, compositor}` honest doc-commented
API skeletons (landed 2026-06-01; forge-compositor at 835 LOC carries the real
Loom/layer API); `V7/ue/` at ~2.2k LOC across 6 modules (measured 2,168) with no
netcode client, no prediction, no UI surfaces, no `Plugins/MawuMode_*`, no
attestation; missing entirely: `mawu-web`, `mawu-web-fallback`, companion app,
operator console (the `mawu-studio` web surface is two pages).

## 7. The 110-task adversarial re-marking (all 32 original sections)

Every original task was re-judged individually against code read on disk; each
carries a one-line dated inline reason. Rules applied: `[x]` kept **only** where
substantive matching code/fixtures were read and the task wording scopes to them
(honest skeleton-/fixture-scoped tasks); `[~]` where the algorithmic core + eval
exist but the Done-when requires a real client/server/cluster/vendor/operational
run that is unprovable in-repo; `[ ]` where the on-disk implementation is
plainly insufficient for the task text.

Final distribution over the 120 tasks (110 re-judged + 10 new):

| Mark  | Count | Meaning                                                                       |
| ----- | ----- | ----------------------------------------------------------------------------- |
| `[x]` | 36    | substantive matching code/fixtures read; task wording scopes to them          |
| `[~]` | 62    | real algorithm + eval in-repo; real-world/scale/integration proof outstanding |
| `[ ]` | 22    | plainly insufficient on disk (12 re-marked + 10 newly added)                  |

Representative re-marks (full reasons inline in `V7_TODOS.md`):

- **`[x]`→`[ ]` (examples):** §14 in-realm VR builder — `MawuBuilder` is two
  source files (~470 LOC) of placement-request validation, Sculpt/UvProject are
  enum values only; §14 AI-assisted creation — no generation code, no
  Isis/Sophia integration, no `generation-policy` eval anywhere; §12 proximity
  voice — only a 38-line client gain/pan function (`MawuVoiceMix.cpp`), no
  SFU/occlusion/audio-level eval; §3 creator web-view lockdown — no web view
  exists; §21 Thorn-class classifiers — local keyword heuristics only; §22
  hardened/signed/attested client; §30 expanded gate registration; §32 both
  rollout/launch tasks.
- **`[x]`→`[~]` (examples):** §8 AOI/split-merge/overload/degradation — real
  models + evals, no cluster; §11 characters/jobs/property/civic/whitelist —
  models + evals, no realm process or real Iris; §16 all six original hosting
  tasks — Agones CRD YAML rendered but nothing stood up; §20 scanning —
  heuristic stand-in below the ≥200-sample bar; §21 CSAM/voice/NCII/age tasks —
  pipelines exist, no vendor integrations; §25 passport — real `ori-model` crate
  but modeled destinations; §29 telemetry — schema + coverage eval, no producers
  or dashboards.
- **`[x]` kept (examples, fixture-/skeleton-scoped wording):** §1 service
  scaffolds and forge-\* skeleton tasks; §2 all three contracts tasks (codegen +
  drift + byte-identical-composition tests); §4 golden-replay CI gate; §5 wire
  protocol + composed `netcode-loss` gate; §8 `mesh-handoff` at exactly 200
  entities × 10,000 crossings with mid-handoff death injection (constant +
  assertions verified in `danu-mesh-cluster/src/lib.rs`) and `colocation`; §9
  all six sandbox tasks (real Wasmtime component model, fuel, AOT receipts,
  hostile corpus as a named CI step); §10 all four
  resolver/conflict/compositor/content-store tasks (real pubgrub 0.3); §11
  double-entry ledger + sink/auto-balancer; §17 publishing lifecycle +
  dependency-revenue computation; §18 all three economy-firewall tasks; §19 both
  governance tasks; §20 content-addressing/signing/step-up; §27 both commerce
  tasks.

## 8. Completion-state banner

A banner was added near the top of `V7_TODOS.md` (modeled on
`V5/V5_TODOS.md:40-54`): the original 110/110 state predated adversarial
verification; every task re-judged 2026-06-12 per this log; §33–§35 and the
§14/§16 tasks added for previously untasked surfaces; **V7 is in-progress, not
launch-ready**; no historical `[x]` is authoritative without its inline note.

---

## Remediation provenance

The work above was performed in two passes on 2026-06-12:

1. **Initial pass (interrupted):** items 1–8 — the renumbering propagation, the
   nine gate rows + threshold quantification, the economy/performance defaults,
   the `V7/release/` corrections, the audit-snapshot rewrite, the full 110-task
   re-marking, the 10 new tasks, and the banner.
2. **Completion pass (this log):** verified the initial pass against the diff
   and against code on disk, then finished the remainder:
   - Corrected the §17 dependency-revenue inline note, which overstated the code
     state: `dependencyShareBasisPoints` is caller-configurable in
     `abundantia-market-service`; the 10% default is a docs-level policy
     default, not yet a service-config default.
   - Corrected the §16 AI-degradation task citation features:1194-1204 →
     features:1207-1218 (the initial pass's own insertions had shifted the
     section).
   - Wrote this log (`V7/REMEDIATION_2026-06-12.md`), which the banner and
     release correction notes already referenced.

**Completion-pass verification results:**

- Section-citation sweep: 168/168 bare-`§N` citations across
  `V7_DEPENDENCIES.md` / `V7_GAP_ANALYSIS.md` / `V7_ARCHITECTURE.md` /
  `V7_features.md` resolve to existing `V7_TODOS.md` sections and were
  topic-checked (scripted keyword pass + manual read of every flagged line).
- JSON validity: `launch-readiness-review.json` and `staged-rollout.json` parse;
  all five stages `planned`/`pending` with correction notes.
- Spot-reads confirming inline-note claims: danu 200×10,000 handoff
  constants/assertions; `MawuBuilder` 499 LOC across 2 cpp + 2 headers;
  `MawuVoiceMix.cpp` exactly 38 lines; forge crate sizes (835/135/177/126);
  service LOC within rounding of the snapshot; UE tree 2,168 LOC, 6 modules, no
  `Plugins/`; verifier registers exactly the original 20 gates; eval code exists
  for all added gates except `generation-policy`; eunomia fork/ canonical-vote
  tests; `mawu-studio` web surface is two pages.
- Checkbox audit: every kept `[x]` (36) carries a dated inline reason; every
  `[~]` (62) and re-marked `[ ]` carries a dated inline reason; the 10 new tasks
  are unchecked with dated provenance notes.
- Final tally: **36 `[x]` / 62 `[~]` / 22 `[ ]`** (120 tasks).