Release map: the Reveal row ends a reveal only on what the observer perceives

Amends the model page to Defaulted ruling reveal-ends-on-perception (Soul
findings cut-contact-reveals.s2.perceived-destruction-never-ends-reveal and
unseen-departure-clears-contact): zone departure no longer empties books.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/aetheria-release-map.md

@@ -8135,7 +8135,7 @@ Aimed across 8 test files; FireControlCut12Tests pins ResolveAimPoint's cell ave
 | Track (`EntityInfoGathered[subject]`) | (observer, subject entity). | Seeded 0 on zone entry, revised each tick by each active sensor (passive gain, decay), plus one monostatic gain on the tick its own ping crosses the subject and one bistatic gain per published ping return (R2); removed when the subject leaves; cleared on Deactivate. Runtime only. | Sensor.Execute only, reading the observer's own receivers and its own published returns. Forbidden: shared-track writes (ruling shared-track-bearing-only), presenters, other ships, any read of another ship's Sensor state. |
 | Ping sweep (`Sensor._reached`, per pinging sensor) | (pinging sensor, ping). The set of subjects the wavefront has reached this ping, in the beam or not. | Cleared at Ping(); a subject joins on the first sweeping tick it lies inside the radius, and that is its one crossing (credited and painted only if inside the beam then); nothing joins after the ping's last step; emptied when the sensor is idle. Runtime only. | The pinging Sensor.Execute alone decides "this ping crossed this subject, once". Forbidden: another sensor or ship reading its radii; an interval sample standing in for it. |
 | Ping return (`PingReturn {Subject, IlluminatedRange, IlluminatedObscuration, MaxRange}` in the ally's `PingReturns`) | (receiving entity, pinging sensor, subject, tick). No id. | Posted by the pinger to each ally's inbox on the crossing tick; published in the zone pre-phase with paints (`PublishInbox`); lives exactly one tick. Never saved. | The pinger posts (it owns the illuminated leg and its own range); the receiving Sensor credits from its own Sensitivity, PingBoost, distance and sight line (it owns the receive leg). Forbidden: the pinger writing the ally's track; the ally reading the pinger. |
-| Reveal (`Reveal {Item, Channel, Bearing, Time}` in the observer's reveal book, keyed (subject, item)) | (observer, subject entity, revealed item), by reference. Channel is null for a reveal by inspection (cut inspection-scanner). | Created on the first act the observer's instruments receive, or for every live item when the observer's scanner completes a scan; Channel, Bearing and Time refreshed by each later act; kept when the item is later destroyed or removed out of the observer's sight, until the observer perceives that (a death or impact fact it can sense) or the sitting ends: Contact never reads the subject's live equipment or Durability (Defaulted ruling contact-reads-book-aim-reads-live); only the aiming read (IsRevealed, IsLocated: can this item be selected and fired at now) filters on the live item (Durability < .01 or off the subject); removed when the subject leaves the zone; cleared on Deactivate. Not decayed: memory of the sitting. Never saved. | `Entity.Sense` (once per Entity.Update) for light acts and heard emissions; `ReceivePaint` for paints; `Entity.RecordInspection` (called by the observer's own Scanner) for scans. Forbidden: Sensor's track loop, presenters, another ship, shared tracks. |
+| Reveal (`Reveal {Item, Channel, Bearing, Time}` in the observer's reveal book, keyed (subject, item)) | (observer, subject entity, revealed item), by reference. Channel is null for a reveal by inspection (cut inspection-scanner). | Created on the first act the observer's instruments receive, or for every live item when the observer's scanner completes a scan; Channel, Bearing and Time refreshed by each later act; ended for an item when the observer perceives its destruction, and for all of a subject's items when the observer perceives the subject's death or departure (acts received through the observer's own Sense step, never a subscription to the subject); a subject leaving the zone does not by itself empty any book: its entries stay unrefreshed and are pruned once the freshest is older than BearingMemory; Contact never reads the subject's live equipment or Durability, and only the aiming read (IsRevealed, IsLocated) filters on the live item (Durability < .01 or off the subject) (Defaulted ruling reveal-ends-on-perception); RecordReveal and its one removal counterpart are the book's only writers and its one membership gate; cleared on Deactivate. Not decayed: memory of the sitting. Never saved. | `Entity.Sense` (once per Entity.Update) for light acts and heard emissions; `ReceivePaint` for paints; `Entity.RecordInspection` (called by the observer's own Scanner) for scans. Forbidden: Sensor's track loop, presenters, another ship, shared tracks. |
 | Hull layout knowledge (derived by `Entity.LayoutOf(subject)`) | (observer, subject hull class). The class is the subject's HullData; the layout is its Hardpoints (type, position, shape). | Derived on read: the subject's HullData.Hardpoints while ContactOf(subject).Identified, else empty. Stored nowhere; never says what is fitted. | `Entity.LayoutOf` is the one derivation (ruling quiet-gear-identifiable-hull-layout-known). Readers: IsLocated, the target schematic, the player's cycle. |
 | Contact (`Contact`, derived by `Entity.ContactOf(subject)`) | (observer, subject). | Derived on read from track, reveals, the zone clock and `BearingMemory`; stored nowhere. Flags: Detected (tracked, or a reveal younger than BearingMemory), Tracked (track > TargetDetectionInfoThreshold, which is VisibleEntities), Classified (detected and any reveal), Identified (track >= TargetGearInfoThreshold, name kept, now the identify threshold). Bearing: the true bearing while tracked, else the freshest reveal's. | `Entity.ContactOf` is the one derivation. HUD and AI read it; VisibleEntities stays the tracked set. |
 | Located item (`FireControl.IsLocated(observer, item)`) and aim point | (observer, subject item). | Derived on every read: revealed, or on a hardpoint of a layout the observer holds. The aim point is the item's own cells when revealed, else its hardpoint's cells; the choice is frozen into the shot with Aimed. | FireControl (R10). TrySelectTargetItem and ResolvedTargetItem gate on IsLocated; anything that reads an item's stats or class (AI weapon choice, schematic weapon rows) gates on IsRevealed. |